kernel-grsec_full.patch

   1 diff -urNp linux-2.6.33/arch/alpha/include/asm/elf.h linux-2.6.33/arch/alpha/include/asm/elf.h
   2 --- linux-2.6.33/arch/alpha/include/asm/elf.h   2010-02-24 13:52:17.000000000 -0500
   3 +++ linux-2.6.33/arch/alpha/include/asm/elf.h   2010-03-07 12:23:35.885719847 -0500
   4 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
   5
   6  #define ELF_ET_DYN_BASE                (TASK_UNMAPPED_BASE + 0x1000000)
   7
   8 +#ifdef CONFIG_PAX_ASLR
   9 +#define PAX_ELF_ET_DYN_BASE    (current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
  10 +
  11 +#define PAX_DELTA_MMAP_LEN     (current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
  12 +#define PAX_DELTA_STACK_LEN    (current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
  13 +#endif
  14 +
  15  /* $0 is set by ld.so to a pointer to a function which might be
  16     registered using atexit.  This provides a mean for the dynamic
  17     linker to call DT_FINI functions for shared libraries that have
  18 diff -urNp linux-2.6.33/arch/alpha/include/asm/pgtable.h linux-2.6.33/arch/alpha/include/asm/pgtable.h
  19 --- linux-2.6.33/arch/alpha/include/asm/pgtable.h       2010-02-24 13:52:17.000000000 -0500
  20 +++ linux-2.6.33/arch/alpha/include/asm/pgtable.h       2010-03-07 12:23:35.885719847 -0500
  21 @@ -101,6 +101,17 @@ struct vm_area_struct;
  22  #define PAGE_SHARED    __pgprot(_PAGE_VALID | __ACCESS_BITS)
  23  #define PAGE_COPY      __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
  24  #define PAGE_READONLY  __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
  25 +
  26 +#ifdef CONFIG_PAX_PAGEEXEC
  27 +# define PAGE_SHARED_NOEXEC    __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
  28 +# define PAGE_COPY_NOEXEC      __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
  29 +# define PAGE_READONLY_NOEXEC  __pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
  30 +#else
  31 +# define PAGE_SHARED_NOEXEC    PAGE_SHARED
  32 +# define PAGE_COPY_NOEXEC      PAGE_COPY
  33 +# define PAGE_READONLY_NOEXEC  PAGE_READONLY
  34 +#endif
  35 +
  36  #define PAGE_KERNEL    __pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
  37
  38  #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
  39 diff -urNp linux-2.6.33/arch/alpha/kernel/module.c linux-2.6.33/arch/alpha/kernel/module.c
  40 --- linux-2.6.33/arch/alpha/kernel/module.c     2010-02-24 13:52:17.000000000 -0500
  41 +++ linux-2.6.33/arch/alpha/kernel/module.c     2010-03-07 12:23:35.885719847 -0500
  42 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs,
  43
  44         /* The small sections were sorted to the end of the segment.
  45            The following should definitely cover them.  */
  46 -       gp = (u64)me->module_core + me->core_size - 0x8000;
  47 +       gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
  48         got = sechdrs[me->arch.gotsecindex].sh_addr;
  49
  50         for (i = 0; i < n; i++) {
  51 diff -urNp linux-2.6.33/arch/alpha/kernel/osf_sys.c linux-2.6.33/arch/alpha/kernel/osf_sys.c
  52 --- linux-2.6.33/arch/alpha/kernel/osf_sys.c    2010-02-24 13:52:17.000000000 -0500
  53 +++ linux-2.6.33/arch/alpha/kernel/osf_sys.c    2010-03-07 12:23:35.885719847 -0500
  54 @@ -1205,6 +1205,10 @@ arch_get_unmapped_area(struct file *filp
  55            merely specific addresses, but regions of memory -- perhaps
  56            this feature should be incorporated into all ports?  */
  57
  58 +#ifdef CONFIG_PAX_RANDMMAP
  59 +       if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
  60 +#endif
  61 +
  62         if (addr) {
  63                 addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
  64                 if (addr != (unsigned long) -ENOMEM)
  65 @@ -1212,8 +1216,8 @@ arch_get_unmapped_area(struct file *filp
  66         }
  67
  68         /* Next, try allocating at TASK_UNMAPPED_BASE.  */
  69 -       addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
  70 -                                        len, limit);
  71 +       addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
  72 +
  73         if (addr != (unsigned long) -ENOMEM)
  74                 return addr;
  75
  76 diff -urNp linux-2.6.33/arch/alpha/mm/fault.c linux-2.6.33/arch/alpha/mm/fault.c
  77 --- linux-2.6.33/arch/alpha/mm/fault.c  2010-02-24 13:52:17.000000000 -0500
  78 +++ linux-2.6.33/arch/alpha/mm/fault.c  2010-03-07 12:23:35.885719847 -0500
  79 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
  80         __reload_thread(pcb);
  81  }
  82
  83 +#ifdef CONFIG_PAX_PAGEEXEC
  84 +/*
  85 + * PaX: decide what to do with offenders (regs->pc = fault address)
  86 + *
  87 + * returns 1 when task should be killed
  88 + *         2 when patched PLT trampoline was detected
  89 + *         3 when unpatched PLT trampoline was detected
  90 + */
  91 +static int pax_handle_fetch_fault(struct pt_regs *regs)
  92 +{
  93 +
  94 +#ifdef CONFIG_PAX_EMUPLT
  95 +       int err;
  96 +
  97 +       do { /* PaX: patched PLT emulation #1 */
  98 +               unsigned int ldah, ldq, jmp;
  99 +
 100 +               err = get_user(ldah, (unsigned int *)regs->pc);
 101 +               err |= get_user(ldq, (unsigned int *)(regs->pc+4));
 102 +               err |= get_user(jmp, (unsigned int *)(regs->pc+8));
 103 +
 104 +               if (err)
 105 +                       break;
 106 +
 107 +               if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
 108 +                   (ldq & 0xFFFF0000U) == 0xA77B0000U &&
 109 +                   jmp == 0x6BFB0000U)
 110 +               {
 111 +                       unsigned long r27, addr;
 112 +                       unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
 113 +                       unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
 114 +
 115 +                       addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
 116 +                       err = get_user(r27, (unsigned long *)addr);
 117 +                       if (err)
 118 +                               break;
 119 +
 120 +                       regs->r27 = r27;
 121 +                       regs->pc = r27;
 122 +                       return 2;
 123 +               }
 124 +       } while (0);
 125 +
 126 +       do { /* PaX: patched PLT emulation #2 */
 127 +               unsigned int ldah, lda, br;
 128 +
 129 +               err = get_user(ldah, (unsigned int *)regs->pc);
 130 +               err |= get_user(lda, (unsigned int *)(regs->pc+4));
 131 +               err |= get_user(br, (unsigned int *)(regs->pc+8));
 132 +
 133 +               if (err)
 134 +                       break;
 135 +
 136 +               if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
 137 +                   (lda & 0xFFFF0000U) == 0xA77B0000U &&
 138 +                   (br & 0xFFE00000U) == 0xC3E00000U)
 139 +               {
 140 +                       unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
 141 +                       unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
 142 +                       unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
 143 +
 144 +                       regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
 145 +                       regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
 146 +                       return 2;
 147 +               }
 148 +       } while (0);
 149 +
 150 +       do { /* PaX: unpatched PLT emulation */
 151 +               unsigned int br;
 152 +
 153 +               err = get_user(br, (unsigned int *)regs->pc);
 154 +
 155 +               if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
 156 +                       unsigned int br2, ldq, nop, jmp;
 157 +                       unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
 158 +
 159 +                       addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
 160 +                       err = get_user(br2, (unsigned int *)addr);
 161 +                       err |= get_user(ldq, (unsigned int *)(addr+4));
 162 +                       err |= get_user(nop, (unsigned int *)(addr+8));
 163 +                       err |= get_user(jmp, (unsigned int *)(addr+12));
 164 +                       err |= get_user(resolver, (unsigned long *)(addr+16));
 165 +
 166 +                       if (err)
 167 +                               break;
 168 +
 169 +                       if (br2 == 0xC3600000U &&
 170 +                           ldq == 0xA77B000CU &&
 171 +                           nop == 0x47FF041FU &&
 172 +                           jmp == 0x6B7B0000U)
 173 +                       {
 174 +                               regs->r28 = regs->pc+4;
 175 +                               regs->r27 = addr+16;
 176 +                               regs->pc = resolver;
 177 +                               return 3;
 178 +                       }
 179 +               }
 180 +       } while (0);
 181 +#endif
 182 +
 183 +       return 1;
 184 +}
 185 +
 186 +void pax_report_insns(void *pc, void *sp)
 187 +{
 188 +       unsigned long i;
 189 +
 190 +       printk(KERN_ERR "PAX: bytes at PC: ");
 191 +       for (i = 0; i < 5; i++) {
 192 +               unsigned int c;
 193 +               if (get_user(c, (unsigned int *)pc+i))
 194 +                       printk(KERN_CONT "???????? ");
 195 +               else
 196 +                       printk(KERN_CONT "%08x ", c);
 197 +       }
 198 +       printk("\n");
 199 +}
 200 +#endif
 201
 202  /*
 203   * This routine handles page faults.  It determines the address,
 204 @@ -131,8 +249,29 @@ do_page_fault(unsigned long address, uns
 205   good_area:
 206         si_code = SEGV_ACCERR;
 207         if (cause < 0) {
 208 -               if (!(vma->vm_flags & VM_EXEC))
 209 +               if (!(vma->vm_flags & VM_EXEC)) {
 210 +
 211 +#ifdef CONFIG_PAX_PAGEEXEC
 212 +                       if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
 213 +                               goto bad_area;
 214 +
 215 +                       up_read(&mm->mmap_sem);
 216 +                       switch (pax_handle_fetch_fault(regs)) {
 217 +
 218 +#ifdef CONFIG_PAX_EMUPLT
 219 +                       case 2:
 220 +                       case 3:
 221 +                               return;
 222 +#endif
 223 +
 224 +                       }
 225 +                       pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
 226 +                       do_group_exit(SIGKILL);
 227 +#else
 228                         goto bad_area;
 229 +#endif
 230 +
 231 +               }
 232         } else if (!cause) {
 233                 /* Allow reads even for write-only mappings */
 234                 if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
 235 diff -urNp linux-2.6.33/arch/arm/include/asm/elf.h linux-2.6.33/arch/arm/include/asm/elf.h
 236 --- linux-2.6.33/arch/arm/include/asm/elf.h     2010-02-24 13:52:17.000000000 -0500
 237 +++ linux-2.6.33/arch/arm/include/asm/elf.h     2010-03-07 12:23:35.885719847 -0500
 238 @@ -108,7 +108,14 @@ int dump_task_regs(struct task_struct *t
 239     the loader.  We need to make sure that it is out of the way of the program
 240     that it will "exec", and that there is sufficient room for the brk.  */
 241
 242 -#define ELF_ET_DYN_BASE        (2 * TASK_SIZE / 3)
 243 +#define ELF_ET_DYN_BASE                (TASK_SIZE / 3 * 2)
 244 +
 245 +#ifdef CONFIG_PAX_ASLR
 246 +#define PAX_ELF_ET_DYN_BASE    0x00008000UL
 247 +
 248 +#define PAX_DELTA_MMAP_LEN     ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
 249 +#define PAX_DELTA_STACK_LEN    ((current->personality == PER_LINUX_32BIT) ? 16 : 10)
 250 +#endif
 251
 252  /* When the program starts, a1 contains a pointer to a function to be
 253     registered with atexit, as per the SVR4 ABI.  A value of 0 means we
 254 diff -urNp linux-2.6.33/arch/arm/include/asm/kmap_types.h linux-2.6.33/arch/arm/include/asm/kmap_types.h
 255 --- linux-2.6.33/arch/arm/include/asm/kmap_types.h      2010-02-24 13:52:17.000000000 -0500
 256 +++ linux-2.6.33/arch/arm/include/asm/kmap_types.h      2010-03-07 12:23:35.885719847 -0500
 257 @@ -19,6 +19,7 @@ enum km_type {
 258         KM_SOFTIRQ0,
 259         KM_SOFTIRQ1,
 260         KM_L2_CACHE,
 261 +       KM_CLEARPAGE,
 262         KM_TYPE_NR
 263  };
 264
 265 diff -urNp linux-2.6.33/arch/arm/include/asm/uaccess.h linux-2.6.33/arch/arm/include/asm/uaccess.h
 266 --- linux-2.6.33/arch/arm/include/asm/uaccess.h 2010-02-24 13:52:17.000000000 -0500
 267 +++ linux-2.6.33/arch/arm/include/asm/uaccess.h 2010-03-07 12:23:35.889620809 -0500
 268 @@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
 269
 270  static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 271  {
 272 +       if ((long)n < 0)
 273 +               return n;
 274 +
 275         if (access_ok(VERIFY_READ, from, n))
 276                 n = __copy_from_user(to, from, n);
 277         else /* security hole - plug it */
 278 @@ -412,6 +415,9 @@ static inline unsigned long __must_check
 279
 280  static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
 281  {
 282 +       if ((long)n < 0)
 283 +               return n;
 284 +
 285         if (access_ok(VERIFY_WRITE, to, n))
 286                 n = __copy_to_user(to, from, n);
 287         return n;
 288 diff -urNp linux-2.6.33/arch/arm/kernel/kgdb.c linux-2.6.33/arch/arm/kernel/kgdb.c
 289 --- linux-2.6.33/arch/arm/kernel/kgdb.c 2010-02-24 13:52:17.000000000 -0500
 290 +++ linux-2.6.33/arch/arm/kernel/kgdb.c 2010-03-07 12:23:35.889620809 -0500
 291 @@ -190,7 +190,7 @@ void kgdb_arch_exit(void)
 292   * and we handle the normal undef case within the do_undefinstr
 293   * handler.
 294   */
 295 -struct kgdb_arch arch_kgdb_ops = {
 296 +const struct kgdb_arch arch_kgdb_ops = {
 297  #ifndef __ARMEB__
 298         .gdb_bpt_instr          = {0xfe, 0xde, 0xff, 0xe7}
 299  #else /* ! __ARMEB__ */
 300 diff -urNp linux-2.6.33/arch/arm/mach-at91/pm.c linux-2.6.33/arch/arm/mach-at91/pm.c
 301 --- linux-2.6.33/arch/arm/mach-at91/pm.c        2010-02-24 13:52:17.000000000 -0500
 302 +++ linux-2.6.33/arch/arm/mach-at91/pm.c        2010-03-07 12:23:35.889620809 -0500
 303 @@ -294,7 +294,7 @@ static void at91_pm_end(void)
 304  }
 305
 306
 307 -static struct platform_suspend_ops at91_pm_ops ={
 308 +static const struct platform_suspend_ops at91_pm_ops ={
 309         .valid  = at91_pm_valid_state,
 310         .begin  = at91_pm_begin,
 311         .enter  = at91_pm_enter,
 312 diff -urNp linux-2.6.33/arch/arm/mach-omap1/pm.c linux-2.6.33/arch/arm/mach-omap1/pm.c
 313 --- linux-2.6.33/arch/arm/mach-omap1/pm.c       2010-02-24 13:52:17.000000000 -0500
 314 +++ linux-2.6.33/arch/arm/mach-omap1/pm.c       2010-03-07 12:23:35.889620809 -0500
 315 @@ -647,7 +647,7 @@ static struct irqaction omap_wakeup_irq
 316
 317
 318
 319 -static struct platform_suspend_ops omap_pm_ops ={
 320 +static const struct platform_suspend_ops omap_pm_ops ={
 321         .prepare        = omap_pm_prepare,
 322         .enter          = omap_pm_enter,
 323         .finish         = omap_pm_finish,
 324 diff -urNp linux-2.6.33/arch/arm/mach-omap2/pm24xx.c linux-2.6.33/arch/arm/mach-omap2/pm24xx.c
 325 --- linux-2.6.33/arch/arm/mach-omap2/pm24xx.c   2010-02-24 13:52:17.000000000 -0500
 326 +++ linux-2.6.33/arch/arm/mach-omap2/pm24xx.c   2010-03-07 12:23:35.889620809 -0500
 327 @@ -326,7 +326,7 @@ static void omap2_pm_finish(void)
 328         enable_hlt();
 329  }
 330
 331 -static struct platform_suspend_ops omap_pm_ops = {
 332 +static const struct platform_suspend_ops omap_pm_ops = {
 333         .prepare        = omap2_pm_prepare,
 334         .enter          = omap2_pm_enter,
 335         .finish         = omap2_pm_finish,
 336 diff -urNp linux-2.6.33/arch/arm/mach-omap2/pm34xx.c linux-2.6.33/arch/arm/mach-omap2/pm34xx.c
 337 --- linux-2.6.33/arch/arm/mach-omap2/pm34xx.c   2010-02-24 13:52:17.000000000 -0500
 338 +++ linux-2.6.33/arch/arm/mach-omap2/pm34xx.c   2010-03-07 12:23:35.889620809 -0500
 339 @@ -650,7 +650,7 @@ static void omap3_pm_end(void)
 340         return;
 341  }
 342
 343 -static struct platform_suspend_ops omap_pm_ops = {
 344 +static const struct platform_suspend_ops omap_pm_ops = {
 345         .begin          = omap3_pm_begin,
 346         .end            = omap3_pm_end,
 347         .prepare        = omap3_pm_prepare,
 348 diff -urNp linux-2.6.33/arch/arm/mach-pnx4008/pm.c linux-2.6.33/arch/arm/mach-pnx4008/pm.c
 349 --- linux-2.6.33/arch/arm/mach-pnx4008/pm.c     2010-02-24 13:52:17.000000000 -0500
 350 +++ linux-2.6.33/arch/arm/mach-pnx4008/pm.c     2010-03-07 12:23:35.889620809 -0500
 351 @@ -116,7 +116,7 @@ static int pnx4008_pm_valid(suspend_stat
 352                (state == PM_SUSPEND_MEM);
 353  }
 354
 355 -static struct platform_suspend_ops pnx4008_pm_ops = {
 356 +static const struct platform_suspend_ops pnx4008_pm_ops = {
 357         .enter = pnx4008_pm_enter,
 358         .valid = pnx4008_pm_valid,
 359  };
 360 diff -urNp linux-2.6.33/arch/arm/mach-pxa/pm.c linux-2.6.33/arch/arm/mach-pxa/pm.c
 361 --- linux-2.6.33/arch/arm/mach-pxa/pm.c 2010-02-24 13:52:17.000000000 -0500
 362 +++ linux-2.6.33/arch/arm/mach-pxa/pm.c 2010-03-07 12:23:35.889620809 -0500
 363 @@ -95,7 +95,7 @@ void pxa_pm_finish(void)
 364                 pxa_cpu_pm_fns->finish();
 365  }
 366
 367 -static struct platform_suspend_ops pxa_pm_ops = {
 368 +static const struct platform_suspend_ops pxa_pm_ops = {
 369         .valid          = pxa_pm_valid,
 370         .enter          = pxa_pm_enter,
 371         .prepare        = pxa_pm_prepare,
 372 diff -urNp linux-2.6.33/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.33/arch/arm/mach-pxa/sharpsl_pm.c
 373 --- linux-2.6.33/arch/arm/mach-pxa/sharpsl_pm.c 2010-02-24 13:52:17.000000000 -0500
 374 +++ linux-2.6.33/arch/arm/mach-pxa/sharpsl_pm.c 2010-03-07 12:23:35.889620809 -0500
 375 @@ -892,7 +892,7 @@ static void sharpsl_apm_get_power_status
 376  }
 377
 378  #ifdef CONFIG_PM
 379 -static struct platform_suspend_ops sharpsl_pm_ops = {
 380 +static const struct platform_suspend_ops sharpsl_pm_ops = {
 381         .prepare        = pxa_pm_prepare,
 382         .finish         = pxa_pm_finish,
 383         .enter          = corgi_pxa_pm_enter,
 384 diff -urNp linux-2.6.33/arch/arm/mach-sa1100/pm.c linux-2.6.33/arch/arm/mach-sa1100/pm.c
 385 --- linux-2.6.33/arch/arm/mach-sa1100/pm.c      2010-02-24 13:52:17.000000000 -0500
 386 +++ linux-2.6.33/arch/arm/mach-sa1100/pm.c      2010-03-07 12:23:35.889620809 -0500
 387 @@ -120,7 +120,7 @@ unsigned long sleep_phys_sp(void *sp)
 388         return virt_to_phys(sp);
 389  }
 390
 391 -static struct platform_suspend_ops sa11x0_pm_ops = {
 392 +static const struct platform_suspend_ops sa11x0_pm_ops = {
 393         .enter          = sa11x0_pm_enter,
 394         .valid          = suspend_valid_only_mem,
 395  };
 396 diff -urNp linux-2.6.33/arch/arm/mm/fault.c linux-2.6.33/arch/arm/mm/fault.c
 397 --- linux-2.6.33/arch/arm/mm/fault.c    2010-02-24 13:52:17.000000000 -0500
 398 +++ linux-2.6.33/arch/arm/mm/fault.c    2010-03-07 12:23:35.889620809 -0500
 399 @@ -166,6 +166,13 @@ __do_user_fault(struct task_struct *tsk,
 400         }
 401  #endif
 402
 403 +#ifdef CONFIG_PAX_PAGEEXEC
 404 +       if (fsr & FSR_LNX_PF) {
 405 +               pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
 406 +               do_group_exit(SIGKILL);
 407 +       }
 408 +#endif
 409 +
 410         tsk->thread.address = addr;
 411         tsk->thread.error_code = fsr;
 412         tsk->thread.trap_no = 14;
 413 @@ -357,6 +364,33 @@ do_page_fault(unsigned long addr, unsign
 414  }
 415  #endif                                 /* CONFIG_MMU */
 416
 417 +#ifdef CONFIG_PAX_PAGEEXEC
 418 +void pax_report_insns(void *pc, void *sp)
 419 +{
 420 +       long i;
 421 +
 422 +       printk(KERN_ERR "PAX: bytes at PC: ");
 423 +       for (i = 0; i < 20; i++) {
 424 +               unsigned char c;
 425 +               if (get_user(c, (__force unsigned char __user *)pc+i))
 426 +                       printk(KERN_CONT "?? ");
 427 +               else
 428 +                       printk(KERN_CONT "%02x ", c);
 429 +       }
 430 +       printk("\n");
 431 +
 432 +       printk(KERN_ERR "PAX: bytes at SP-4: ");
 433 +       for (i = -1; i < 20; i++) {
 434 +               unsigned long c;
 435 +               if (get_user(c, (__force unsigned long __user *)sp+i))
 436 +                       printk(KERN_CONT "???????? ");
 437 +               else
 438 +                       printk(KERN_CONT "%08lx ", c);
 439 +       }
 440 +       printk("\n");
 441 +}
 442 +#endif
 443 +
 444  /*
 445   * First Level Translation Fault Handler
 446   *
 447 diff -urNp linux-2.6.33/arch/arm/mm/mmap.c linux-2.6.33/arch/arm/mm/mmap.c
 448 --- linux-2.6.33/arch/arm/mm/mmap.c     2010-02-24 13:52:17.000000000 -0500
 449 +++ linux-2.6.33/arch/arm/mm/mmap.c     2010-03-07 12:23:35.889620809 -0500
 450 @@ -63,6 +63,10 @@ arch_get_unmapped_area(struct file *filp
 451         if (len > TASK_SIZE)
 452                 return -ENOMEM;
 453
 454 +#ifdef CONFIG_PAX_RANDMMAP
 455 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
 456 +#endif
 457 +
 458         if (addr) {
 459                 if (do_align)
 460                         addr = COLOUR_ALIGN(addr, pgoff);
 461 @@ -75,10 +79,10 @@ arch_get_unmapped_area(struct file *filp
 462                         return addr;
 463         }
 464         if (len > mm->cached_hole_size) {
 465 -               start_addr = addr = mm->free_area_cache;
 466 +               start_addr = addr = mm->free_area_cache;
 467         } else {
 468 -               start_addr = addr = TASK_UNMAPPED_BASE;
 469 -               mm->cached_hole_size = 0;
 470 +               start_addr = addr = mm->mmap_base;
 471 +               mm->cached_hole_size = 0;
 472         }
 473
 474  full_search:
 475 @@ -94,8 +98,8 @@ full_search:
 476                          * Start a new search - just in case we missed
 477                          * some holes.
 478                          */
 479 -                       if (start_addr != TASK_UNMAPPED_BASE) {
 480 -                               start_addr = addr = TASK_UNMAPPED_BASE;
 481 +                       if (start_addr != mm->mmap_base) {
 482 +                               start_addr = addr = mm->mmap_base;
 483                                 mm->cached_hole_size = 0;
 484                                 goto full_search;
 485                         }
 486 diff -urNp linux-2.6.33/arch/arm/plat-s3c/pm.c linux-2.6.33/arch/arm/plat-s3c/pm.c
 487 --- linux-2.6.33/arch/arm/plat-s3c/pm.c 2010-02-24 13:52:17.000000000 -0500
 488 +++ linux-2.6.33/arch/arm/plat-s3c/pm.c 2010-03-07 12:23:35.889620809 -0500
 489 @@ -355,7 +355,7 @@ static void s3c_pm_finish(void)
 490         s3c_pm_check_cleanup();
 491  }
 492
 493 -static struct platform_suspend_ops s3c_pm_ops = {
 494 +static const struct platform_suspend_ops s3c_pm_ops = {
 495         .enter          = s3c_pm_enter,
 496         .prepare        = s3c_pm_prepare,
 497         .finish         = s3c_pm_finish,
 498 diff -urNp linux-2.6.33/arch/avr32/include/asm/elf.h linux-2.6.33/arch/avr32/include/asm/elf.h
 499 --- linux-2.6.33/arch/avr32/include/asm/elf.h   2010-02-24 13:52:17.000000000 -0500
 500 +++ linux-2.6.33/arch/avr32/include/asm/elf.h   2010-03-07 12:23:35.889620809 -0500
 501 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
 502     the loader.  We need to make sure that it is out of the way of the program
 503     that it will "exec", and that there is sufficient room for the brk.  */
 504
 505 -#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
 506 +#define ELF_ET_DYN_BASE                (TASK_SIZE / 3 * 2)
 507
 508 +#ifdef CONFIG_PAX_ASLR
 509 +#define PAX_ELF_ET_DYN_BASE    0x00001000UL
 510 +
 511 +#define PAX_DELTA_MMAP_LEN     15
 512 +#define PAX_DELTA_STACK_LEN    15
 513 +#endif
 514
 515  /* This yields a mask that user programs can use to figure out what
 516     instruction set this CPU supports.  This could be done in user space,
 517 diff -urNp linux-2.6.33/arch/avr32/include/asm/kmap_types.h linux-2.6.33/arch/avr32/include/asm/kmap_types.h
 518 --- linux-2.6.33/arch/avr32/include/asm/kmap_types.h    2010-02-24 13:52:17.000000000 -0500
 519 +++ linux-2.6.33/arch/avr32/include/asm/kmap_types.h    2010-03-07 12:23:35.889620809 -0500
 520 @@ -22,7 +22,8 @@ D(10) KM_IRQ0,
 521  D(11)  KM_IRQ1,
 522  D(12)  KM_SOFTIRQ0,
 523  D(13)  KM_SOFTIRQ1,
 524 -D(14)  KM_TYPE_NR
 525 +D(14)  KM_CLEARPAGE,
 526 +D(15)  KM_TYPE_NR
 527  };
 528
 529  #undef D
 530 diff -urNp linux-2.6.33/arch/avr32/mach-at32ap/pm.c linux-2.6.33/arch/avr32/mach-at32ap/pm.c
 531 --- linux-2.6.33/arch/avr32/mach-at32ap/pm.c    2010-02-24 13:52:17.000000000 -0500
 532 +++ linux-2.6.33/arch/avr32/mach-at32ap/pm.c    2010-03-07 12:23:35.889620809 -0500
 533 @@ -176,7 +176,7 @@ out:
 534         return 0;
 535  }
 536
 537 -static struct platform_suspend_ops avr32_pm_ops = {
 538 +static const struct platform_suspend_ops avr32_pm_ops = {
 539         .valid  = avr32_pm_valid_state,
 540         .enter  = avr32_pm_enter,
 541  };
 542 diff -urNp linux-2.6.33/arch/avr32/mm/fault.c linux-2.6.33/arch/avr32/mm/fault.c
 543 --- linux-2.6.33/arch/avr32/mm/fault.c  2010-02-24 13:52:17.000000000 -0500
 544 +++ linux-2.6.33/arch/avr32/mm/fault.c  2010-03-07 12:23:35.889620809 -0500
 545 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
 546
 547  int exception_trace = 1;
 548
 549 +#ifdef CONFIG_PAX_PAGEEXEC
 550 +void pax_report_insns(void *pc, void *sp)
 551 +{
 552 +       unsigned long i;
 553 +
 554 +       printk(KERN_ERR "PAX: bytes at PC: ");
 555 +       for (i = 0; i < 20; i++) {
 556 +               unsigned char c;
 557 +               if (get_user(c, (unsigned char *)pc+i))
 558 +                       printk(KERN_CONT "???????? ");
 559 +               else
 560 +                       printk(KERN_CONT "%02x ", c);
 561 +       }
 562 +       printk("\n");
 563 +}
 564 +#endif
 565 +
 566  /*
 567   * This routine handles page faults. It determines the address and the
 568   * problem, and then passes it off to one of the appropriate routines.
 569 @@ -157,6 +174,16 @@ bad_area:
 570         up_read(&mm->mmap_sem);
 571
 572         if (user_mode(regs)) {
 573 +
 574 +#ifdef CONFIG_PAX_PAGEEXEC
 575 +               if (mm->pax_flags & MF_PAX_PAGEEXEC) {
 576 +                       if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
 577 +                               pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
 578 +                               do_group_exit(SIGKILL);
 579 +                       }
 580 +               }
 581 +#endif
 582 +
 583                 if (exception_trace && printk_ratelimit())
 584                         printk("%s%s[%d]: segfault at %08lx pc %08lx "
 585                                "sp %08lx ecr %lu\n",
 586 diff -urNp linux-2.6.33/arch/blackfin/kernel/kgdb.c linux-2.6.33/arch/blackfin/kernel/kgdb.c
 587 --- linux-2.6.33/arch/blackfin/kernel/kgdb.c    2010-02-24 13:52:17.000000000 -0500
 588 +++ linux-2.6.33/arch/blackfin/kernel/kgdb.c    2010-03-07 12:23:35.889620809 -0500
 589 @@ -397,7 +397,7 @@ int kgdb_arch_handle_exception(int vecto
 590         return -1;              /* this means that we do not want to exit from the handler */
 591  }
 592
 593 -struct kgdb_arch arch_kgdb_ops = {
 594 +const struct kgdb_arch arch_kgdb_ops = {
 595         .gdb_bpt_instr = {0xa1},
 596  #ifdef CONFIG_SMP
 597         .flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
 598 diff -urNp linux-2.6.33/arch/blackfin/mach-common/pm.c linux-2.6.33/arch/blackfin/mach-common/pm.c
 599 --- linux-2.6.33/arch/blackfin/mach-common/pm.c 2010-02-24 13:52:17.000000000 -0500
 600 +++ linux-2.6.33/arch/blackfin/mach-common/pm.c 2010-03-07 12:23:35.889620809 -0500
 601 @@ -255,7 +255,7 @@ static int bfin_pm_enter(suspend_state_t
 602         return 0;
 603  }
 604
 605 -struct platform_suspend_ops bfin_pm_ops = {
 606 +const struct platform_suspend_ops bfin_pm_ops = {
 607         .enter = bfin_pm_enter,
 608         .valid  = bfin_pm_valid,
 609  };
 610 diff -urNp linux-2.6.33/arch/blackfin/mm/maccess.c linux-2.6.33/arch/blackfin/mm/maccess.c
 611 --- linux-2.6.33/arch/blackfin/mm/maccess.c     2010-02-24 13:52:17.000000000 -0500
 612 +++ linux-2.6.33/arch/blackfin/mm/maccess.c     2010-03-07 12:23:35.889620809 -0500
 613 @@ -16,7 +16,7 @@ static int validate_memory_access_addres
 614         return bfin_mem_access_type(addr, size);
 615  }
 616
 617 -long probe_kernel_read(void *dst, void *src, size_t size)
 618 +long probe_kernel_read(void *dst, const void *src, size_t size)
 619  {
 620         unsigned long lsrc = (unsigned long)src;
 621         int mem_type;
 622 @@ -55,7 +55,7 @@ long probe_kernel_read(void *dst, void *
 623         return -EFAULT;
 624  }
 625
 626 -long probe_kernel_write(void *dst, void *src, size_t size)
 627 +long probe_kernel_write(void *dst, const void *src, size_t size)
 628  {
 629         unsigned long ldst = (unsigned long)dst;
 630         int mem_type;
 631 diff -urNp linux-2.6.33/arch/frv/include/asm/kmap_types.h linux-2.6.33/arch/frv/include/asm/kmap_types.h
 632 --- linux-2.6.33/arch/frv/include/asm/kmap_types.h      2010-02-24 13:52:17.000000000 -0500
 633 +++ linux-2.6.33/arch/frv/include/asm/kmap_types.h      2010-03-07 12:23:35.889620809 -0500
 634 @@ -23,6 +23,7 @@ enum km_type {
 635         KM_IRQ1,
 636         KM_SOFTIRQ0,
 637         KM_SOFTIRQ1,
 638 +       KM_CLEARPAGE,
 639         KM_TYPE_NR
 640  };
 641
 642 diff -urNp linux-2.6.33/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.33/arch/ia64/hp/common/hwsw_iommu.c
 643 --- linux-2.6.33/arch/ia64/hp/common/hwsw_iommu.c       2010-02-24 13:52:17.000000000 -0500
 644 +++ linux-2.6.33/arch/ia64/hp/common/hwsw_iommu.c       2010-03-07 12:23:35.889620809 -0500
 645 @@ -17,7 +17,7 @@
 646  #include <linux/swiotlb.h>
 647  #include <asm/machvec.h>
 648
 649 -extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
 650 +extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
 651
 652  /* swiotlb declarations & definitions: */
 653  extern int swiotlb_late_init_with_default_size (size_t size);
 654 @@ -33,7 +33,7 @@ static inline int use_swiotlb(struct dev
 655                 !sba_dma_ops.dma_supported(dev, *dev->dma_mask);
 656  }
 657
 658 -struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
 659 +const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
 660  {
 661         if (use_swiotlb(dev))
 662                 return &swiotlb_dma_ops;
 663 diff -urNp linux-2.6.33/arch/ia64/hp/common/sba_iommu.c linux-2.6.33/arch/ia64/hp/common/sba_iommu.c
 664 --- linux-2.6.33/arch/ia64/hp/common/sba_iommu.c        2010-02-24 13:52:17.000000000 -0500
 665 +++ linux-2.6.33/arch/ia64/hp/common/sba_iommu.c        2010-03-07 12:23:35.889620809 -0500
 666 @@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
 667         },
 668  };
 669
 670 -extern struct dma_map_ops swiotlb_dma_ops;
 671 +extern const struct dma_map_ops swiotlb_dma_ops;
 672
 673  static int __init
 674  sba_init(void)
 675 @@ -2211,7 +2211,7 @@ sba_page_override(char *str)
 676
 677  __setup("sbapagesize=",sba_page_override);
 678
 679 -struct dma_map_ops sba_dma_ops = {
 680 +const struct dma_map_ops sba_dma_ops = {
 681         .alloc_coherent         = sba_alloc_coherent,
 682         .free_coherent          = sba_free_coherent,
 683         .map_page               = sba_map_page,
 684 diff -urNp linux-2.6.33/arch/ia64/ia32/binfmt_elf32.c linux-2.6.33/arch/ia64/ia32/binfmt_elf32.c
 685 --- linux-2.6.33/arch/ia64/ia32/binfmt_elf32.c  2010-02-24 13:52:17.000000000 -0500
 686 +++ linux-2.6.33/arch/ia64/ia32/binfmt_elf32.c  2010-03-07 12:23:35.889620809 -0500
 687 @@ -45,6 +45,13 @@ randomize_stack_top(unsigned long stack_
 688
 689  #define elf_read_implies_exec(ex, have_pt_gnu_stack)   (!(have_pt_gnu_stack))
 690
 691 +#ifdef CONFIG_PAX_ASLR
 692 +#define PAX_ELF_ET_DYN_BASE    (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
 693 +
 694 +#define PAX_DELTA_MMAP_LEN     (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
 695 +#define PAX_DELTA_STACK_LEN    (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
 696 +#endif
 697 +
 698  /* Ugly but avoids duplication */
 699  #include "../../../fs/binfmt_elf.c"
 700
 701 diff -urNp linux-2.6.33/arch/ia64/ia32/ia32priv.h linux-2.6.33/arch/ia64/ia32/ia32priv.h
 702 --- linux-2.6.33/arch/ia64/ia32/ia32priv.h      2010-02-24 13:52:17.000000000 -0500
 703 +++ linux-2.6.33/arch/ia64/ia32/ia32priv.h      2010-03-07 12:23:35.889620809 -0500
 704 @@ -296,7 +296,14 @@ typedef struct compat_siginfo {
 705  #define ELF_DATA       ELFDATA2LSB
 706  #define ELF_ARCH       EM_386
 707
 708 -#define IA32_STACK_TOP         IA32_PAGE_OFFSET
 709 +#ifdef CONFIG_PAX_RANDUSTACK
 710 +#define __IA32_DELTA_STACK     (current->mm->delta_stack)
 711 +#else
 712 +#define __IA32_DELTA_STACK     0UL
 713 +#endif
 714 +
 715 +#define IA32_STACK_TOP         (IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
 716 +
 717  #define IA32_GATE_OFFSET       IA32_PAGE_OFFSET
 718  #define IA32_GATE_END          IA32_PAGE_OFFSET + PAGE_SIZE
 719
 720 diff -urNp linux-2.6.33/arch/ia64/include/asm/dma-mapping.h linux-2.6.33/arch/ia64/include/asm/dma-mapping.h
 721 --- linux-2.6.33/arch/ia64/include/asm/dma-mapping.h    2010-02-24 13:52:17.000000000 -0500
 722 +++ linux-2.6.33/arch/ia64/include/asm/dma-mapping.h    2010-03-07 12:23:35.889620809 -0500
 723 @@ -12,7 +12,7 @@
 724
 725  #define ARCH_HAS_DMA_GET_REQUIRED_MASK
 726
 727 -extern struct dma_map_ops *dma_ops;
 728 +extern const struct dma_map_ops *dma_ops;
 729  extern struct ia64_machine_vector ia64_mv;
 730  extern void set_iommu_machvec(void);
 731
 732 @@ -24,7 +24,7 @@ extern void machvec_dma_sync_sg(struct d
 733  static inline void *dma_alloc_coherent(struct device *dev, size_t size,
 734                                        dma_addr_t *daddr, gfp_t gfp)
 735  {
 736 -       struct dma_map_ops *ops = platform_dma_get_ops(dev);
 737 +       const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 738         void *caddr;
 739
 740         caddr = ops->alloc_coherent(dev, size, daddr, gfp);
 741 @@ -35,7 +35,7 @@ static inline void *dma_alloc_coherent(s
 742  static inline void dma_free_coherent(struct device *dev, size_t size,
 743                                      void *caddr, dma_addr_t daddr)
 744  {
 745 -       struct dma_map_ops *ops = platform_dma_get_ops(dev);
 746 +       const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 747         debug_dma_free_coherent(dev, size, caddr, daddr);
 748         ops->free_coherent(dev, size, caddr, daddr);
 749  }
 750 @@ -49,13 +49,13 @@ static inline void dma_free_coherent(str
 751
 752  static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
 753  {
 754 -       struct dma_map_ops *ops = platform_dma_get_ops(dev);
 755 +       const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 756         return ops->mapping_error(dev, daddr);
 757  }
 758
 759  static inline int dma_supported(struct device *dev, u64 mask)
 760  {
 761 -       struct dma_map_ops *ops = platform_dma_get_ops(dev);
 762 +       const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 763         return ops->dma_supported(dev, mask);
 764  }
 765
 766 diff -urNp linux-2.6.33/arch/ia64/include/asm/elf.h linux-2.6.33/arch/ia64/include/asm/elf.h
 767 --- linux-2.6.33/arch/ia64/include/asm/elf.h    2010-02-24 13:52:17.000000000 -0500
 768 +++ linux-2.6.33/arch/ia64/include/asm/elf.h    2010-03-07 12:23:35.889620809 -0500
 769 @@ -42,6 +42,13 @@
 770   */
 771  #define ELF_ET_DYN_BASE                (TASK_UNMAPPED_BASE + 0x800000000UL)
 772
 773 +#ifdef CONFIG_PAX_ASLR
 774 +#define PAX_ELF_ET_DYN_BASE    (current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
 775 +
 776 +#define PAX_DELTA_MMAP_LEN     (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
 777 +#define PAX_DELTA_STACK_LEN    (current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
 778 +#endif
 779 +
 780  #define PT_IA_64_UNWIND                0x70000001
 781
 782  /* IA-64 relocations: */
 783 diff -urNp linux-2.6.33/arch/ia64/include/asm/machvec.h linux-2.6.33/arch/ia64/include/asm/machvec.h
 784 --- linux-2.6.33/arch/ia64/include/asm/machvec.h        2010-02-24 13:52:17.000000000 -0500
 785 +++ linux-2.6.33/arch/ia64/include/asm/machvec.h        2010-03-07 12:23:35.889620809 -0500
 786 @@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
 787  /* DMA-mapping interface: */
 788  typedef void ia64_mv_dma_init (void);
 789  typedef u64 ia64_mv_dma_get_required_mask (struct device *);
 790 -typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
 791 +typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
 792
 793  /*
 794   * WARNING: The legacy I/O space is _architected_.  Platforms are
 795 @@ -251,7 +251,7 @@ extern void machvec_init_from_cmdline(co
 796  # endif /* CONFIG_IA64_GENERIC */
 797
 798  extern void swiotlb_dma_init(void);
 799 -extern struct dma_map_ops *dma_get_ops(struct device *);
 800 +extern const struct dma_map_ops *dma_get_ops(struct device *);
 801
 802  /*
 803   * Define default versions so we can extend machvec for new platforms without having
 804 diff -urNp linux-2.6.33/arch/ia64/include/asm/pgtable.h linux-2.6.33/arch/ia64/include/asm/pgtable.h
 805 --- linux-2.6.33/arch/ia64/include/asm/pgtable.h        2010-02-24 13:52:17.000000000 -0500
 806 +++ linux-2.6.33/arch/ia64/include/asm/pgtable.h        2010-03-07 12:23:35.889620809 -0500
 807 @@ -143,6 +143,17 @@
 808  #define PAGE_READONLY  __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 809  #define PAGE_COPY      __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 810  #define PAGE_COPY_EXEC __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
 811 +
 812 +#ifdef CONFIG_PAX_PAGEEXEC
 813 +# define PAGE_SHARED_NOEXEC    __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
 814 +# define PAGE_READONLY_NOEXEC  __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 815 +# define PAGE_COPY_NOEXEC      __pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 816 +#else
 817 +# define PAGE_SHARED_NOEXEC    PAGE_SHARED
 818 +# define PAGE_READONLY_NOEXEC  PAGE_READONLY
 819 +# define PAGE_COPY_NOEXEC      PAGE_COPY
 820 +#endif
 821 +
 822  #define PAGE_GATE      __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
 823  #define PAGE_KERNEL    __pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
 824  #define PAGE_KERNELRX  __pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
 825 diff -urNp linux-2.6.33/arch/ia64/include/asm/uaccess.h linux-2.6.33/arch/ia64/include/asm/uaccess.h
 826 --- linux-2.6.33/arch/ia64/include/asm/uaccess.h        2010-02-24 13:52:17.000000000 -0500
 827 +++ linux-2.6.33/arch/ia64/include/asm/uaccess.h        2010-03-07 12:23:35.889620809 -0500
 828 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
 829         const void *__cu_from = (from);                                                 \
 830         long __cu_len = (n);                                                            \
 831                                                                                         \
 832 -       if (__access_ok(__cu_to, __cu_len, get_fs()))                                   \
 833 +       if (__cu_len > 0  && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))                   \
 834                 __cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);   \
 835         __cu_len;                                                                       \
 836  })
 837 @@ -269,7 +269,7 @@ __copy_from_user (void *to, const void _
 838         long __cu_len = (n);                                                            \
 839                                                                                         \
 840         __chk_user_ptr(__cu_from);                                                      \
 841 -       if (__access_ok(__cu_from, __cu_len, get_fs()))                                 \
 842 +       if (__cu_len > 0 && __cu_len <= INT_MAX  && __access_ok(__cu_from, __cu_len, get_fs()))                 \
 843                 __cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);   \
 844         __cu_len;                                                                       \
 845  })
 846 diff -urNp linux-2.6.33/arch/ia64/kernel/dma-mapping.c linux-2.6.33/arch/ia64/kernel/dma-mapping.c
 847 --- linux-2.6.33/arch/ia64/kernel/dma-mapping.c 2010-02-24 13:52:17.000000000 -0500
 848 +++ linux-2.6.33/arch/ia64/kernel/dma-mapping.c 2010-03-07 12:23:35.889620809 -0500
 849 @@ -3,7 +3,7 @@
 850  /* Set this to 1 if there is a HW IOMMU in the system */
 851  int iommu_detected __read_mostly;
 852
 853 -struct dma_map_ops *dma_ops;
 854 +const struct dma_map_ops *dma_ops;
 855  EXPORT_SYMBOL(dma_ops);
 856
 857  #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
 858 @@ -16,7 +16,7 @@ static int __init dma_init(void)
 859  }
 860  fs_initcall(dma_init);
 861
 862 -struct dma_map_ops *dma_get_ops(struct device *dev)
 863 +const struct dma_map_ops *dma_get_ops(struct device *dev)
 864  {
 865         return dma_ops;
 866  }
 867 diff -urNp linux-2.6.33/arch/ia64/kernel/module.c linux-2.6.33/arch/ia64/kernel/module.c
 868 --- linux-2.6.33/arch/ia64/kernel/module.c      2010-02-24 13:52:17.000000000 -0500
 869 +++ linux-2.6.33/arch/ia64/kernel/module.c      2010-03-07 12:23:35.895205004 -0500
 870 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
 871  void
 872  module_free (struct module *mod, void *module_region)
 873  {
 874 -       if (mod && mod->arch.init_unw_table &&
 875 -           module_region == mod->module_init) {
 876 +       if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
 877                 unw_remove_unwind_table(mod->arch.init_unw_table);
 878                 mod->arch.init_unw_table = NULL;
 879         }
 880 @@ -502,15 +501,39 @@ module_frob_arch_sections (Elf_Ehdr *ehd
 881  }
 882
 883  static inline int
 884 +in_init_rx (const struct module *mod, uint64_t addr)
 885 +{
 886 +       return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
 887 +}
 888 +
 889 +static inline int
 890 +in_init_rw (const struct module *mod, uint64_t addr)
 891 +{
 892 +       return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
 893 +}
 894 +
 895 +static inline int
 896  in_init (const struct module *mod, uint64_t addr)
 897  {
 898 -       return addr - (uint64_t) mod->module_init < mod->init_size;
 899 +       return in_init_rx(mod, addr) || in_init_rw(mod, addr);
 900 +}
 901 +
 902 +static inline int
 903 +in_core_rx (const struct module *mod, uint64_t addr)
 904 +{
 905 +       return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
 906 +}
 907 +
 908 +static inline int
 909 +in_core_rw (const struct module *mod, uint64_t addr)
 910 +{
 911 +       return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
 912  }
 913
 914  static inline int
 915  in_core (const struct module *mod, uint64_t addr)
 916  {
 917 -       return addr - (uint64_t) mod->module_core < mod->core_size;
 918 +       return in_core_rx(mod, addr) || in_core_rw(mod, addr);
 919  }
 920
 921  static inline int
 922 @@ -693,7 +716,14 @@ do_reloc (struct module *mod, uint8_t r_
 923                 break;
 924
 925               case RV_BDREL:
 926 -               val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
 927 +               if (in_init_rx(mod, val))
 928 +                       val -= (uint64_t) mod->module_init_rx;
 929 +               else if (in_init_rw(mod, val))
 930 +                       val -= (uint64_t) mod->module_init_rw;
 931 +               else if (in_core_rx(mod, val))
 932 +                       val -= (uint64_t) mod->module_core_rx;
 933 +               else if (in_core_rw(mod, val))
 934 +                       val -= (uint64_t) mod->module_core_rw;
 935                 break;
 936
 937               case RV_LTV:
 938 @@ -828,15 +858,15 @@ apply_relocate_add (Elf64_Shdr *sechdrs,
 939                  *     addresses have been selected...
 940                  */
 941                 uint64_t gp;
 942 -               if (mod->core_size > MAX_LTOFF)
 943 +               if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
 944                         /*
 945                          * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
 946                          * at the end of the module.
 947                          */
 948 -                       gp = mod->core_size - MAX_LTOFF / 2;
 949 +                       gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
 950                 else
 951 -                       gp = mod->core_size / 2;
 952 -               gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
 953 +                       gp = (mod->core_size_rx + mod->core_size_rw) / 2;
 954 +               gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
 955                 mod->arch.gp = gp;
 956                 DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
 957         }
 958 diff -urNp linux-2.6.33/arch/ia64/kernel/pci-dma.c linux-2.6.33/arch/ia64/kernel/pci-dma.c
 959 --- linux-2.6.33/arch/ia64/kernel/pci-dma.c     2010-02-24 13:52:17.000000000 -0500
 960 +++ linux-2.6.33/arch/ia64/kernel/pci-dma.c     2010-03-07 12:23:35.895205004 -0500
 961 @@ -43,7 +43,7 @@ struct device fallback_dev = {
 962         .dma_mask = &fallback_dev.coherent_dma_mask,
 963  };
 964
 965 -extern struct dma_map_ops intel_dma_ops;
 966 +extern const struct dma_map_ops intel_dma_ops;
 967
 968  static int __init pci_iommu_init(void)
 969  {
 970 diff -urNp linux-2.6.33/arch/ia64/kernel/pci-swiotlb.c linux-2.6.33/arch/ia64/kernel/pci-swiotlb.c
 971 --- linux-2.6.33/arch/ia64/kernel/pci-swiotlb.c 2010-02-24 13:52:17.000000000 -0500
 972 +++ linux-2.6.33/arch/ia64/kernel/pci-swiotlb.c 2010-03-07 12:23:35.895205004 -0500
 973 @@ -21,7 +21,7 @@ static void *ia64_swiotlb_alloc_coherent
 974         return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
 975  }
 976
 977 -struct dma_map_ops swiotlb_dma_ops = {
 978 +const struct dma_map_ops swiotlb_dma_ops = {
 979         .alloc_coherent = ia64_swiotlb_alloc_coherent,
 980         .free_coherent = swiotlb_free_coherent,
 981         .map_page = swiotlb_map_page,
 982 diff -urNp linux-2.6.33/arch/ia64/kernel/sys_ia64.c linux-2.6.33/arch/ia64/kernel/sys_ia64.c
 983 --- linux-2.6.33/arch/ia64/kernel/sys_ia64.c    2010-02-24 13:52:17.000000000 -0500
 984 +++ linux-2.6.33/arch/ia64/kernel/sys_ia64.c    2010-03-07 12:23:35.895205004 -0500
 985 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
 986         if (REGION_NUMBER(addr) == RGN_HPAGE)
 987                 addr = 0;
 988  #endif
 989 +
 990 +#ifdef CONFIG_PAX_RANDMMAP
 991 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
 992 +               addr = mm->free_area_cache;
 993 +       else
 994 +#endif
 995 +
 996         if (!addr)
 997                 addr = mm->free_area_cache;
 998
 999 @@ -61,9 +68,9 @@ arch_get_unmapped_area (struct file *fil
1000         for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
1001                 /* At this point:  (!vma || addr < vma->vm_end). */
1002                 if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
1003 -                       if (start_addr != TASK_UNMAPPED_BASE) {
1004 +                       if (start_addr != mm->mmap_base) {
1005                                 /* Start a new search --- just in case we missed some holes.  */
1006 -                               addr = TASK_UNMAPPED_BASE;
1007 +                               addr = mm->mmap_base;
1008                                 goto full_search;
1009                         }
1010                         return -ENOMEM;
1011 diff -urNp linux-2.6.33/arch/ia64/kernel/topology.c linux-2.6.33/arch/ia64/kernel/topology.c
1012 --- linux-2.6.33/arch/ia64/kernel/topology.c    2010-02-24 13:52:17.000000000 -0500
1013 +++ linux-2.6.33/arch/ia64/kernel/topology.c    2010-03-07 12:23:35.895205004 -0500
1014 @@ -282,7 +282,7 @@ static ssize_t cache_show(struct kobject
1015         return ret;
1016  }
1017
1018 -static struct sysfs_ops cache_sysfs_ops = {
1019 +static const struct sysfs_ops cache_sysfs_ops = {
1020         .show   = cache_show
1021  };
1022
1023 diff -urNp linux-2.6.33/arch/ia64/kernel/vmlinux.lds.S linux-2.6.33/arch/ia64/kernel/vmlinux.lds.S
1024 --- linux-2.6.33/arch/ia64/kernel/vmlinux.lds.S 2010-02-24 13:52:17.000000000 -0500
1025 +++ linux-2.6.33/arch/ia64/kernel/vmlinux.lds.S 2010-03-07 12:23:35.895205004 -0500
1026 @@ -196,7 +196,7 @@ SECTIONS
1027    /* Per-cpu data: */
1028    . = ALIGN(PERCPU_PAGE_SIZE);
1029    PERCPU_VADDR(PERCPU_ADDR, :percpu)
1030 -  __phys_per_cpu_start = __per_cpu_load;
1031 +  __phys_per_cpu_start = per_cpu_load;
1032    . = __phys_per_cpu_start + PERCPU_PAGE_SIZE; /* ensure percpu data fits
1033                                                  * into percpu page size
1034                                                  */
1035 diff -urNp linux-2.6.33/arch/ia64/mm/fault.c linux-2.6.33/arch/ia64/mm/fault.c
1036 --- linux-2.6.33/arch/ia64/mm/fault.c   2010-02-24 13:52:17.000000000 -0500
1037 +++ linux-2.6.33/arch/ia64/mm/fault.c   2010-03-07 12:23:35.895205004 -0500
1038 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned
1039         return pte_present(pte);
1040  }
1041
1042 +#ifdef CONFIG_PAX_PAGEEXEC
1043 +void pax_report_insns(void *pc, void *sp)
1044 +{
1045 +       unsigned long i;
1046 +
1047 +       printk(KERN_ERR "PAX: bytes at PC: ");
1048 +       for (i = 0; i < 8; i++) {
1049 +               unsigned int c;
1050 +               if (get_user(c, (unsigned int *)pc+i))
1051 +                       printk(KERN_CONT "???????? ");
1052 +               else
1053 +                       printk(KERN_CONT "%08x ", c);
1054 +       }
1055 +       printk("\n");
1056 +}
1057 +#endif
1058 +
1059  void __kprobes
1060  ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
1061  {
1062 @@ -145,9 +162,23 @@ ia64_do_page_fault (unsigned long addres
1063         mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
1064                 | (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
1065
1066 -       if ((vma->vm_flags & mask) != mask)
1067 +       if ((vma->vm_flags & mask) != mask) {
1068 +
1069 +#ifdef CONFIG_PAX_PAGEEXEC
1070 +               if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
1071 +                       if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
1072 +                               goto bad_area;
1073 +
1074 +                       up_read(&mm->mmap_sem);
1075 +                       pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
1076 +                       do_group_exit(SIGKILL);
1077 +               }
1078 +#endif
1079 +
1080                 goto bad_area;
1081
1082 +       }
1083 +
1084    survive:
1085         /*
1086          * If for any reason at all we couldn't handle the fault, make
1087 diff -urNp linux-2.6.33/arch/ia64/mm/init.c linux-2.6.33/arch/ia64/mm/init.c
1088 --- linux-2.6.33/arch/ia64/mm/init.c    2010-02-24 13:52:17.000000000 -0500
1089 +++ linux-2.6.33/arch/ia64/mm/init.c    2010-03-07 12:23:35.895205004 -0500
1090 @@ -122,6 +122,19 @@ ia64_init_addr_space (void)
1091                 vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
1092                 vma->vm_end = vma->vm_start + PAGE_SIZE;
1093                 vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
1094 +
1095 +#ifdef CONFIG_PAX_PAGEEXEC
1096 +               if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
1097 +                       vma->vm_flags &= ~VM_EXEC;
1098 +
1099 +#ifdef CONFIG_PAX_MPROTECT
1100 +                       if (current->mm->pax_flags & MF_PAX_MPROTECT)
1101 +                               vma->vm_flags &= ~VM_MAYEXEC;
1102 +#endif
1103 +
1104 +               }
1105 +#endif
1106 +
1107                 vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
1108                 down_write(&current->mm->mmap_sem);
1109                 if (insert_vm_struct(current->mm, vma)) {
1110 diff -urNp linux-2.6.33/arch/ia64/sn/pci/pci_dma.c linux-2.6.33/arch/ia64/sn/pci/pci_dma.c
1111 --- linux-2.6.33/arch/ia64/sn/pci/pci_dma.c     2010-02-24 13:52:17.000000000 -0500
1112 +++ linux-2.6.33/arch/ia64/sn/pci/pci_dma.c     2010-03-07 12:23:35.895205004 -0500
1113 @@ -464,7 +464,7 @@ int sn_pci_legacy_write(struct pci_bus *
1114         return ret;
1115  }
1116
1117 -static struct dma_map_ops sn_dma_ops = {
1118 +static const struct dma_map_ops sn_dma_ops = {
1119         .alloc_coherent         = sn_dma_alloc_coherent,
1120         .free_coherent          = sn_dma_free_coherent,
1121         .map_page               = sn_dma_map_page,
1122 diff -urNp linux-2.6.33/arch/m32r/lib/usercopy.c linux-2.6.33/arch/m32r/lib/usercopy.c
1123 --- linux-2.6.33/arch/m32r/lib/usercopy.c       2010-02-24 13:52:17.000000000 -0500
1124 +++ linux-2.6.33/arch/m32r/lib/usercopy.c       2010-03-07 12:23:35.895205004 -0500
1125 @@ -14,6 +14,9 @@
1126  unsigned long
1127  __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
1128  {
1129 +       if ((long)n < 0)
1130 +               return n;
1131 +
1132         prefetch(from);
1133         if (access_ok(VERIFY_WRITE, to, n))
1134                 __copy_user(to,from,n);
1135 @@ -23,6 +26,9 @@ __generic_copy_to_user(void __user *to,
1136  unsigned long
1137  __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
1138  {
1139 +       if ((long)n < 0)
1140 +               return n;
1141 +
1142         prefetchw(to);
1143         if (access_ok(VERIFY_READ, from, n))
1144                 __copy_user_zeroing(to,from,n);
1145 diff -urNp linux-2.6.33/arch/mips/alchemy/devboards/pm.c linux-2.6.33/arch/mips/alchemy/devboards/pm.c
1146 --- linux-2.6.33/arch/mips/alchemy/devboards/pm.c       2010-02-24 13:52:17.000000000 -0500
1147 +++ linux-2.6.33/arch/mips/alchemy/devboards/pm.c       2010-03-07 12:23:35.895205004 -0500
1148 @@ -78,7 +78,7 @@ static void db1x_pm_end(void)
1149
1150  }
1151
1152 -static struct platform_suspend_ops db1x_pm_ops = {
1153 +static const struct platform_suspend_ops db1x_pm_ops = {
1154         .valid          = suspend_valid_only_mem,
1155         .begin          = db1x_pm_begin,
1156         .enter          = db1x_pm_enter,
1157 diff -urNp linux-2.6.33/arch/mips/include/asm/elf.h linux-2.6.33/arch/mips/include/asm/elf.h
1158 --- linux-2.6.33/arch/mips/include/asm/elf.h    2010-02-24 13:52:17.000000000 -0500
1159 +++ linux-2.6.33/arch/mips/include/asm/elf.h    2010-03-07 12:23:35.895205004 -0500
1160 @@ -367,4 +367,11 @@ extern int dump_task_fpu(struct task_str
1161  #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
1162  #endif
1163
1164 +#ifdef CONFIG_PAX_ASLR
1165 +#define PAX_ELF_ET_DYN_BASE    (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1166 +
1167 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1168 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1169 +#endif
1170 +
1171  #endif /* _ASM_ELF_H */
1172 diff -urNp linux-2.6.33/arch/mips/include/asm/page.h linux-2.6.33/arch/mips/include/asm/page.h
1173 --- linux-2.6.33/arch/mips/include/asm/page.h   2010-02-24 13:52:17.000000000 -0500
1174 +++ linux-2.6.33/arch/mips/include/asm/page.h   2010-03-07 12:23:35.895205004 -0500
1175 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
1176    #ifdef CONFIG_CPU_MIPS32
1177      typedef struct { unsigned long pte_low, pte_high; } pte_t;
1178      #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
1179 -    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
1180 +    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
1181    #else
1182       typedef struct { unsigned long long pte; } pte_t;
1183       #define pte_val(x)        ((x).pte)
1184 diff -urNp linux-2.6.33/arch/mips/include/asm/system.h linux-2.6.33/arch/mips/include/asm/system.h
1185 --- linux-2.6.33/arch/mips/include/asm/system.h 2010-02-24 13:52:17.000000000 -0500
1186 +++ linux-2.6.33/arch/mips/include/asm/system.h 2010-03-07 12:23:35.895205004 -0500
1187 @@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
1188   */
1189  #define __ARCH_WANT_UNLOCKED_CTXSW
1190
1191 -extern unsigned long arch_align_stack(unsigned long sp);
1192 +#define arch_align_stack(x) ((x) & ALMASK)
1193
1194  #endif /* _ASM_SYSTEM_H */
1195 diff -urNp linux-2.6.33/arch/mips/kernel/binfmt_elfn32.c linux-2.6.33/arch/mips/kernel/binfmt_elfn32.c
1196 --- linux-2.6.33/arch/mips/kernel/binfmt_elfn32.c       2010-02-24 13:52:17.000000000 -0500
1197 +++ linux-2.6.33/arch/mips/kernel/binfmt_elfn32.c       2010-03-07 12:23:35.895205004 -0500
1198 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1199  #undef ELF_ET_DYN_BASE
1200  #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
1201
1202 +#ifdef CONFIG_PAX_ASLR
1203 +#define PAX_ELF_ET_DYN_BASE    (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1204 +
1205 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1206 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1207 +#endif
1208 +
1209  #include <asm/processor.h>
1210  #include <linux/module.h>
1211  #include <linux/elfcore.h>
1212 diff -urNp linux-2.6.33/arch/mips/kernel/binfmt_elfo32.c linux-2.6.33/arch/mips/kernel/binfmt_elfo32.c
1213 --- linux-2.6.33/arch/mips/kernel/binfmt_elfo32.c       2010-02-24 13:52:17.000000000 -0500
1214 +++ linux-2.6.33/arch/mips/kernel/binfmt_elfo32.c       2010-03-07 12:23:35.895205004 -0500
1215 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
1216  #undef ELF_ET_DYN_BASE
1217  #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
1218
1219 +#ifdef CONFIG_PAX_ASLR
1220 +#define PAX_ELF_ET_DYN_BASE    (test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
1221 +
1222 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1223 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
1224 +#endif
1225 +
1226  #include <asm/processor.h>
1227
1228  /*
1229 diff -urNp linux-2.6.33/arch/mips/kernel/kgdb.c linux-2.6.33/arch/mips/kernel/kgdb.c
1230 --- linux-2.6.33/arch/mips/kernel/kgdb.c        2010-02-24 13:52:17.000000000 -0500
1231 +++ linux-2.6.33/arch/mips/kernel/kgdb.c        2010-03-07 12:23:35.895205004 -0500
1232 @@ -245,6 +245,7 @@ int kgdb_arch_handle_exception(int vecto
1233         return -1;
1234  }
1235
1236 +/* cannot be const */
1237  struct kgdb_arch arch_kgdb_ops;
1238
1239  /*
1240 diff -urNp linux-2.6.33/arch/mips/kernel/process.c linux-2.6.33/arch/mips/kernel/process.c
1241 --- linux-2.6.33/arch/mips/kernel/process.c     2010-02-24 13:52:17.000000000 -0500
1242 +++ linux-2.6.33/arch/mips/kernel/process.c     2010-03-07 12:23:35.895205004 -0500
1243 @@ -470,15 +470,3 @@ unsigned long get_wchan(struct task_stru
1244  out:
1245         return pc;
1246  }
1247 -
1248 -/*
1249 - * Don't forget that the stack pointer must be aligned on a 8 bytes
1250 - * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
1251 - */
1252 -unsigned long arch_align_stack(unsigned long sp)
1253 -{
1254 -       if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
1255 -               sp -= get_random_int() & ~PAGE_MASK;
1256 -
1257 -       return sp & ALMASK;
1258 -}
1259 diff -urNp linux-2.6.33/arch/mips/kernel/syscall.c linux-2.6.33/arch/mips/kernel/syscall.c
1260 --- linux-2.6.33/arch/mips/kernel/syscall.c     2010-02-24 13:52:17.000000000 -0500
1261 +++ linux-2.6.33/arch/mips/kernel/syscall.c     2010-03-07 12:23:35.895205004 -0500
1262 @@ -102,6 +102,11 @@ unsigned long arch_get_unmapped_area(str
1263         do_color_align = 0;
1264         if (filp || (flags & MAP_SHARED))
1265                 do_color_align = 1;
1266 +
1267 +#ifdef CONFIG_PAX_RANDMMAP
1268 +       if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
1269 +#endif
1270 +
1271         if (addr) {
1272                 if (do_color_align)
1273                         addr = COLOUR_ALIGN(addr, pgoff);
1274 @@ -112,7 +117,7 @@ unsigned long arch_get_unmapped_area(str
1275                     (!vmm || addr + len <= vmm->vm_start))
1276                         return addr;
1277         }
1278 -       addr = TASK_UNMAPPED_BASE;
1279 +       addr = current->mm->mmap_base;
1280         if (do_color_align)
1281                 addr = COLOUR_ALIGN(addr, pgoff);
1282         else
1283 diff -urNp linux-2.6.33/arch/mips/loongson/common/pm.c linux-2.6.33/arch/mips/loongson/common/pm.c
1284 --- linux-2.6.33/arch/mips/loongson/common/pm.c 2010-02-24 13:52:17.000000000 -0500
1285 +++ linux-2.6.33/arch/mips/loongson/common/pm.c 2010-03-07 12:23:35.895205004 -0500
1286 @@ -147,7 +147,7 @@ static int loongson_pm_valid_state(suspe
1287         }
1288  }
1289
1290 -static struct platform_suspend_ops loongson_pm_ops = {
1291 +static const struct platform_suspend_ops loongson_pm_ops = {
1292         .valid  = loongson_pm_valid_state,
1293         .enter  = loongson_pm_enter,
1294  };
1295 diff -urNp linux-2.6.33/arch/mips/mm/fault.c linux-2.6.33/arch/mips/mm/fault.c
1296 --- linux-2.6.33/arch/mips/mm/fault.c   2010-02-24 13:52:17.000000000 -0500
1297 +++ linux-2.6.33/arch/mips/mm/fault.c   2010-03-07 12:23:35.895205004 -0500
1298 @@ -26,6 +26,23 @@
1299  #include <asm/ptrace.h>
1300  #include <asm/highmem.h>               /* For VMALLOC_END */
1301
1302 +#ifdef CONFIG_PAX_PAGEEXEC
1303 +void pax_report_insns(void *pc)
1304 +{
1305 +       unsigned long i;
1306 +
1307 +       printk(KERN_ERR "PAX: bytes at PC: ");
1308 +       for (i = 0; i < 5; i++) {
1309 +               unsigned int c;
1310 +               if (get_user(c, (unsigned int *)pc+i))
1311 +                       printk(KERN_CONT "???????? ");
1312 +               else
1313 +                       printk(KERN_CONT "%08x ", c);
1314 +       }
1315 +       printk("\n");
1316 +}
1317 +#endif
1318 +
1319  /*
1320   * This routine handles page faults.  It determines the address,
1321   * and the problem, and then passes it off to one of the appropriate
1322 diff -urNp linux-2.6.33/arch/parisc/include/asm/elf.h linux-2.6.33/arch/parisc/include/asm/elf.h
1323 --- linux-2.6.33/arch/parisc/include/asm/elf.h  2010-02-24 13:52:17.000000000 -0500
1324 +++ linux-2.6.33/arch/parisc/include/asm/elf.h  2010-03-07 12:23:35.895205004 -0500
1325 @@ -342,6 +342,13 @@ struct pt_regs;    /* forward declaration..
1326
1327  #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
1328
1329 +#ifdef CONFIG_PAX_ASLR
1330 +#define PAX_ELF_ET_DYN_BASE    0x10000UL
1331 +
1332 +#define PAX_DELTA_MMAP_LEN     16
1333 +#define PAX_DELTA_STACK_LEN    16
1334 +#endif
1335 +
1336  /* This yields a mask that user programs can use to figure out what
1337     instruction set this CPU supports.  This could be done in user space,
1338     but it's not easy, and we've already done it here.  */
1339 diff -urNp linux-2.6.33/arch/parisc/include/asm/pgtable.h linux-2.6.33/arch/parisc/include/asm/pgtable.h
1340 --- linux-2.6.33/arch/parisc/include/asm/pgtable.h      2010-02-24 13:52:17.000000000 -0500
1341 +++ linux-2.6.33/arch/parisc/include/asm/pgtable.h      2010-03-07 12:23:35.895205004 -0500
1342 @@ -207,6 +207,17 @@
1343  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
1344  #define PAGE_COPY       PAGE_EXECREAD
1345  #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
1346 +
1347 +#ifdef CONFIG_PAX_PAGEEXEC
1348 +# define PAGE_SHARED_NOEXEC    __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
1349 +# define PAGE_COPY_NOEXEC      __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1350 +# define PAGE_READONLY_NOEXEC  __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
1351 +#else
1352 +# define PAGE_SHARED_NOEXEC    PAGE_SHARED
1353 +# define PAGE_COPY_NOEXEC      PAGE_COPY
1354 +# define PAGE_READONLY_NOEXEC  PAGE_READONLY
1355 +#endif
1356 +
1357  #define PAGE_KERNEL    __pgprot(_PAGE_KERNEL)
1358  #define PAGE_KERNEL_RO __pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
1359  #define PAGE_KERNEL_UNC        __pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
1360 diff -urNp linux-2.6.33/arch/parisc/kernel/module.c linux-2.6.33/arch/parisc/kernel/module.c
1361 --- linux-2.6.33/arch/parisc/kernel/module.c    2010-02-24 13:52:17.000000000 -0500
1362 +++ linux-2.6.33/arch/parisc/kernel/module.c    2010-03-07 12:23:35.899198434 -0500
1363 @@ -95,16 +95,38 @@
1364
1365  /* three functions to determine where in the module core
1366   * or init pieces the location is */
1367 +static inline int in_init_rx(struct module *me, void *loc)
1368 +{
1369 +       return (loc >= me->module_init_rx &&
1370 +               loc < (me->module_init_rx + me->init_size_rx));
1371 +}
1372 +
1373 +static inline int in_init_rw(struct module *me, void *loc)
1374 +{
1375 +       return (loc >= me->module_init_rw &&
1376 +               loc < (me->module_init_rw + me->init_size_rw));
1377 +}
1378 +
1379  static inline int in_init(struct module *me, void *loc)
1380  {
1381 -       return (loc >= me->module_init &&
1382 -               loc <= (me->module_init + me->init_size));
1383 +       return in_init_rx(me, loc) || in_init_rw(me, loc);
1384 +}
1385 +
1386 +static inline int in_core_rx(struct module *me, void *loc)
1387 +{
1388 +       return (loc >= me->module_core_rx &&
1389 +               loc < (me->module_core_rx + me->core_size_rx));
1390 +}
1391 +
1392 +static inline int in_core_rw(struct module *me, void *loc)
1393 +{
1394 +       return (loc >= me->module_core_rw &&
1395 +               loc < (me->module_core_rw + me->core_size_rw));
1396  }
1397
1398  static inline int in_core(struct module *me, void *loc)
1399  {
1400 -       return (loc >= me->module_core &&
1401 -               loc <= (me->module_core + me->core_size));
1402 +       return in_core_rx(me, loc) || in_core_rw(me, loc);
1403  }
1404
1405  static inline int in_local(struct module *me, void *loc)
1406 @@ -364,13 +386,13 @@ int module_frob_arch_sections(CONST Elf_
1407         }
1408
1409         /* align things a bit */
1410 -       me->core_size = ALIGN(me->core_size, 16);
1411 -       me->arch.got_offset = me->core_size;
1412 -       me->core_size += gots * sizeof(struct got_entry);
1413 -
1414 -       me->core_size = ALIGN(me->core_size, 16);
1415 -       me->arch.fdesc_offset = me->core_size;
1416 -       me->core_size += fdescs * sizeof(Elf_Fdesc);
1417 +       me->core_size_rw = ALIGN(me->core_size_rw, 16);
1418 +       me->arch.got_offset = me->core_size_rw;
1419 +       me->core_size_rw += gots * sizeof(struct got_entry);
1420 +
1421 +       me->core_size_rw = ALIGN(me->core_size_rw, 16);
1422 +       me->arch.fdesc_offset = me->core_size_rw;
1423 +       me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
1424
1425         me->arch.got_max = gots;
1426         me->arch.fdesc_max = fdescs;
1427 @@ -388,7 +410,7 @@ static Elf64_Word get_got(struct module
1428
1429         BUG_ON(value == 0);
1430
1431 -       got = me->module_core + me->arch.got_offset;
1432 +       got = me->module_core_rw + me->arch.got_offset;
1433         for (i = 0; got[i].addr; i++)
1434                 if (got[i].addr == value)
1435                         goto out;
1436 @@ -406,7 +428,7 @@ static Elf64_Word get_got(struct module
1437  #ifdef CONFIG_64BIT
1438  static Elf_Addr get_fdesc(struct module *me, unsigned long value)
1439  {
1440 -       Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
1441 +       Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
1442
1443         if (!value) {
1444                 printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
1445 @@ -424,7 +446,7 @@ static Elf_Addr get_fdesc(struct module
1446
1447         /* Create new one */
1448         fdesc->addr = value;
1449 -       fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1450 +       fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1451         return (Elf_Addr)fdesc;
1452  }
1453  #endif /* CONFIG_64BIT */
1454 @@ -848,7 +870,7 @@ register_unwind_table(struct module *me,
1455
1456         table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
1457         end = table + sechdrs[me->arch.unwind_section].sh_size;
1458 -       gp = (Elf_Addr)me->module_core + me->arch.got_offset;
1459 +       gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
1460
1461         DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
1462                me->arch.unwind_section, table, end, gp);
1463 diff -urNp linux-2.6.33/arch/parisc/kernel/sys_parisc.c linux-2.6.33/arch/parisc/kernel/sys_parisc.c
1464 --- linux-2.6.33/arch/parisc/kernel/sys_parisc.c        2010-02-24 13:52:17.000000000 -0500
1465 +++ linux-2.6.33/arch/parisc/kernel/sys_parisc.c        2010-03-07 12:23:35.899198434 -0500
1466 @@ -98,7 +98,7 @@ unsigned long arch_get_unmapped_area(str
1467         if (flags & MAP_FIXED)
1468                 return addr;
1469         if (!addr)
1470 -               addr = TASK_UNMAPPED_BASE;
1471 +               addr = current->mm->mmap_base;
1472
1473         if (filp) {
1474                 addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
1475 diff -urNp linux-2.6.33/arch/parisc/kernel/traps.c linux-2.6.33/arch/parisc/kernel/traps.c
1476 --- linux-2.6.33/arch/parisc/kernel/traps.c     2010-02-24 13:52:17.000000000 -0500
1477 +++ linux-2.6.33/arch/parisc/kernel/traps.c     2010-03-07 12:23:35.899198434 -0500
1478 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
1479
1480                         down_read(&current->mm->mmap_sem);
1481                         vma = find_vma(current->mm,regs->iaoq[0]);
1482 -                       if (vma && (regs->iaoq[0] >= vma->vm_start)
1483 -                               && (vma->vm_flags & VM_EXEC)) {
1484 -
1485 +                       if (vma && (regs->iaoq[0] >= vma->vm_start)) {
1486                                 fault_address = regs->iaoq[0];
1487                                 fault_space = regs->iasq[0];
1488
1489 diff -urNp linux-2.6.33/arch/parisc/mm/fault.c linux-2.6.33/arch/parisc/mm/fault.c
1490 --- linux-2.6.33/arch/parisc/mm/fault.c 2010-02-24 13:52:17.000000000 -0500
1491 +++ linux-2.6.33/arch/parisc/mm/fault.c 2010-03-07 12:23:35.899198434 -0500
1492 @@ -15,6 +15,7 @@
1493  #include <linux/sched.h>
1494  #include <linux/interrupt.h>
1495  #include <linux/module.h>
1496 +#include <linux/unistd.h>
1497
1498  #include <asm/uaccess.h>
1499  #include <asm/traps.h>
1500 @@ -52,7 +53,7 @@ DEFINE_PER_CPU(struct exception_data, ex
1501  static unsigned long
1502  parisc_acctyp(unsigned long code, unsigned int inst)
1503  {
1504 -       if (code == 6 || code == 16)
1505 +       if (code == 6 || code == 7 || code == 16)
1506             return VM_EXEC;
1507
1508         switch (inst & 0xf0000000) {
1509 @@ -138,6 +139,116 @@ parisc_acctyp(unsigned long code, unsign
1510                         }
1511  #endif
1512
1513 +#ifdef CONFIG_PAX_PAGEEXEC
1514 +/*
1515 + * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
1516 + *
1517 + * returns 1 when task should be killed
1518 + *         2 when rt_sigreturn trampoline was detected
1519 + *         3 when unpatched PLT trampoline was detected
1520 + */
1521 +static int pax_handle_fetch_fault(struct pt_regs *regs)
1522 +{
1523 +
1524 +#ifdef CONFIG_PAX_EMUPLT
1525 +       int err;
1526 +
1527 +       do { /* PaX: unpatched PLT emulation */
1528 +               unsigned int bl, depwi;
1529 +
1530 +               err = get_user(bl, (unsigned int *)instruction_pointer(regs));
1531 +               err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
1532 +
1533 +               if (err)
1534 +                       break;
1535 +
1536 +               if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
1537 +                       unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
1538 +
1539 +                       err = get_user(ldw, (unsigned int *)addr);
1540 +                       err |= get_user(bv, (unsigned int *)(addr+4));
1541 +                       err |= get_user(ldw2, (unsigned int *)(addr+8));
1542 +
1543 +                       if (err)
1544 +                               break;
1545 +
1546 +                       if (ldw == 0x0E801096U &&
1547 +                           bv == 0xEAC0C000U &&
1548 +                           ldw2 == 0x0E881095U)
1549 +                       {
1550 +                               unsigned int resolver, map;
1551 +
1552 +                               err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
1553 +                               err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
1554 +                               if (err)
1555 +                                       break;
1556 +
1557 +                               regs->gr[20] = instruction_pointer(regs)+8;
1558 +                               regs->gr[21] = map;
1559 +                               regs->gr[22] = resolver;
1560 +                               regs->iaoq[0] = resolver | 3UL;
1561 +                               regs->iaoq[1] = regs->iaoq[0] + 4;
1562 +                               return 3;
1563 +                       }
1564 +               }
1565 +       } while (0);
1566 +#endif
1567 +
1568 +#ifdef CONFIG_PAX_EMUTRAMP
1569 +
1570 +#ifndef CONFIG_PAX_EMUSIGRT
1571 +       if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
1572 +               return 1;
1573 +#endif
1574 +
1575 +       do { /* PaX: rt_sigreturn emulation */
1576 +               unsigned int ldi1, ldi2, bel, nop;
1577 +
1578 +               err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
1579 +               err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
1580 +               err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
1581 +               err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
1582 +
1583 +               if (err)
1584 +                       break;
1585 +
1586 +               if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
1587 +                   ldi2 == 0x3414015AU &&
1588 +                   bel == 0xE4008200U &&
1589 +                   nop == 0x08000240U)
1590 +               {
1591 +                       regs->gr[25] = (ldi1 & 2) >> 1;
1592 +                       regs->gr[20] = __NR_rt_sigreturn;
1593 +                       regs->gr[31] = regs->iaoq[1] + 16;
1594 +                       regs->sr[0] = regs->iasq[1];
1595 +                       regs->iaoq[0] = 0x100UL;
1596 +                       regs->iaoq[1] = regs->iaoq[0] + 4;
1597 +                       regs->iasq[0] = regs->sr[2];
1598 +                       regs->iasq[1] = regs->sr[2];
1599 +                       return 2;
1600 +               }
1601 +       } while (0);
1602 +#endif
1603 +
1604 +       return 1;
1605 +}
1606 +
1607 +void pax_report_insns(void *pc, void *sp)
1608 +{
1609 +       unsigned long i;
1610 +
1611 +       printk(KERN_ERR "PAX: bytes at PC: ");
1612 +       for (i = 0; i < 5; i++) {
1613 +               unsigned int c;
1614 +               if (get_user(c, (unsigned int *)pc+i))
1615 +                       printk(KERN_CONT "???????? ");
1616 +               else
1617 +                       printk(KERN_CONT "%08x ", c);
1618 +       }
1619 +       printk("\n");
1620 +}
1621 +#endif
1622 +
1623  int fixup_exception(struct pt_regs *regs)
1624  {
1625         const struct exception_table_entry *fix;
1626 @@ -192,8 +303,33 @@ good_area:
1627
1628         acc_type = parisc_acctyp(code,regs->iir);
1629
1630 -       if ((vma->vm_flags & acc_type) != acc_type)
1631 +       if ((vma->vm_flags & acc_type) != acc_type) {
1632 +
1633 +#ifdef CONFIG_PAX_PAGEEXEC
1634 +               if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
1635 +                   (address & ~3UL) == instruction_pointer(regs))
1636 +               {
1637 +                       up_read(&mm->mmap_sem);
1638 +                       switch (pax_handle_fetch_fault(regs)) {
1639 +
1640 +#ifdef CONFIG_PAX_EMUPLT
1641 +                       case 3:
1642 +                               return;
1643 +#endif
1644 +
1645 +#ifdef CONFIG_PAX_EMUTRAMP
1646 +                       case 2:
1647 +                               return;
1648 +#endif
1649 +
1650 +                       }
1651 +                       pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
1652 +                       do_group_exit(SIGKILL);
1653 +               }
1654 +#endif
1655 +
1656                 goto bad_area;
1657 +       }
1658
1659         /*
1660          * If for any reason at all we couldn't handle the fault, make
1661 diff -urNp linux-2.6.33/arch/powerpc/include/asm/device.h linux-2.6.33/arch/powerpc/include/asm/device.h
1662 --- linux-2.6.33/arch/powerpc/include/asm/device.h      2010-02-24 13:52:17.000000000 -0500
1663 +++ linux-2.6.33/arch/powerpc/include/asm/device.h      2010-03-07 12:23:35.899198434 -0500
1664 @@ -14,7 +14,7 @@ struct dev_archdata {
1665         struct device_node      *of_node;
1666
1667         /* DMA operations on that device */
1668 -       struct dma_map_ops      *dma_ops;
1669 +       const struct dma_map_ops        *dma_ops;
1670
1671         /*
1672          * When an iommu is in use, dma_data is used as a ptr to the base of the
1673 diff -urNp linux-2.6.33/arch/powerpc/include/asm/dma-mapping.h linux-2.6.33/arch/powerpc/include/asm/dma-mapping.h
1674 --- linux-2.6.33/arch/powerpc/include/asm/dma-mapping.h 2010-02-24 13:52:17.000000000 -0500
1675 +++ linux-2.6.33/arch/powerpc/include/asm/dma-mapping.h 2010-03-07 12:23:35.899198434 -0500
1676 @@ -69,9 +69,9 @@ static inline unsigned long device_to_ma
1677  #ifdef CONFIG_PPC64
1678  extern struct dma_map_ops dma_iommu_ops;
1679  #endif
1680 -extern struct dma_map_ops dma_direct_ops;
1681 +extern const struct dma_map_ops dma_direct_ops;
1682
1683 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
1684 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
1685  {
1686         /* We don't handle the NULL dev case for ISA for now. We could
1687          * do it via an out of line call but it is not needed for now. The
1688 @@ -84,7 +84,7 @@ static inline struct dma_map_ops *get_dm
1689         return dev->archdata.dma_ops;
1690  }
1691
1692 -static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
1693 +static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
1694  {
1695         dev->archdata.dma_ops = ops;
1696  }
1697 @@ -118,7 +118,7 @@ static inline void set_dma_offset(struct
1698
1699  static inline int dma_supported(struct device *dev, u64 mask)
1700  {
1701 -       struct dma_map_ops *dma_ops = get_dma_ops(dev);
1702 +       const struct dma_map_ops *dma_ops = get_dma_ops(dev);
1703
1704         if (unlikely(dma_ops == NULL))
1705                 return 0;
1706 @@ -132,7 +132,7 @@ static inline int dma_supported(struct d
1707
1708  static inline int dma_set_mask(struct device *dev, u64 dma_mask)
1709  {
1710 -       struct dma_map_ops *dma_ops = get_dma_ops(dev);
1711 +       const struct dma_map_ops *dma_ops = get_dma_ops(dev);
1712
1713         if (unlikely(dma_ops == NULL))
1714                 return -EIO;
1715 @@ -147,7 +147,7 @@ static inline int dma_set_mask(struct de
1716  static inline void *dma_alloc_coherent(struct device *dev, size_t size,
1717                                        dma_addr_t *dma_handle, gfp_t flag)
1718  {
1719 -       struct dma_map_ops *dma_ops = get_dma_ops(dev);
1720 +       const struct dma_map_ops *dma_ops = get_dma_ops(dev);
1721         void *cpu_addr;
1722
1723         BUG_ON(!dma_ops);
1724 @@ -162,7 +162,7 @@ static inline void *dma_alloc_coherent(s
1725  static inline void dma_free_coherent(struct device *dev, size_t size,
1726                                      void *cpu_addr, dma_addr_t dma_handle)
1727  {
1728 -       struct dma_map_ops *dma_ops = get_dma_ops(dev);
1729 +       const struct dma_map_ops *dma_ops = get_dma_ops(dev);
1730
1731         BUG_ON(!dma_ops);
1732
1733 @@ -173,7 +173,7 @@ static inline void dma_free_coherent(str
1734
1735  static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
1736  {
1737 -       struct dma_map_ops *dma_ops = get_dma_ops(dev);
1738 +       const struct dma_map_ops *dma_ops = get_dma_ops(dev);
1739
1740         if (dma_ops->mapping_error)
1741                 return dma_ops->mapping_error(dev, dma_addr);
1742 diff -urNp linux-2.6.33/arch/powerpc/include/asm/elf.h linux-2.6.33/arch/powerpc/include/asm/elf.h
1743 --- linux-2.6.33/arch/powerpc/include/asm/elf.h 2010-02-24 13:52:17.000000000 -0500
1744 +++ linux-2.6.33/arch/powerpc/include/asm/elf.h 2010-03-07 12:23:35.899198434 -0500
1745 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
1746     the loader.  We need to make sure that it is out of the way of the program
1747     that it will "exec", and that there is sufficient room for the brk.  */
1748
1749 -extern unsigned long randomize_et_dyn(unsigned long base);
1750 -#define ELF_ET_DYN_BASE                (randomize_et_dyn(0x20000000))
1751 +#define ELF_ET_DYN_BASE                (0x20000000)
1752 +
1753 +#ifdef CONFIG_PAX_ASLR
1754 +#define PAX_ELF_ET_DYN_BASE    (0x10000000UL)
1755 +
1756 +#ifdef __powerpc64__
1757 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_32BIT) ? 16 : 28)
1758 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_32BIT) ? 16 : 28)
1759 +#else
1760 +#define PAX_DELTA_MMAP_LEN     15
1761 +#define PAX_DELTA_STACK_LEN    15
1762 +#endif
1763 +#endif
1764
1765  /*
1766   * Our registers are always unsigned longs, whether we're a 32 bit
1767 @@ -274,9 +285,6 @@ extern int arch_setup_additional_pages(s
1768         (0x7ff >> (PAGE_SHIFT - 12)) : \
1769         (0x3ffff >> (PAGE_SHIFT - 12)))
1770
1771 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
1772 -#define arch_randomize_brk arch_randomize_brk
1773 -
1774  #endif /* __KERNEL__ */
1775
1776  /*
1777 diff -urNp linux-2.6.33/arch/powerpc/include/asm/iommu.h linux-2.6.33/arch/powerpc/include/asm/iommu.h
1778 --- linux-2.6.33/arch/powerpc/include/asm/iommu.h       2010-02-24 13:52:17.000000000 -0500
1779 +++ linux-2.6.33/arch/powerpc/include/asm/iommu.h       2010-03-07 12:23:35.899198434 -0500
1780 @@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
1781  extern void iommu_init_early_dart(void);
1782  extern void iommu_init_early_pasemi(void);
1783
1784 +/* dma-iommu.c */
1785 +extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
1786 +
1787  #ifdef CONFIG_PCI
1788  extern void pci_iommu_init(void);
1789  extern void pci_direct_iommu_init(void);
1790 diff -urNp linux-2.6.33/arch/powerpc/include/asm/kmap_types.h linux-2.6.33/arch/powerpc/include/asm/kmap_types.h
1791 --- linux-2.6.33/arch/powerpc/include/asm/kmap_types.h  2010-02-24 13:52:17.000000000 -0500
1792 +++ linux-2.6.33/arch/powerpc/include/asm/kmap_types.h  2010-03-07 12:23:35.899198434 -0500
1793 @@ -26,6 +26,7 @@ enum km_type {
1794         KM_SOFTIRQ1,
1795         KM_PPC_SYNC_PAGE,
1796         KM_PPC_SYNC_ICACHE,
1797 +       KM_CLEARPAGE,
1798         KM_TYPE_NR
1799  };
1800
1801 diff -urNp linux-2.6.33/arch/powerpc/include/asm/page_64.h linux-2.6.33/arch/powerpc/include/asm/page_64.h
1802 --- linux-2.6.33/arch/powerpc/include/asm/page_64.h     2010-02-24 13:52:17.000000000 -0500
1803 +++ linux-2.6.33/arch/powerpc/include/asm/page_64.h     2010-03-07 12:23:35.899198434 -0500
1804 @@ -180,15 +180,18 @@ do {                                              \
1805   * stack by default, so in the absense of a PT_GNU_STACK program header
1806   * we turn execute permission off.
1807   */
1808 -#define VM_STACK_DEFAULT_FLAGS32       (VM_READ | VM_WRITE | VM_EXEC | \
1809 -                                        VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1810 +#define VM_STACK_DEFAULT_FLAGS32 \
1811 +       (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1812 +        VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1813
1814  #define VM_STACK_DEFAULT_FLAGS64       (VM_READ | VM_WRITE | \
1815                                          VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1816
1817 +#ifndef CONFIG_PAX_PAGEEXEC
1818  #define VM_STACK_DEFAULT_FLAGS \
1819         (test_thread_flag(TIF_32BIT) ? \
1820          VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
1821 +#endif
1822
1823  #include <asm-generic/getorder.h>
1824
1825 diff -urNp linux-2.6.33/arch/powerpc/include/asm/page.h linux-2.6.33/arch/powerpc/include/asm/page.h
1826 --- linux-2.6.33/arch/powerpc/include/asm/page.h        2010-02-24 13:52:17.000000000 -0500
1827 +++ linux-2.6.33/arch/powerpc/include/asm/page.h        2010-03-07 12:23:35.899198434 -0500
1828 @@ -116,8 +116,9 @@ extern phys_addr_t kernstart_addr;
1829   * and needs to be executable.  This means the whole heap ends
1830   * up being executable.
1831   */
1832 -#define VM_DATA_DEFAULT_FLAGS32        (VM_READ | VM_WRITE | VM_EXEC | \
1833 -                                VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1834 +#define VM_DATA_DEFAULT_FLAGS32 \
1835 +       (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
1836 +        VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1837
1838  #define VM_DATA_DEFAULT_FLAGS64        (VM_READ | VM_WRITE | \
1839                                  VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
1840 @@ -145,6 +146,9 @@ extern phys_addr_t kernstart_addr;
1841  #define is_kernel_addr(x)      ((x) >= PAGE_OFFSET)
1842  #endif
1843
1844 +#define ktla_ktva(addr)                (addr)
1845 +#define ktva_ktla(addr)                (addr)
1846 +
1847  #ifndef __ASSEMBLY__
1848
1849  #undef STRICT_MM_TYPECHECKS
1850 diff -urNp linux-2.6.33/arch/powerpc/include/asm/pci.h linux-2.6.33/arch/powerpc/include/asm/pci.h
1851 --- linux-2.6.33/arch/powerpc/include/asm/pci.h 2010-02-24 13:52:17.000000000 -0500
1852 +++ linux-2.6.33/arch/powerpc/include/asm/pci.h 2010-03-07 12:23:35.899198434 -0500
1853 @@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
1854  }
1855
1856  #ifdef CONFIG_PCI
1857 -extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
1858 -extern struct dma_map_ops *get_pci_dma_ops(void);
1859 +extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
1860 +extern const struct dma_map_ops *get_pci_dma_ops(void);
1861  #else  /* CONFIG_PCI */
1862  #define set_pci_dma_ops(d)
1863  #define get_pci_dma_ops()      NULL
1864 diff -urNp linux-2.6.33/arch/powerpc/include/asm/pte-hash32.h linux-2.6.33/arch/powerpc/include/asm/pte-hash32.h
1865 --- linux-2.6.33/arch/powerpc/include/asm/pte-hash32.h  2010-02-24 13:52:17.000000000 -0500
1866 +++ linux-2.6.33/arch/powerpc/include/asm/pte-hash32.h  2010-03-07 12:23:35.899198434 -0500
1867 @@ -21,6 +21,7 @@
1868  #define _PAGE_FILE     0x004   /* when !present: nonlinear file mapping */
1869  #define _PAGE_USER     0x004   /* usermode access allowed */
1870  #define _PAGE_GUARDED  0x008   /* G: prohibit speculative access */
1871 +#define _PAGE_EXEC     _PAGE_GUARDED
1872  #define _PAGE_COHERENT 0x010   /* M: enforce memory coherence (SMP systems) */
1873  #define _PAGE_NO_CACHE 0x020   /* I: cache inhibit */
1874  #define _PAGE_WRITETHRU        0x040   /* W: cache write-through */
1875 diff -urNp linux-2.6.33/arch/powerpc/include/asm/reg.h linux-2.6.33/arch/powerpc/include/asm/reg.h
1876 --- linux-2.6.33/arch/powerpc/include/asm/reg.h 2010-02-24 13:52:17.000000000 -0500
1877 +++ linux-2.6.33/arch/powerpc/include/asm/reg.h 2010-03-07 12:23:35.899198434 -0500
1878 @@ -191,6 +191,7 @@
1879  #define SPRN_DBCR      0x136   /* e300 Data Breakpoint Control Reg */
1880  #define SPRN_DSISR     0x012   /* Data Storage Interrupt Status Register */
1881  #define   DSISR_NOHPTE         0x40000000      /* no translation found */
1882 +#define   DSISR_GUARDED                0x10000000      /* fetch from guarded storage */
1883  #define   DSISR_PROTFAULT      0x08000000      /* protection fault */
1884  #define   DSISR_ISSTORE                0x02000000      /* access was a store */
1885  #define   DSISR_DABRMATCH      0x00400000      /* hit data breakpoint */
1886 diff -urNp linux-2.6.33/arch/powerpc/include/asm/swiotlb.h linux-2.6.33/arch/powerpc/include/asm/swiotlb.h
1887 --- linux-2.6.33/arch/powerpc/include/asm/swiotlb.h     2010-02-24 13:52:17.000000000 -0500
1888 +++ linux-2.6.33/arch/powerpc/include/asm/swiotlb.h     2010-03-07 12:23:35.899198434 -0500
1889 @@ -13,7 +13,7 @@
1890
1891  #include <linux/swiotlb.h>
1892
1893 -extern struct dma_map_ops swiotlb_dma_ops;
1894 +extern const struct dma_map_ops swiotlb_dma_ops;
1895
1896  static inline void dma_mark_clean(void *addr, size_t size) {}
1897
1898 diff -urNp linux-2.6.33/arch/powerpc/include/asm/uaccess.h linux-2.6.33/arch/powerpc/include/asm/uaccess.h
1899 --- linux-2.6.33/arch/powerpc/include/asm/uaccess.h     2010-02-24 13:52:17.000000000 -0500
1900 +++ linux-2.6.33/arch/powerpc/include/asm/uaccess.h     2010-03-07 12:23:35.899198434 -0500
1901 @@ -327,52 +327,6 @@ do {                                                               \
1902  extern unsigned long __copy_tofrom_user(void __user *to,
1903                 const void __user *from, unsigned long size);
1904
1905 -#ifndef __powerpc64__
1906 -
1907 -static inline unsigned long copy_from_user(void *to,
1908 -               const void __user *from, unsigned long n)
1909 -{
1910 -       unsigned long over;
1911 -
1912 -       if (access_ok(VERIFY_READ, from, n))
1913 -               return __copy_tofrom_user((__force void __user *)to, from, n);
1914 -       if ((unsigned long)from < TASK_SIZE) {
1915 -               over = (unsigned long)from + n - TASK_SIZE;
1916 -               return __copy_tofrom_user((__force void __user *)to, from,
1917 -                               n - over) + over;
1918 -       }
1919 -       return n;
1920 -}
1921 -
1922 -static inline unsigned long copy_to_user(void __user *to,
1923 -               const void *from, unsigned long n)
1924 -{
1925 -       unsigned long over;
1926 -
1927 -       if (access_ok(VERIFY_WRITE, to, n))
1928 -               return __copy_tofrom_user(to, (__force void __user *)from, n);
1929 -       if ((unsigned long)to < TASK_SIZE) {
1930 -               over = (unsigned long)to + n - TASK_SIZE;
1931 -               return __copy_tofrom_user(to, (__force void __user *)from,
1932 -                               n - over) + over;
1933 -       }
1934 -       return n;
1935 -}
1936 -
1937 -#else /* __powerpc64__ */
1938 -
1939 -#define __copy_in_user(to, from, size) \
1940 -       __copy_tofrom_user((to), (from), (size))
1941 -
1942 -extern unsigned long copy_from_user(void *to, const void __user *from,
1943 -                                   unsigned long n);
1944 -extern unsigned long copy_to_user(void __user *to, const void *from,
1945 -                                 unsigned long n);
1946 -extern unsigned long copy_in_user(void __user *to, const void __user *from,
1947 -                                 unsigned long n);
1948 -
1949 -#endif /* __powerpc64__ */
1950 -
1951  static inline unsigned long __copy_from_user_inatomic(void *to,
1952                 const void __user *from, unsigned long n)
1953  {
1954 @@ -396,6 +350,10 @@ static inline unsigned long __copy_from_
1955                 if (ret == 0)
1956                         return 0;
1957         }
1958 +
1959 +       if (!__builtin_constant_p(n))
1960 +               check_object_size(to, n, false);
1961 +
1962         return __copy_tofrom_user((__force void __user *)to, from, n);
1963  }
1964
1965 @@ -422,6 +380,10 @@ static inline unsigned long __copy_to_us
1966                 if (ret == 0)
1967                         return 0;
1968         }
1969 +
1970 +       if (!__builtin_constant_p(n))
1971 +               check_object_size(from, n, true);
1972 +
1973         return __copy_tofrom_user(to, (__force const void __user *)from, n);
1974  }
1975
1976 @@ -439,6 +401,92 @@ static inline unsigned long __copy_to_us
1977         return __copy_to_user_inatomic(to, from, size);
1978  }
1979
1980 +#ifndef __powerpc64__
1981 +
1982 +static inline unsigned long __must_check copy_from_user(void *to,
1983 +               const void __user *from, unsigned long n)
1984 +{
1985 +       unsigned long over;
1986 +
1987 +       if ((long)n < 0)
1988 +               return n;
1989 +
1990 +       if (access_ok(VERIFY_READ, from, n)) {
1991 +               if (!__builtin_constant_p(n))
1992 +                       check_object_size(to, n, false);
1993 +               return __copy_tofrom_user((__force void __user *)to, from, n);
1994 +       }
1995 +       if ((unsigned long)from < TASK_SIZE) {
1996 +               over = (unsigned long)from + n - TASK_SIZE;
1997 +               if (!__builtin_constant_p(n - over))
1998 +                       check_object_size(to, n - over, false);
1999 +               return __copy_tofrom_user((__force void __user *)to, from,
2000 +                               n - over) + over;
2001 +       }
2002 +       return n;
2003 +}
2004 +
2005 +static inline unsigned long __must_check copy_to_user(void __user *to,
2006 +               const void *from, unsigned long n)
2007 +{
2008 +       unsigned long over;
2009 +
2010 +       if ((long)n < 0)
2011 +               return n;
2012 +
2013 +       if (access_ok(VERIFY_WRITE, to, n)) {
2014 +               if (!__builtin_constant_p(n))
2015 +                       check_object_size(from, n, true);
2016 +               return __copy_tofrom_user(to, (__force void __user *)from, n);
2017 +       }
2018 +       if ((unsigned long)to < TASK_SIZE) {
2019 +               over = (unsigned long)to + n - TASK_SIZE;
2020 +               if (!__builtin_constant_p(n))
2021 +                       check_object_size(from, n - over, true);
2022 +               return __copy_tofrom_user(to, (__force void __user *)from,
2023 +                               n - over) + over;
2024 +       }
2025 +       return n;
2026 +}
2027 +
2028 +#else /* __powerpc64__ */
2029 +
2030 +#define __copy_in_user(to, from, size) \
2031 +       __copy_tofrom_user((to), (from), (size))
2032 +
2033 +static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
2034 +{
2035 +       if ((long)n < 0 || n > INT_MAX)
2036 +               return n;
2037 +
2038 +       if (!__builtin_constant_p(n))
2039 +               check_object_size(to, n, false);
2040 +
2041 +       if (likely(access_ok(VERIFY_READ, from, n)))
2042 +               n = __copy_from_user(to, from, n);
2043 +       else
2044 +               memset(to, 0, n);
2045 +       return n;
2046 +}
2047 +
2048 +static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
2049 +{
2050 +       if ((long)n < 0 || n > INT_MAX)
2051 +               return n;
2052 +
2053 +       if (likely(access_ok(VERIFY_WRITE, to, n))) {
2054 +               if (!__builtin_constant_p(n))
2055 +                       check_object_size(from, n, true);
2056 +               n = __copy_to_user(to, from, n);
2057 +       }
2058 +       return n;
2059 +}
2060 +
2061 +extern unsigned long copy_in_user(void __user *to, const void __user *from,
2062 +                                 unsigned long n);
2063 +
2064 +#endif /* __powerpc64__ */
2065 +
2066  extern unsigned long __clear_user(void __user *addr, unsigned long size);
2067
2068  static inline unsigned long clear_user(void __user *addr, unsigned long size)
2069 diff -urNp linux-2.6.33/arch/powerpc/kernel/cacheinfo.c linux-2.6.33/arch/powerpc/kernel/cacheinfo.c
2070 --- linux-2.6.33/arch/powerpc/kernel/cacheinfo.c        2010-02-24 13:52:17.000000000 -0500
2071 +++ linux-2.6.33/arch/powerpc/kernel/cacheinfo.c        2010-03-07 12:23:35.899198434 -0500
2072 @@ -642,7 +642,7 @@ static struct kobj_attribute *cache_inde
2073         &cache_assoc_attr,
2074  };
2075
2076 -static struct sysfs_ops cache_index_ops = {
2077 +static const struct sysfs_ops cache_index_ops = {
2078         .show = cache_index_show,
2079  };
2080
2081 diff -urNp linux-2.6.33/arch/powerpc/kernel/dma.c linux-2.6.33/arch/powerpc/kernel/dma.c
2082 --- linux-2.6.33/arch/powerpc/kernel/dma.c      2010-02-24 13:52:17.000000000 -0500
2083 +++ linux-2.6.33/arch/powerpc/kernel/dma.c      2010-03-07 12:23:35.899198434 -0500
2084 @@ -134,7 +134,7 @@ static inline void dma_direct_sync_singl
2085  }
2086  #endif
2087
2088 -struct dma_map_ops dma_direct_ops = {
2089 +const struct dma_map_ops dma_direct_ops = {
2090         .alloc_coherent = dma_direct_alloc_coherent,
2091         .free_coherent  = dma_direct_free_coherent,
2092         .map_sg         = dma_direct_map_sg,
2093 diff -urNp linux-2.6.33/arch/powerpc/kernel/dma-iommu.c linux-2.6.33/arch/powerpc/kernel/dma-iommu.c
2094 --- linux-2.6.33/arch/powerpc/kernel/dma-iommu.c        2010-02-24 13:52:17.000000000 -0500
2095 +++ linux-2.6.33/arch/powerpc/kernel/dma-iommu.c        2010-03-07 12:23:35.899198434 -0500
2096 @@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
2097  }
2098
2099  /* We support DMA to/from any memory page via the iommu */
2100 -static int dma_iommu_dma_supported(struct device *dev, u64 mask)
2101 +int dma_iommu_dma_supported(struct device *dev, u64 mask)
2102  {
2103         struct iommu_table *tbl = get_iommu_table_base(dev);
2104
2105 diff -urNp linux-2.6.33/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.33/arch/powerpc/kernel/dma-swiotlb.c
2106 --- linux-2.6.33/arch/powerpc/kernel/dma-swiotlb.c      2010-02-24 13:52:17.000000000 -0500
2107 +++ linux-2.6.33/arch/powerpc/kernel/dma-swiotlb.c      2010-03-07 12:23:35.899198434 -0500
2108 @@ -30,7 +30,7 @@ unsigned int ppc_swiotlb_enable;
2109   * map_page, and unmap_page on highmem, use normal dma_ops
2110   * for everything else.
2111   */
2112 -struct dma_map_ops swiotlb_dma_ops = {
2113 +const struct dma_map_ops swiotlb_dma_ops = {
2114         .alloc_coherent = dma_direct_alloc_coherent,
2115         .free_coherent = dma_direct_free_coherent,
2116         .map_sg = swiotlb_map_sg_attrs,
2117 diff -urNp linux-2.6.33/arch/powerpc/kernel/exceptions-64e.S linux-2.6.33/arch/powerpc/kernel/exceptions-64e.S
2118 --- linux-2.6.33/arch/powerpc/kernel/exceptions-64e.S   2010-02-24 13:52:17.000000000 -0500
2119 +++ linux-2.6.33/arch/powerpc/kernel/exceptions-64e.S   2010-03-07 12:23:35.899198434 -0500
2120 @@ -455,6 +455,7 @@ storage_fault_common:
2121         std     r14,_DAR(r1)
2122         std     r15,_DSISR(r1)
2123         addi    r3,r1,STACK_FRAME_OVERHEAD
2124 +       bl      .save_nvgprs
2125         mr      r4,r14
2126         mr      r5,r15
2127         ld      r14,PACA_EXGEN+EX_R14(r13)
2128 @@ -464,8 +465,7 @@ storage_fault_common:
2129         cmpdi   r3,0
2130         bne-    1f
2131         b       .ret_from_except_lite
2132 -1:     bl      .save_nvgprs
2133 -       mr      r5,r3
2134 +1:     mr      r5,r3
2135         addi    r3,r1,STACK_FRAME_OVERHEAD
2136         ld      r4,_DAR(r1)
2137         bl      .bad_page_fault
2138 diff -urNp linux-2.6.33/arch/powerpc/kernel/exceptions-64s.S linux-2.6.33/arch/powerpc/kernel/exceptions-64s.S
2139 --- linux-2.6.33/arch/powerpc/kernel/exceptions-64s.S   2010-02-24 13:52:17.000000000 -0500
2140 +++ linux-2.6.33/arch/powerpc/kernel/exceptions-64s.S   2010-03-07 12:23:35.899198434 -0500
2141 @@ -829,10 +829,10 @@ handle_page_fault:
2142  11:    ld      r4,_DAR(r1)
2143         ld      r5,_DSISR(r1)
2144         addi    r3,r1,STACK_FRAME_OVERHEAD
2145 +       bl      .save_nvgprs
2146         bl      .do_page_fault
2147         cmpdi   r3,0
2148         beq+    13f
2149 -       bl      .save_nvgprs
2150         mr      r5,r3
2151         addi    r3,r1,STACK_FRAME_OVERHEAD
2152         lwz     r4,_DAR(r1)
2153 diff -urNp linux-2.6.33/arch/powerpc/kernel/ibmebus.c linux-2.6.33/arch/powerpc/kernel/ibmebus.c
2154 --- linux-2.6.33/arch/powerpc/kernel/ibmebus.c  2010-02-24 13:52:17.000000000 -0500
2155 +++ linux-2.6.33/arch/powerpc/kernel/ibmebus.c  2010-03-07 12:23:35.903199907 -0500
2156 @@ -127,7 +127,7 @@ static int ibmebus_dma_supported(struct
2157         return 1;
2158  }
2159
2160 -static struct dma_map_ops ibmebus_dma_ops = {
2161 +static const struct dma_map_ops ibmebus_dma_ops = {
2162         .alloc_coherent = ibmebus_alloc_coherent,
2163         .free_coherent  = ibmebus_free_coherent,
2164         .map_sg         = ibmebus_map_sg,
2165 diff -urNp linux-2.6.33/arch/powerpc/kernel/kgdb.c linux-2.6.33/arch/powerpc/kernel/kgdb.c
2166 --- linux-2.6.33/arch/powerpc/kernel/kgdb.c     2010-02-24 13:52:17.000000000 -0500
2167 +++ linux-2.6.33/arch/powerpc/kernel/kgdb.c     2010-03-07 12:23:35.903199907 -0500
2168 @@ -126,7 +126,7 @@ static int kgdb_handle_breakpoint(struct
2169         if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
2170                 return 0;
2171
2172 -       if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2173 +       if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
2174                 regs->nip += 4;
2175
2176         return 1;
2177 @@ -353,7 +353,7 @@ int kgdb_arch_handle_exception(int vecto
2178  /*
2179   * Global data
2180   */
2181 -struct kgdb_arch arch_kgdb_ops = {
2182 +const struct kgdb_arch arch_kgdb_ops = {
2183         .gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
2184  };
2185
2186 diff -urNp linux-2.6.33/arch/powerpc/kernel/module_32.c linux-2.6.33/arch/powerpc/kernel/module_32.c
2187 --- linux-2.6.33/arch/powerpc/kernel/module_32.c        2010-02-24 13:52:17.000000000 -0500
2188 +++ linux-2.6.33/arch/powerpc/kernel/module_32.c        2010-03-07 12:23:35.903199907 -0500
2189 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
2190                         me->arch.core_plt_section = i;
2191         }
2192         if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
2193 -               printk("Module doesn't contain .plt or .init.plt sections.\n");
2194 +               printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
2195                 return -ENOEXEC;
2196         }
2197
2198 @@ -203,11 +203,16 @@ static uint32_t do_plt_call(void *locati
2199
2200         DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
2201         /* Init, or core PLT? */
2202 -       if (location >= mod->module_core
2203 -           && location < mod->module_core + mod->core_size)
2204 +       if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
2205 +           (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
2206                 entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
2207 -       else
2208 +       else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
2209 +                (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
2210                 entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
2211 +       else {
2212 +               printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
2213 +               return ~0UL;
2214 +       }
2215
2216         /* Find this entry, or if that fails, the next avail. entry */
2217         while (entry->jump[0]) {
2218 diff -urNp linux-2.6.33/arch/powerpc/kernel/module.c linux-2.6.33/arch/powerpc/kernel/module.c
2219 --- linux-2.6.33/arch/powerpc/kernel/module.c   2010-02-24 13:52:17.000000000 -0500
2220 +++ linux-2.6.33/arch/powerpc/kernel/module.c   2010-03-07 12:23:35.903199907 -0500
2221 @@ -31,11 +31,24 @@
2222
2223  LIST_HEAD(module_bug_list);
2224
2225 +#ifdef CONFIG_PAX_KERNEXEC
2226  void *module_alloc(unsigned long size)
2227  {
2228         if (size == 0)
2229                 return NULL;
2230
2231 +       return vmalloc(size);
2232 +}
2233 +
2234 +void *module_alloc_exec(unsigned long size)
2235 +#else
2236 +void *module_alloc(unsigned long size)
2237 +#endif
2238 +
2239 +{
2240 +       if (size == 0)
2241 +               return NULL;
2242 +
2243         return vmalloc_exec(size);
2244  }
2245
2246 @@ -45,6 +58,13 @@ void module_free(struct module *mod, voi
2247         vfree(module_region);
2248  }
2249
2250 +#ifdef CONFIG_PAX_KERNEXEC
2251 +void module_free_exec(struct module *mod, void *module_region)
2252 +{
2253 +       module_free(mod, module_region);
2254 +}
2255 +#endif
2256 +
2257  static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
2258                                     const Elf_Shdr *sechdrs,
2259                                     const char *name)
2260 diff -urNp linux-2.6.33/arch/powerpc/kernel/pci-common.c linux-2.6.33/arch/powerpc/kernel/pci-common.c
2261 --- linux-2.6.33/arch/powerpc/kernel/pci-common.c       2010-02-24 13:52:17.000000000 -0500
2262 +++ linux-2.6.33/arch/powerpc/kernel/pci-common.c       2010-03-07 12:23:35.903199907 -0500
2263 @@ -50,14 +50,14 @@ resource_size_t isa_mem_base;
2264  unsigned int ppc_pci_flags = 0;
2265
2266
2267 -static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2268 +static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
2269
2270 -void set_pci_dma_ops(struct dma_map_ops *dma_ops)
2271 +void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
2272  {
2273         pci_dma_ops = dma_ops;
2274  }
2275
2276 -struct dma_map_ops *get_pci_dma_ops(void)
2277 +const struct dma_map_ops *get_pci_dma_ops(void)
2278  {
2279         return pci_dma_ops;
2280  }
2281 diff -urNp linux-2.6.33/arch/powerpc/kernel/process.c linux-2.6.33/arch/powerpc/kernel/process.c
2282 --- linux-2.6.33/arch/powerpc/kernel/process.c  2010-02-24 13:52:17.000000000 -0500
2283 +++ linux-2.6.33/arch/powerpc/kernel/process.c  2010-03-07 12:23:35.903199907 -0500
2284 @@ -1141,51 +1141,3 @@ unsigned long arch_align_stack(unsigned
2285                 sp -= get_random_int() & ~PAGE_MASK;
2286         return sp & ~0xf;
2287  }
2288 -
2289 -static inline unsigned long brk_rnd(void)
2290 -{
2291 -        unsigned long rnd = 0;
2292 -
2293 -       /* 8MB for 32bit, 1GB for 64bit */
2294 -       if (is_32bit_task())
2295 -               rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
2296 -       else
2297 -               rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
2298 -
2299 -       return rnd << PAGE_SHIFT;
2300 -}
2301 -
2302 -unsigned long arch_randomize_brk(struct mm_struct *mm)
2303 -{
2304 -       unsigned long base = mm->brk;
2305 -       unsigned long ret;
2306 -
2307 -#ifdef CONFIG_PPC_STD_MMU_64
2308 -       /*
2309 -        * If we are using 1TB segments and we are allowed to randomise
2310 -        * the heap, we can put it above 1TB so it is backed by a 1TB
2311 -        * segment. Otherwise the heap will be in the bottom 1TB
2312 -        * which always uses 256MB segments and this may result in a
2313 -        * performance penalty.
2314 -        */
2315 -       if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
2316 -               base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
2317 -#endif
2318 -
2319 -       ret = PAGE_ALIGN(base + brk_rnd());
2320 -
2321 -       if (ret < mm->brk)
2322 -               return mm->brk;
2323 -
2324 -       return ret;
2325 -}
2326 -
2327 -unsigned long randomize_et_dyn(unsigned long base)
2328 -{
2329 -       unsigned long ret = PAGE_ALIGN(base + brk_rnd());
2330 -
2331 -       if (ret < base)
2332 -               return base;
2333 -
2334 -       return ret;
2335 -}
2336 diff -urNp linux-2.6.33/arch/powerpc/kernel/signal_32.c linux-2.6.33/arch/powerpc/kernel/signal_32.c
2337 --- linux-2.6.33/arch/powerpc/kernel/signal_32.c        2010-02-24 13:52:17.000000000 -0500
2338 +++ linux-2.6.33/arch/powerpc/kernel/signal_32.c        2010-03-07 12:23:35.903199907 -0500
2339 @@ -857,7 +857,7 @@ int handle_rt_signal32(unsigned long sig
2340         /* Save user registers on the stack */
2341         frame = &rt_sf->uc.uc_mcontext;
2342         addr = frame;
2343 -       if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
2344 +       if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2345                 if (save_user_regs(regs, frame, 0, 1))
2346                         goto badframe;
2347                 regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
2348 diff -urNp linux-2.6.33/arch/powerpc/kernel/signal_64.c linux-2.6.33/arch/powerpc/kernel/signal_64.c
2349 --- linux-2.6.33/arch/powerpc/kernel/signal_64.c        2010-02-24 13:52:17.000000000 -0500
2350 +++ linux-2.6.33/arch/powerpc/kernel/signal_64.c        2010-03-07 12:23:35.903199907 -0500
2351 @@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
2352         current->thread.fpscr.val = 0;
2353
2354         /* Set up to return from userspace. */
2355 -       if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
2356 +       if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
2357                 regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
2358         } else {
2359                 err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
2360 diff -urNp linux-2.6.33/arch/powerpc/kernel/vdso.c linux-2.6.33/arch/powerpc/kernel/vdso.c
2361 --- linux-2.6.33/arch/powerpc/kernel/vdso.c     2010-02-24 13:52:17.000000000 -0500
2362 +++ linux-2.6.33/arch/powerpc/kernel/vdso.c     2010-03-07 12:23:35.903199907 -0500
2363 @@ -36,6 +36,7 @@
2364  #include <asm/firmware.h>
2365  #include <asm/vdso.h>
2366  #include <asm/vdso_datapage.h>
2367 +#include <asm/mman.h>
2368
2369  #include "setup.h"
2370
2371 @@ -220,7 +221,7 @@ int arch_setup_additional_pages(struct l
2372         vdso_base = VDSO32_MBASE;
2373  #endif
2374
2375 -       current->mm->context.vdso_base = 0;
2376 +       current->mm->context.vdso_base = ~0UL;
2377
2378         /* vDSO has a problem and was disabled, just don't "enable" it for the
2379          * process
2380 @@ -240,7 +241,7 @@ int arch_setup_additional_pages(struct l
2381         vdso_base = get_unmapped_area(NULL, vdso_base,
2382                                       (vdso_pages << PAGE_SHIFT) +
2383                                       ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
2384 -                                     0, 0);
2385 +                                     0, MAP_PRIVATE | MAP_EXECUTABLE);
2386         if (IS_ERR_VALUE(vdso_base)) {
2387                 rc = vdso_base;
2388                 goto fail_mmapsem;
2389 diff -urNp linux-2.6.33/arch/powerpc/kernel/vio.c linux-2.6.33/arch/powerpc/kernel/vio.c
2390 --- linux-2.6.33/arch/powerpc/kernel/vio.c      2010-02-24 13:52:17.000000000 -0500
2391 +++ linux-2.6.33/arch/powerpc/kernel/vio.c      2010-03-07 12:23:35.903199907 -0500
2392 @@ -601,11 +601,12 @@ static void vio_dma_iommu_unmap_sg(struc
2393         vio_cmo_dealloc(viodev, alloc_size);
2394  }
2395
2396 -struct dma_map_ops vio_dma_mapping_ops = {
2397 +static const struct dma_map_ops vio_dma_mapping_ops = {
2398         .alloc_coherent = vio_dma_iommu_alloc_coherent,
2399         .free_coherent  = vio_dma_iommu_free_coherent,
2400         .map_sg         = vio_dma_iommu_map_sg,
2401         .unmap_sg       = vio_dma_iommu_unmap_sg,
2402 +       .dma_supported  = dma_iommu_dma_supported,
2403         .map_page       = vio_dma_iommu_map_page,
2404         .unmap_page     = vio_dma_iommu_unmap_page,
2405
2406 @@ -857,7 +858,6 @@ static void vio_cmo_bus_remove(struct vi
2407
2408  static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
2409  {
2410 -       vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
2411         viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
2412  }
2413
2414 diff -urNp linux-2.6.33/arch/powerpc/lib/usercopy_64.c linux-2.6.33/arch/powerpc/lib/usercopy_64.c
2415 --- linux-2.6.33/arch/powerpc/lib/usercopy_64.c 2010-02-24 13:52:17.000000000 -0500
2416 +++ linux-2.6.33/arch/powerpc/lib/usercopy_64.c 2010-03-07 12:23:35.903199907 -0500
2417 @@ -9,22 +9,6 @@
2418  #include <linux/module.h>
2419  #include <asm/uaccess.h>
2420
2421 -unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
2422 -{
2423 -       if (likely(access_ok(VERIFY_READ, from, n)))
2424 -               n = __copy_from_user(to, from, n);
2425 -       else
2426 -               memset(to, 0, n);
2427 -       return n;
2428 -}
2429 -
2430 -unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
2431 -{
2432 -       if (likely(access_ok(VERIFY_WRITE, to, n)))
2433 -               n = __copy_to_user(to, from, n);
2434 -       return n;
2435 -}
2436 -
2437  unsigned long copy_in_user(void __user *to, const void __user *from,
2438                            unsigned long n)
2439  {
2440 @@ -35,7 +19,5 @@ unsigned long copy_in_user(void __user *
2441         return n;
2442  }
2443
2444 -EXPORT_SYMBOL(copy_from_user);
2445 -EXPORT_SYMBOL(copy_to_user);
2446  EXPORT_SYMBOL(copy_in_user);
2447
2448 diff -urNp linux-2.6.33/arch/powerpc/mm/fault.c linux-2.6.33/arch/powerpc/mm/fault.c
2449 --- linux-2.6.33/arch/powerpc/mm/fault.c        2010-02-24 13:52:17.000000000 -0500
2450 +++ linux-2.6.33/arch/powerpc/mm/fault.c        2010-03-07 12:23:35.903199907 -0500
2451 @@ -30,6 +30,10 @@
2452  #include <linux/kprobes.h>
2453  #include <linux/kdebug.h>
2454  #include <linux/perf_event.h>
2455 +#include <linux/slab.h>
2456 +#include <linux/pagemap.h>
2457 +#include <linux/compiler.h>
2458 +#include <linux/unistd.h>
2459
2460  #include <asm/firmware.h>
2461  #include <asm/page.h>
2462 @@ -41,6 +45,7 @@
2463  #include <asm/tlbflush.h>
2464  #include <asm/siginfo.h>
2465  #include <mm/mmu_decl.h>
2466 +#include <asm/ptrace.h>
2467
2468  #ifdef CONFIG_KPROBES
2469  static inline int notify_page_fault(struct pt_regs *regs)
2470 @@ -64,6 +69,33 @@ static inline int notify_page_fault(stru
2471  }
2472  #endif
2473
2474 +#ifdef CONFIG_PAX_PAGEEXEC
2475 +/*
2476 + * PaX: decide what to do with offenders (regs->nip = fault address)
2477 + *
2478 + * returns 1 when task should be killed
2479 + */
2480 +static int pax_handle_fetch_fault(struct pt_regs *regs)
2481 +{
2482 +       return 1;
2483 +}
2484 +
2485 +void pax_report_insns(void *pc, void *sp)
2486 +{
2487 +       unsigned long i;
2488 +
2489 +       printk(KERN_ERR "PAX: bytes at PC: ");
2490 +       for (i = 0; i < 5; i++) {
2491 +               unsigned int c;
2492 +               if (get_user(c, (unsigned int __user *)pc+i))
2493 +                       printk(KERN_CONT "???????? ");
2494 +               else
2495 +                       printk(KERN_CONT "%08x ", c);
2496 +       }
2497 +       printk("\n");
2498 +}
2499 +#endif
2500 +
2501  /*
2502   * Check whether the instruction at regs->nip is a store using
2503   * an update addressing form which will update r1.
2504 @@ -134,7 +166,7 @@ int __kprobes do_page_fault(struct pt_re
2505          * indicate errors in DSISR but can validly be set in SRR1.
2506          */
2507         if (trap == 0x400)
2508 -               error_code &= 0x48200000;
2509 +               error_code &= 0x58200000;
2510         else
2511                 is_write = error_code & DSISR_ISSTORE;
2512  #else
2513 @@ -256,7 +288,7 @@ good_area:
2514           * "undefined".  Of those that can be set, this is the only
2515           * one which seems bad.
2516           */
2517 -       if (error_code & 0x10000000)
2518 +       if (error_code & DSISR_GUARDED)
2519                  /* Guarded storage error. */
2520                 goto bad_area;
2521  #endif /* CONFIG_8xx */
2522 @@ -271,7 +303,7 @@ good_area:
2523                  * processors use the same I/D cache coherency mechanism
2524                  * as embedded.
2525                  */
2526 -               if (error_code & DSISR_PROTFAULT)
2527 +               if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
2528                         goto bad_area;
2529  #endif /* CONFIG_PPC_STD_MMU */
2530
2531 @@ -341,6 +373,23 @@ bad_area:
2532  bad_area_nosemaphore:
2533         /* User mode accesses cause a SIGSEGV */
2534         if (user_mode(regs)) {
2535 +
2536 +#ifdef CONFIG_PAX_PAGEEXEC
2537 +               if (mm->pax_flags & MF_PAX_PAGEEXEC) {
2538 +#ifdef CONFIG_PPC_STD_MMU
2539 +                       if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
2540 +#else
2541 +                       if (is_exec && regs->nip == address) {
2542 +#endif
2543 +                               switch (pax_handle_fetch_fault(regs)) {
2544 +                               }
2545 +
2546 +                               pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
2547 +                               do_group_exit(SIGKILL);
2548 +                       }
2549 +               }
2550 +#endif
2551 +
2552                 _exception(SIGSEGV, regs, code, address);
2553                 return 0;
2554         }
2555 diff -urNp linux-2.6.33/arch/powerpc/mm/mmap_64.c linux-2.6.33/arch/powerpc/mm/mmap_64.c
2556 --- linux-2.6.33/arch/powerpc/mm/mmap_64.c      2010-02-24 13:52:17.000000000 -0500
2557 +++ linux-2.6.33/arch/powerpc/mm/mmap_64.c      2010-03-07 12:23:35.903199907 -0500
2558 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
2559          */
2560         if (mmap_is_legacy()) {
2561                 mm->mmap_base = TASK_UNMAPPED_BASE;
2562 +
2563 +#ifdef CONFIG_PAX_RANDMMAP
2564 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2565 +                       mm->mmap_base += mm->delta_mmap;
2566 +#endif
2567 +
2568                 mm->get_unmapped_area = arch_get_unmapped_area;
2569                 mm->unmap_area = arch_unmap_area;
2570         } else {
2571                 mm->mmap_base = mmap_base();
2572 +
2573 +#ifdef CONFIG_PAX_RANDMMAP
2574 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2575 +                       mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2576 +#endif
2577 +
2578                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2579                 mm->unmap_area = arch_unmap_area_topdown;
2580         }
2581 diff -urNp linux-2.6.33/arch/powerpc/mm/slice.c linux-2.6.33/arch/powerpc/mm/slice.c
2582 --- linux-2.6.33/arch/powerpc/mm/slice.c        2010-02-24 13:52:17.000000000 -0500
2583 +++ linux-2.6.33/arch/powerpc/mm/slice.c        2010-03-07 12:23:35.903199907 -0500
2584 @@ -426,6 +426,11 @@ unsigned long slice_get_unmapped_area(un
2585         if (fixed && addr > (mm->task_size - len))
2586                 return -EINVAL;
2587
2588 +#ifdef CONFIG_PAX_RANDMMAP
2589 +       if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
2590 +               addr = 0;
2591 +#endif
2592 +
2593         /* If hint, make sure it matches our alignment restrictions */
2594         if (!fixed && addr) {
2595                 addr = _ALIGN_UP(addr, 1ul << pshift);
2596 diff -urNp linux-2.6.33/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.33/arch/powerpc/platforms/52xx/lite5200_pm.c
2597 --- linux-2.6.33/arch/powerpc/platforms/52xx/lite5200_pm.c      2010-02-24 13:52:17.000000000 -0500
2598 +++ linux-2.6.33/arch/powerpc/platforms/52xx/lite5200_pm.c      2010-03-07 12:23:35.903199907 -0500
2599 @@ -235,7 +235,7 @@ static void lite5200_pm_end(void)
2600         lite5200_pm_target_state = PM_SUSPEND_ON;
2601  }
2602
2603 -static struct platform_suspend_ops lite5200_pm_ops = {
2604 +static const struct platform_suspend_ops lite5200_pm_ops = {
2605         .valid          = lite5200_pm_valid,
2606         .begin          = lite5200_pm_begin,
2607         .prepare        = lite5200_pm_prepare,
2608 diff -urNp linux-2.6.33/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.33/arch/powerpc/platforms/52xx/mpc52xx_pm.c
2609 --- linux-2.6.33/arch/powerpc/platforms/52xx/mpc52xx_pm.c       2010-02-24 13:52:17.000000000 -0500
2610 +++ linux-2.6.33/arch/powerpc/platforms/52xx/mpc52xx_pm.c       2010-03-07 12:23:35.903199907 -0500
2611 @@ -180,7 +180,7 @@ void mpc52xx_pm_finish(void)
2612         iounmap(mbar);
2613  }
2614
2615 -static struct platform_suspend_ops mpc52xx_pm_ops = {
2616 +static const struct platform_suspend_ops mpc52xx_pm_ops = {
2617         .valid          = mpc52xx_pm_valid,
2618         .prepare        = mpc52xx_pm_prepare,
2619         .enter          = mpc52xx_pm_enter,
2620 diff -urNp linux-2.6.33/arch/powerpc/platforms/83xx/suspend.c linux-2.6.33/arch/powerpc/platforms/83xx/suspend.c
2621 --- linux-2.6.33/arch/powerpc/platforms/83xx/suspend.c  2010-02-24 13:52:17.000000000 -0500
2622 +++ linux-2.6.33/arch/powerpc/platforms/83xx/suspend.c  2010-03-07 12:23:35.907205393 -0500
2623 @@ -311,7 +311,7 @@ static int mpc83xx_is_pci_agent(void)
2624         return ret;
2625  }
2626
2627 -static struct platform_suspend_ops mpc83xx_suspend_ops = {
2628 +static const struct platform_suspend_ops mpc83xx_suspend_ops = {
2629         .valid = mpc83xx_suspend_valid,
2630         .begin = mpc83xx_suspend_begin,
2631         .enter = mpc83xx_suspend_enter,
2632 diff -urNp linux-2.6.33/arch/powerpc/platforms/cell/iommu.c linux-2.6.33/arch/powerpc/platforms/cell/iommu.c
2633 --- linux-2.6.33/arch/powerpc/platforms/cell/iommu.c    2010-02-24 13:52:17.000000000 -0500
2634 +++ linux-2.6.33/arch/powerpc/platforms/cell/iommu.c    2010-03-07 12:23:35.907205393 -0500
2635 @@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
2636
2637  static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
2638
2639 -struct dma_map_ops dma_iommu_fixed_ops = {
2640 +const struct dma_map_ops dma_iommu_fixed_ops = {
2641         .alloc_coherent = dma_fixed_alloc_coherent,
2642         .free_coherent  = dma_fixed_free_coherent,
2643         .map_sg         = dma_fixed_map_sg,
2644 diff -urNp linux-2.6.33/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.33/arch/powerpc/platforms/ps3/system-bus.c
2645 --- linux-2.6.33/arch/powerpc/platforms/ps3/system-bus.c        2010-02-24 13:52:17.000000000 -0500
2646 +++ linux-2.6.33/arch/powerpc/platforms/ps3/system-bus.c        2010-03-07 12:23:35.907205393 -0500
2647 @@ -694,7 +694,7 @@ static int ps3_dma_supported(struct devi
2648         return mask >= DMA_BIT_MASK(32);
2649  }
2650
2651 -static struct dma_map_ops ps3_sb_dma_ops = {
2652 +static const struct dma_map_ops ps3_sb_dma_ops = {
2653         .alloc_coherent = ps3_alloc_coherent,
2654         .free_coherent = ps3_free_coherent,
2655         .map_sg = ps3_sb_map_sg,
2656 @@ -704,7 +704,7 @@ static struct dma_map_ops ps3_sb_dma_ops
2657         .unmap_page = ps3_unmap_page,
2658  };
2659
2660 -static struct dma_map_ops ps3_ioc0_dma_ops = {
2661 +static const struct dma_map_ops ps3_ioc0_dma_ops = {
2662         .alloc_coherent = ps3_alloc_coherent,
2663         .free_coherent = ps3_free_coherent,
2664         .map_sg = ps3_ioc0_map_sg,
2665 diff -urNp linux-2.6.33/arch/powerpc/sysdev/fsl_pmc.c linux-2.6.33/arch/powerpc/sysdev/fsl_pmc.c
2666 --- linux-2.6.33/arch/powerpc/sysdev/fsl_pmc.c  2010-02-24 13:52:17.000000000 -0500
2667 +++ linux-2.6.33/arch/powerpc/sysdev/fsl_pmc.c  2010-03-07 12:23:35.907205393 -0500
2668 @@ -53,7 +53,7 @@ static int pmc_suspend_valid(suspend_sta
2669         return 1;
2670  }
2671
2672 -static struct platform_suspend_ops pmc_suspend_ops = {
2673 +static const struct platform_suspend_ops pmc_suspend_ops = {
2674         .valid = pmc_suspend_valid,
2675         .enter = pmc_suspend_enter,
2676  };
2677 diff -urNp linux-2.6.33/arch/s390/include/asm/elf.h linux-2.6.33/arch/s390/include/asm/elf.h
2678 --- linux-2.6.33/arch/s390/include/asm/elf.h    2010-02-24 13:52:17.000000000 -0500
2679 +++ linux-2.6.33/arch/s390/include/asm/elf.h    2010-03-07 12:23:35.907205393 -0500
2680 @@ -163,6 +163,13 @@ extern unsigned int vdso_enabled;
2681     that it will "exec", and that there is sufficient room for the brk.  */
2682  #define ELF_ET_DYN_BASE                (STACK_TOP / 3 * 2)
2683
2684 +#ifdef CONFIG_PAX_ASLR
2685 +#define PAX_ELF_ET_DYN_BASE    (test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
2686 +
2687 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2688 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_31BIT) ? 15 : 26 )
2689 +#endif
2690 +
2691  /* This yields a mask that user programs can use to figure out what
2692     instruction set this CPU supports. */
2693
2694 diff -urNp linux-2.6.33/arch/s390/include/asm/uaccess.h linux-2.6.33/arch/s390/include/asm/uaccess.h
2695 --- linux-2.6.33/arch/s390/include/asm/uaccess.h        2010-02-24 13:52:17.000000000 -0500
2696 +++ linux-2.6.33/arch/s390/include/asm/uaccess.h        2010-03-07 12:23:35.907205393 -0500
2697 @@ -234,6 +234,10 @@ static inline unsigned long __must_check
2698  copy_to_user(void __user *to, const void *from, unsigned long n)
2699  {
2700         might_fault();
2701 +
2702 +       if ((long)n < 0)
2703 +               return n;
2704 +
2705         if (access_ok(VERIFY_WRITE, to, n))
2706                 n = __copy_to_user(to, from, n);
2707         return n;
2708 @@ -259,6 +263,9 @@ copy_to_user(void __user *to, const void
2709  static inline unsigned long __must_check
2710  __copy_from_user(void *to, const void __user *from, unsigned long n)
2711  {
2712 +       if ((long)n < 0)
2713 +               return n;
2714 +
2715         if (__builtin_constant_p(n) && (n <= 256))
2716                 return uaccess.copy_from_user_small(n, from, to);
2717         else
2718 @@ -285,6 +292,10 @@ static inline unsigned long __must_check
2719  copy_from_user(void *to, const void __user *from, unsigned long n)
2720  {
2721         might_fault();
2722 +
2723 +       if ((long)n < 0)
2724 +               return n;
2725 +
2726         if (access_ok(VERIFY_READ, from, n))
2727                 n = __copy_from_user(to, from, n);
2728         else
2729 diff -urNp linux-2.6.33/arch/s390/Kconfig linux-2.6.33/arch/s390/Kconfig
2730 --- linux-2.6.33/arch/s390/Kconfig      2010-02-24 13:52:17.000000000 -0500
2731 +++ linux-2.6.33/arch/s390/Kconfig      2010-03-07 12:23:35.907205393 -0500
2732 @@ -222,13 +222,12 @@ config AUDIT_ARCH
2733
2734  config S390_EXEC_PROTECT
2735         bool "Data execute protection"
2736 +       default y
2737         help
2738           This option allows to enable a buffer overflow protection for user
2739 -         space programs and it also selects the addressing mode option above.
2740 -         The kernel parameter noexec=on will enable this feature and also
2741 -         switch the addressing modes, default is disabled. Enabling this (via
2742 -         kernel parameter) on machines earlier than IBM System z9-109 EC/BC
2743 -         will reduce system performance.
2744 +         space programs.
2745 +         Enabling this on machines earlier than IBM System z9-109 EC/BC will
2746 +         reduce system performance.
2747
2748  comment "Code generation options"
2749
2750 diff -urNp linux-2.6.33/arch/s390/kernel/module.c linux-2.6.33/arch/s390/kernel/module.c
2751 --- linux-2.6.33/arch/s390/kernel/module.c      2010-02-24 13:52:17.000000000 -0500
2752 +++ linux-2.6.33/arch/s390/kernel/module.c      2010-03-07 12:23:35.907205393 -0500
2753 @@ -166,11 +166,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
2754
2755         /* Increase core size by size of got & plt and set start
2756            offsets for got and plt. */
2757 -       me->core_size = ALIGN(me->core_size, 4);
2758 -       me->arch.got_offset = me->core_size;
2759 -       me->core_size += me->arch.got_size;
2760 -       me->arch.plt_offset = me->core_size;
2761 -       me->core_size += me->arch.plt_size;
2762 +       me->core_size_rw = ALIGN(me->core_size_rw, 4);
2763 +       me->arch.got_offset = me->core_size_rw;
2764 +       me->core_size_rw += me->arch.got_size;
2765 +       me->arch.plt_offset = me->core_size_rx;
2766 +       me->core_size_rx += me->arch.plt_size;
2767         return 0;
2768  }
2769
2770 @@ -256,7 +256,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2771                 if (info->got_initialized == 0) {
2772                         Elf_Addr *gotent;
2773
2774 -                       gotent = me->module_core + me->arch.got_offset +
2775 +                       gotent = me->module_core_rw + me->arch.got_offset +
2776                                 info->got_offset;
2777                         *gotent = val;
2778                         info->got_initialized = 1;
2779 @@ -280,7 +280,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2780                 else if (r_type == R_390_GOTENT ||
2781                          r_type == R_390_GOTPLTENT)
2782                         *(unsigned int *) loc =
2783 -                               (val + (Elf_Addr) me->module_core - loc) >> 1;
2784 +                               (val + (Elf_Addr) me->module_core_rw - loc) >> 1;
2785                 else if (r_type == R_390_GOT64 ||
2786                          r_type == R_390_GOTPLT64)
2787                         *(unsigned long *) loc = val;
2788 @@ -294,7 +294,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2789         case R_390_PLTOFF64:    /* 16 bit offset from GOT to PLT. */
2790                 if (info->plt_initialized == 0) {
2791                         unsigned int *ip;
2792 -                       ip = me->module_core + me->arch.plt_offset +
2793 +                       ip = me->module_core_rx + me->arch.plt_offset +
2794                                 info->plt_offset;
2795  #ifndef CONFIG_64BIT
2796                         ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
2797 @@ -319,7 +319,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2798                                val - loc + 0xffffUL < 0x1ffffeUL) ||
2799                               (r_type == R_390_PLT32DBL &&
2800                                val - loc + 0xffffffffULL < 0x1fffffffeULL)))
2801 -                               val = (Elf_Addr) me->module_core +
2802 +                               val = (Elf_Addr) me->module_core_rx +
2803                                         me->arch.plt_offset +
2804                                         info->plt_offset;
2805                         val += rela->r_addend - loc;
2806 @@ -341,7 +341,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2807         case R_390_GOTOFF32:    /* 32 bit offset to GOT.  */
2808         case R_390_GOTOFF64:    /* 64 bit offset to GOT. */
2809                 val = val + rela->r_addend -
2810 -                       ((Elf_Addr) me->module_core + me->arch.got_offset);
2811 +                       ((Elf_Addr) me->module_core_rw + me->arch.got_offset);
2812                 if (r_type == R_390_GOTOFF16)
2813                         *(unsigned short *) loc = val;
2814                 else if (r_type == R_390_GOTOFF32)
2815 @@ -351,7 +351,7 @@ apply_rela(Elf_Rela *rela, Elf_Addr base
2816                 break;
2817         case R_390_GOTPC:       /* 32 bit PC relative offset to GOT. */
2818         case R_390_GOTPCDBL:    /* 32 bit PC rel. off. to GOT shifted by 1. */
2819 -               val = (Elf_Addr) me->module_core + me->arch.got_offset +
2820 +               val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
2821                         rela->r_addend - loc;
2822                 if (r_type == R_390_GOTPC)
2823                         *(unsigned int *) loc = val;
2824 diff -urNp linux-2.6.33/arch/s390/kernel/setup.c linux-2.6.33/arch/s390/kernel/setup.c
2825 --- linux-2.6.33/arch/s390/kernel/setup.c       2010-02-24 13:52:17.000000000 -0500
2826 +++ linux-2.6.33/arch/s390/kernel/setup.c       2010-03-07 12:23:35.907205393 -0500
2827 @@ -298,7 +298,7 @@ static int __init early_parse_mem(char *
2828  }
2829  early_param("mem", early_parse_mem);
2830
2831 -unsigned int user_mode = HOME_SPACE_MODE;
2832 +unsigned int user_mode = SECONDARY_SPACE_MODE;
2833  EXPORT_SYMBOL_GPL(user_mode);
2834
2835  static int set_amode_and_uaccess(unsigned long user_amode,
2836 @@ -327,17 +327,6 @@ static int set_amode_and_uaccess(unsigne
2837         }
2838  }
2839
2840 -/*
2841 - * Switch kernel/user addressing modes?
2842 - */
2843 -static int __init early_parse_switch_amode(char *p)
2844 -{
2845 -       if (user_mode != SECONDARY_SPACE_MODE)
2846 -               user_mode = PRIMARY_SPACE_MODE;
2847 -       return 0;
2848 -}
2849 -early_param("switch_amode", early_parse_switch_amode);
2850 -
2851  static int __init early_parse_user_mode(char *p)
2852  {
2853         if (p && strcmp(p, "primary") == 0)
2854 @@ -354,20 +343,6 @@ static int __init early_parse_user_mode(
2855  }
2856  early_param("user_mode", early_parse_user_mode);
2857
2858 -#ifdef CONFIG_S390_EXEC_PROTECT
2859 -/*
2860 - * Enable execute protection?
2861 - */
2862 -static int __init early_parse_noexec(char *p)
2863 -{
2864 -       if (!strncmp(p, "off", 3))
2865 -               return 0;
2866 -       user_mode = SECONDARY_SPACE_MODE;
2867 -       return 0;
2868 -}
2869 -early_param("noexec", early_parse_noexec);
2870 -#endif /* CONFIG_S390_EXEC_PROTECT */
2871 -
2872  static void setup_addressing_mode(void)
2873  {
2874         if (user_mode == SECONDARY_SPACE_MODE) {
2875 diff -urNp linux-2.6.33/arch/s390/mm/maccess.c linux-2.6.33/arch/s390/mm/maccess.c
2876 --- linux-2.6.33/arch/s390/mm/maccess.c 2010-02-24 13:52:17.000000000 -0500
2877 +++ linux-2.6.33/arch/s390/mm/maccess.c 2010-03-07 12:23:35.907205393 -0500
2878 @@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void
2879         return rc ? rc : count;
2880  }
2881
2882 -long probe_kernel_write(void *dst, void *src, size_t size)
2883 +long probe_kernel_write(void *dst, const void *src, size_t size)
2884  {
2885         long copied = 0;
2886
2887 diff -urNp linux-2.6.33/arch/s390/mm/mmap.c linux-2.6.33/arch/s390/mm/mmap.c
2888 --- linux-2.6.33/arch/s390/mm/mmap.c    2010-02-24 13:52:17.000000000 -0500
2889 +++ linux-2.6.33/arch/s390/mm/mmap.c    2010-03-07 12:23:35.907205393 -0500
2890 @@ -78,10 +78,22 @@ void arch_pick_mmap_layout(struct mm_str
2891          */
2892         if (mmap_is_legacy()) {
2893                 mm->mmap_base = TASK_UNMAPPED_BASE;
2894 +
2895 +#ifdef CONFIG_PAX_RANDMMAP
2896 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2897 +                       mm->mmap_base += mm->delta_mmap;
2898 +#endif
2899 +
2900                 mm->get_unmapped_area = arch_get_unmapped_area;
2901                 mm->unmap_area = arch_unmap_area;
2902         } else {
2903                 mm->mmap_base = mmap_base();
2904 +
2905 +#ifdef CONFIG_PAX_RANDMMAP
2906 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2907 +                       mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2908 +#endif
2909 +
2910                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
2911                 mm->unmap_area = arch_unmap_area_topdown;
2912         }
2913 @@ -153,10 +165,22 @@ void arch_pick_mmap_layout(struct mm_str
2914          */
2915         if (mmap_is_legacy()) {
2916                 mm->mmap_base = TASK_UNMAPPED_BASE;
2917 +
2918 +#ifdef CONFIG_PAX_RANDMMAP
2919 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2920 +                       mm->mmap_base += mm->delta_mmap;
2921 +#endif
2922 +
2923                 mm->get_unmapped_area = s390_get_unmapped_area;
2924                 mm->unmap_area = arch_unmap_area;
2925         } else {
2926                 mm->mmap_base = mmap_base();
2927 +
2928 +#ifdef CONFIG_PAX_RANDMMAP
2929 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
2930 +                       mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
2931 +#endif
2932 +
2933                 mm->get_unmapped_area = s390_get_unmapped_area_topdown;
2934                 mm->unmap_area = arch_unmap_area_topdown;
2935         }
2936 diff -urNp linux-2.6.33/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.33/arch/sh/boards/mach-hp6xx/pm.c
2937 --- linux-2.6.33/arch/sh/boards/mach-hp6xx/pm.c 2010-02-24 13:52:17.000000000 -0500
2938 +++ linux-2.6.33/arch/sh/boards/mach-hp6xx/pm.c 2010-03-07 12:23:35.907205393 -0500
2939 @@ -143,7 +143,7 @@ static int hp6x0_pm_enter(suspend_state_
2940         return 0;
2941  }
2942
2943 -static struct platform_suspend_ops hp6x0_pm_ops = {
2944 +static const struct platform_suspend_ops hp6x0_pm_ops = {
2945         .enter          = hp6x0_pm_enter,
2946         .valid          = suspend_valid_only_mem,
2947  };
2948 diff -urNp linux-2.6.33/arch/sh/include/asm/dma-mapping.h linux-2.6.33/arch/sh/include/asm/dma-mapping.h
2949 --- linux-2.6.33/arch/sh/include/asm/dma-mapping.h      2010-02-24 13:52:17.000000000 -0500
2950 +++ linux-2.6.33/arch/sh/include/asm/dma-mapping.h      2010-03-07 12:23:35.907205393 -0500
2951 @@ -1,10 +1,10 @@
2952  #ifndef __ASM_SH_DMA_MAPPING_H
2953  #define __ASM_SH_DMA_MAPPING_H
2954
2955 -extern struct dma_map_ops *dma_ops;
2956 +extern const struct dma_map_ops *dma_ops;
2957  extern void no_iommu_init(void);
2958
2959 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
2960 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
2961  {
2962         return dma_ops;
2963  }
2964 @@ -14,7 +14,7 @@ static inline struct dma_map_ops *get_dm
2965
2966  static inline int dma_supported(struct device *dev, u64 mask)
2967  {
2968 -       struct dma_map_ops *ops = get_dma_ops(dev);
2969 +       const struct dma_map_ops *ops = get_dma_ops(dev);
2970
2971         if (ops->dma_supported)
2972                 return ops->dma_supported(dev, mask);
2973 @@ -24,7 +24,7 @@ static inline int dma_supported(struct d
2974
2975  static inline int dma_set_mask(struct device *dev, u64 mask)
2976  {
2977 -       struct dma_map_ops *ops = get_dma_ops(dev);
2978 +       const struct dma_map_ops *ops = get_dma_ops(dev);
2979
2980         if (!dev->dma_mask || !dma_supported(dev, mask))
2981                 return -EIO;
2982 @@ -59,7 +59,7 @@ static inline int dma_get_cache_alignmen
2983
2984  static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
2985  {
2986 -       struct dma_map_ops *ops = get_dma_ops(dev);
2987 +       const struct dma_map_ops *ops = get_dma_ops(dev);
2988
2989         if (ops->mapping_error)
2990                 return ops->mapping_error(dev, dma_addr);
2991 @@ -70,7 +70,7 @@ static inline int dma_mapping_error(stru
2992  static inline void *dma_alloc_coherent(struct device *dev, size_t size,
2993                                        dma_addr_t *dma_handle, gfp_t gfp)
2994  {
2995 -       struct dma_map_ops *ops = get_dma_ops(dev);
2996 +       const struct dma_map_ops *ops = get_dma_ops(dev);
2997         void *memory;
2998
2999         if (dma_alloc_from_coherent(dev, size, dma_handle, &memory))
3000 @@ -87,7 +87,7 @@ static inline void *dma_alloc_coherent(s
3001  static inline void dma_free_coherent(struct device *dev, size_t size,
3002                                      void *vaddr, dma_addr_t dma_handle)
3003  {
3004 -       struct dma_map_ops *ops = get_dma_ops(dev);
3005 +       const struct dma_map_ops *ops = get_dma_ops(dev);
3006
3007         WARN_ON(irqs_disabled());       /* for portability */
3008
3009 diff -urNp linux-2.6.33/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.33/arch/sh/kernel/cpu/sh4/sq.c
3010 --- linux-2.6.33/arch/sh/kernel/cpu/sh4/sq.c    2010-02-24 13:52:17.000000000 -0500
3011 +++ linux-2.6.33/arch/sh/kernel/cpu/sh4/sq.c    2010-03-07 12:23:35.909670807 -0500
3012 @@ -327,7 +327,7 @@ static struct attribute *sq_sysfs_attrs[
3013         NULL,
3014  };
3015
3016 -static struct sysfs_ops sq_sysfs_ops = {
3017 +static const struct sysfs_ops sq_sysfs_ops = {
3018         .show   = sq_sysfs_show,
3019         .store  = sq_sysfs_store,
3020  };
3021 diff -urNp linux-2.6.33/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.33/arch/sh/kernel/cpu/shmobile/pm.c
3022 --- linux-2.6.33/arch/sh/kernel/cpu/shmobile/pm.c       2010-02-24 13:52:17.000000000 -0500
3023 +++ linux-2.6.33/arch/sh/kernel/cpu/shmobile/pm.c       2010-03-07 12:23:35.909670807 -0500
3024 @@ -140,7 +140,7 @@ static int sh_pm_enter(suspend_state_t s
3025         return 0;
3026  }
3027
3028 -static struct platform_suspend_ops sh_pm_ops = {
3029 +static const struct platform_suspend_ops sh_pm_ops = {
3030         .enter          = sh_pm_enter,
3031         .valid          = suspend_valid_only_mem,
3032  };
3033 diff -urNp linux-2.6.33/arch/sh/kernel/dma-nommu.c linux-2.6.33/arch/sh/kernel/dma-nommu.c
3034 --- linux-2.6.33/arch/sh/kernel/dma-nommu.c     2010-02-24 13:52:17.000000000 -0500
3035 +++ linux-2.6.33/arch/sh/kernel/dma-nommu.c     2010-03-07 12:23:35.909670807 -0500
3036 @@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device
3037  }
3038  #endif
3039
3040 -struct dma_map_ops nommu_dma_ops = {
3041 +const struct dma_map_ops nommu_dma_ops = {
3042         .alloc_coherent         = dma_generic_alloc_coherent,
3043         .free_coherent          = dma_generic_free_coherent,
3044         .map_page               = nommu_map_page,
3045 diff -urNp linux-2.6.33/arch/sh/kernel/kgdb.c linux-2.6.33/arch/sh/kernel/kgdb.c
3046 --- linux-2.6.33/arch/sh/kernel/kgdb.c  2010-02-24 13:52:17.000000000 -0500
3047 +++ linux-2.6.33/arch/sh/kernel/kgdb.c  2010-03-07 12:23:35.909670807 -0500
3048 @@ -271,7 +271,7 @@ void kgdb_arch_exit(void)
3049  {
3050  }
3051
3052 -struct kgdb_arch arch_kgdb_ops = {
3053 +const struct kgdb_arch arch_kgdb_ops = {
3054         /* Breakpoint instruction: trapa #0x3c */
3055  #ifdef CONFIG_CPU_LITTLE_ENDIAN
3056         .gdb_bpt_instr          = { 0x3c, 0xc3 },
3057 diff -urNp linux-2.6.33/arch/sh/mm/consistent.c linux-2.6.33/arch/sh/mm/consistent.c
3058 --- linux-2.6.33/arch/sh/mm/consistent.c        2010-02-24 13:52:17.000000000 -0500
3059 +++ linux-2.6.33/arch/sh/mm/consistent.c        2010-03-07 12:23:35.909670807 -0500
3060 @@ -21,7 +21,7 @@
3061
3062  #define PREALLOC_DMA_DEBUG_ENTRIES     4096
3063
3064 -struct dma_map_ops *dma_ops;
3065 +const struct dma_map_ops *dma_ops;
3066  EXPORT_SYMBOL(dma_ops);
3067
3068  static int __init dma_init(void)
3069 diff -urNp linux-2.6.33/arch/sparc/include/asm/atomic_64.h linux-2.6.33/arch/sparc/include/asm/atomic_64.h
3070 --- linux-2.6.33/arch/sparc/include/asm/atomic_64.h     2010-02-24 13:52:17.000000000 -0500
3071 +++ linux-2.6.33/arch/sparc/include/asm/atomic_64.h     2010-03-07 12:23:35.909670807 -0500
3072 @@ -14,18 +14,38 @@
3073  #define ATOMIC64_INIT(i)       { (i) }
3074
3075  #define atomic_read(v)         ((v)->counter)
3076 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
3077 +{
3078 +       return v->counter;
3079 +}
3080  #define atomic64_read(v)       ((v)->counter)
3081 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
3082 +{
3083 +       return v->counter;
3084 +}
3085
3086  #define atomic_set(v, i)       (((v)->counter) = i)
3087 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
3088 +{
3089 +       v->counter = i;
3090 +}
3091  #define atomic64_set(v, i)     (((v)->counter) = i)
3092 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
3093 +{
3094 +       v->counter = i;
3095 +}
3096
3097  extern void atomic_add(int, atomic_t *);
3098 +extern void atomic_add_unchecked(int, atomic_unchecked_t *);
3099  extern void atomic64_add(int, atomic64_t *);
3100 +extern void atomic64_add_unchecked(int, atomic64_unchecked_t *);
3101  extern void atomic_sub(int, atomic_t *);
3102 +extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
3103  extern void atomic64_sub(int, atomic64_t *);
3104
3105  extern int atomic_add_ret(int, atomic_t *);
3106  extern int atomic64_add_ret(int, atomic64_t *);
3107 +extern int atomic64_add_ret_unchecked(int, atomic64_unchecked_t *);
3108  extern int atomic_sub_ret(int, atomic_t *);
3109  extern int atomic64_sub_ret(int, atomic64_t *);
3110
3111 @@ -34,6 +54,7 @@ extern int atomic64_sub_ret(int, atomic6
3112
3113  #define atomic_inc_return(v) atomic_add_ret(1, v)
3114  #define atomic64_inc_return(v) atomic64_add_ret(1, v)
3115 +#define atomic64_inc_return_unchecked(v) atomic64_add_ret_unchecked(1, v)
3116
3117  #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
3118  #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
3119 @@ -59,7 +80,15 @@ extern int atomic64_sub_ret(int, atomic6
3120  #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
3121
3122  #define atomic_inc(v) atomic_add(1, v)
3123 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
3124 +{
3125 +       atomic_add_unchecked(1, v);
3126 +}
3127  #define atomic64_inc(v) atomic64_add(1, v)
3128 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
3129 +{
3130 +       atomic64_add_unchecked(1, v);
3131 +}
3132
3133  #define atomic_dec(v) atomic_sub(1, v)
3134  #define atomic64_dec(v) atomic64_sub(1, v)
3135 @@ -72,17 +101,28 @@ extern int atomic64_sub_ret(int, atomic6
3136
3137  static inline int atomic_add_unless(atomic_t *v, int a, int u)
3138  {
3139 -       int c, old;
3140 +       int c, old, new;
3141         c = atomic_read(v);
3142         for (;;) {
3143 -               if (unlikely(c == (u)))
3144 +               if (unlikely(c == u))
3145                         break;
3146 -               old = atomic_cmpxchg((v), c, c + (a));
3147 +
3148 +               asm volatile("addcc %2, %0, %0\n"
3149 +
3150 +#ifdef CONFIG_PAX_REFCOUNT
3151 +                            "tvs %%icc, 6\n"
3152 +#endif
3153 +
3154 +                            : "=r" (new)
3155 +                            : "0" (c), "ir" (a)
3156 +                            : "cc");
3157 +
3158 +               old = atomic_cmpxchg(v, c, new);
3159                 if (likely(old == c))
3160                         break;
3161                 c = old;
3162         }
3163 -       return c != (u);
3164 +       return c != u;
3165  }
3166
3167  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
3168 @@ -93,17 +133,28 @@ static inline int atomic_add_unless(atom
3169
3170  static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
3171  {
3172 -       long c, old;
3173 +       long c, old, new;
3174         c = atomic64_read(v);
3175         for (;;) {
3176 -               if (unlikely(c == (u)))
3177 +               if (unlikely(c == u))
3178                         break;
3179 -               old = atomic64_cmpxchg((v), c, c + (a));
3180 +
3181 +               asm volatile("addcc %2, %0, %0\n"
3182 +
3183 +#ifdef CONFIG_PAX_REFCOUNT
3184 +                            "tvs %%xcc, 6\n"
3185 +#endif
3186 +
3187 +                            : "=r" (new)
3188 +                            : "0" (c), "ir" (a)
3189 +                            : "cc");
3190 +
3191 +               old = atomic64_cmpxchg(v, c, new);
3192                 if (likely(old == c))
3193                         break;
3194                 c = old;
3195         }
3196 -       return c != (u);
3197 +       return c != u;
3198  }
3199
3200  #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
3201 diff -urNp linux-2.6.33/arch/sparc/include/asm/dma-mapping.h linux-2.6.33/arch/sparc/include/asm/dma-mapping.h
3202 --- linux-2.6.33/arch/sparc/include/asm/dma-mapping.h   2010-02-24 13:52:17.000000000 -0500
3203 +++ linux-2.6.33/arch/sparc/include/asm/dma-mapping.h   2010-03-07 12:23:35.909670807 -0500
3204 @@ -14,10 +14,10 @@ extern int dma_set_mask(struct device *d
3205  #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
3206  #define dma_is_consistent(d, h)        (1)
3207
3208 -extern struct dma_map_ops *dma_ops, pci32_dma_ops;
3209 +extern struct const dma_map_ops *dma_ops, pci32_dma_ops;
3210  extern struct bus_type pci_bus_type;
3211
3212 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
3213 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
3214  {
3215  #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
3216         if (dev->bus == &pci_bus_type)
3217 @@ -31,7 +31,7 @@ static inline struct dma_map_ops *get_dm
3218  static inline void *dma_alloc_coherent(struct device *dev, size_t size,
3219                                        dma_addr_t *dma_handle, gfp_t flag)
3220  {
3221 -       struct dma_map_ops *ops = get_dma_ops(dev);
3222 +       const struct dma_map_ops *ops = get_dma_ops(dev);
3223         void *cpu_addr;
3224
3225         cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
3226 @@ -42,7 +42,7 @@ static inline void *dma_alloc_coherent(s
3227  static inline void dma_free_coherent(struct device *dev, size_t size,
3228                                      void *cpu_addr, dma_addr_t dma_handle)
3229  {
3230 -       struct dma_map_ops *ops = get_dma_ops(dev);
3231 +       const struct dma_map_ops *ops = get_dma_ops(dev);
3232
3233         debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
3234         ops->free_coherent(dev, size, cpu_addr, dma_handle);
3235 diff -urNp linux-2.6.33/arch/sparc/include/asm/elf_32.h linux-2.6.33/arch/sparc/include/asm/elf_32.h
3236 --- linux-2.6.33/arch/sparc/include/asm/elf_32.h        2010-02-24 13:52:17.000000000 -0500
3237 +++ linux-2.6.33/arch/sparc/include/asm/elf_32.h        2010-03-07 12:23:35.909670807 -0500
3238 @@ -114,6 +114,13 @@ typedef struct {
3239
3240  #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
3241
3242 +#ifdef CONFIG_PAX_ASLR
3243 +#define PAX_ELF_ET_DYN_BASE    0x10000UL
3244 +
3245 +#define PAX_DELTA_MMAP_LEN     16
3246 +#define PAX_DELTA_STACK_LEN    16
3247 +#endif
3248 +
3249  /* This yields a mask that user programs can use to figure out what
3250     instruction set this cpu supports.  This can NOT be done in userspace
3251     on Sparc.  */
3252 diff -urNp linux-2.6.33/arch/sparc/include/asm/elf_64.h linux-2.6.33/arch/sparc/include/asm/elf_64.h
3253 --- linux-2.6.33/arch/sparc/include/asm/elf_64.h        2010-02-24 13:52:17.000000000 -0500
3254 +++ linux-2.6.33/arch/sparc/include/asm/elf_64.h        2010-03-07 12:23:35.909670807 -0500
3255 @@ -162,6 +162,12 @@ typedef struct {
3256  #define ELF_ET_DYN_BASE                0x0000010000000000UL
3257  #define COMPAT_ELF_ET_DYN_BASE 0x0000000070000000UL
3258
3259 +#ifdef CONFIG_PAX_ASLR
3260 +#define PAX_ELF_ET_DYN_BASE    (test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
3261 +
3262 +#define PAX_DELTA_MMAP_LEN     (test_thread_flag(TIF_32BIT) ? 14 : 28)
3263 +#define PAX_DELTA_STACK_LEN    (test_thread_flag(TIF_32BIT) ? 15 : 29)
3264 +#endif
3265
3266  /* This yields a mask that user programs can use to figure out what
3267     instruction set this cpu supports.  */
3268 diff -urNp linux-2.6.33/arch/sparc/include/asm/pgtable_32.h linux-2.6.33/arch/sparc/include/asm/pgtable_32.h
3269 --- linux-2.6.33/arch/sparc/include/asm/pgtable_32.h    2010-02-24 13:52:17.000000000 -0500
3270 +++ linux-2.6.33/arch/sparc/include/asm/pgtable_32.h    2010-03-07 12:23:35.909670807 -0500
3271 @@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
3272  BTFIXUPDEF_INT(page_none)
3273  BTFIXUPDEF_INT(page_copy)
3274  BTFIXUPDEF_INT(page_readonly)
3275 +
3276 +#ifdef CONFIG_PAX_PAGEEXEC
3277 +BTFIXUPDEF_INT(page_shared_noexec)
3278 +BTFIXUPDEF_INT(page_copy_noexec)
3279 +BTFIXUPDEF_INT(page_readonly_noexec)
3280 +#endif
3281 +
3282  BTFIXUPDEF_INT(page_kernel)
3283
3284  #define PMD_SHIFT              SUN4C_PMD_SHIFT
3285 @@ -64,6 +71,16 @@ extern pgprot_t PAGE_SHARED;
3286  #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
3287  #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
3288
3289 +#ifdef CONFIG_PAX_PAGEEXEC
3290 +extern pgprot_t PAGE_SHARED_NOEXEC;
3291 +# define PAGE_COPY_NOEXEC      __pgprot(BTFIXUP_INT(page_copy_noexec))
3292 +# define PAGE_READONLY_NOEXEC  __pgprot(BTFIXUP_INT(page_readonly_noexec))
3293 +#else
3294 +# define PAGE_SHARED_NOEXEC    PAGE_SHARED
3295 +# define PAGE_COPY_NOEXEC      PAGE_COPY
3296 +# define PAGE_READONLY_NOEXEC  PAGE_READONLY
3297 +#endif
3298 +
3299  extern unsigned long page_kernel;
3300
3301  #ifdef MODULE
3302 diff -urNp linux-2.6.33/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.33/arch/sparc/include/asm/pgtsrmmu.h
3303 --- linux-2.6.33/arch/sparc/include/asm/pgtsrmmu.h      2010-02-24 13:52:17.000000000 -0500
3304 +++ linux-2.6.33/arch/sparc/include/asm/pgtsrmmu.h      2010-03-07 12:23:35.909670807 -0500
3305 @@ -115,6 +115,13 @@
3306                                     SRMMU_EXEC | SRMMU_REF)
3307  #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
3308                                     SRMMU_EXEC | SRMMU_REF)
3309 +
3310 +#ifdef CONFIG_PAX_PAGEEXEC
3311 +#define SRMMU_PAGE_SHARED_NOEXEC       __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
3312 +#define SRMMU_PAGE_COPY_NOEXEC __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3313 +#define SRMMU_PAGE_RDONLY_NOEXEC       __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
3314 +#endif
3315 +
3316  #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
3317                                     SRMMU_DIRTY | SRMMU_REF)
3318
3319 diff -urNp linux-2.6.33/arch/sparc/include/asm/spinlock_64.h linux-2.6.33/arch/sparc/include/asm/spinlock_64.h
3320 --- linux-2.6.33/arch/sparc/include/asm/spinlock_64.h   2010-02-24 13:52:17.000000000 -0500
3321 +++ linux-2.6.33/arch/sparc/include/asm/spinlock_64.h   2010-03-07 12:23:35.909670807 -0500
3322 @@ -99,7 +99,12 @@ static void inline arch_read_lock(arch_r
3323         __asm__ __volatile__ (
3324  "1:    ldsw            [%2], %0\n"
3325  "      brlz,pn         %0, 2f\n"
3326 -"4:     add            %0, 1, %1\n"
3327 +"4:     addcc          %0, 1, %1\n"
3328 +
3329 +#ifdef CONFIG_PAX_REFCOUNT
3330 +"      tvs             %%icc, 6\n"
3331 +#endif
3332 +
3333  "      cas             [%2], %0, %1\n"
3334  "      cmp             %0, %1\n"
3335  "      bne,pn          %%icc, 1b\n"
3336 @@ -112,7 +117,7 @@ static void inline arch_read_lock(arch_r
3337  "      .previous"
3338         : "=&r" (tmp1), "=&r" (tmp2)
3339         : "r" (lock)
3340 -       : "memory");
3341 +       : "memory", "cc");
3342  }
3343
3344  static int inline arch_read_trylock(arch_rwlock_t *lock)
3345 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
3346  "1:    ldsw            [%2], %0\n"
3347  "      brlz,a,pn       %0, 2f\n"
3348  "       mov            0, %0\n"
3349 -"      add             %0, 1, %1\n"
3350 +"      addcc           %0, 1, %1\n"
3351 +
3352 +#ifdef CONFIG_PAX_REFCOUNT
3353 +"      tvs             %%icc, 6\n"
3354 +#endif
3355 +
3356  "      cas             [%2], %0, %1\n"
3357  "      cmp             %0, %1\n"
3358  "      bne,pn          %%icc, 1b\n"
3359 @@ -142,7 +152,12 @@ static void inline arch_read_unlock(arch
3360
3361         __asm__ __volatile__(
3362  "1:    lduw    [%2], %0\n"
3363 -"      sub     %0, 1, %1\n"
3364 +"      subcc   %0, 1, %1\n"
3365 +
3366 +#ifdef CONFIG_PAX_REFCOUNT
3367 +"      tvs     %%icc, 6\n"
3368 +#endif
3369 +
3370  "      cas     [%2], %0, %1\n"
3371  "      cmp     %0, %1\n"
3372  "      bne,pn  %%xcc, 1b\n"
3373 diff -urNp linux-2.6.33/arch/sparc/include/asm/uaccess_32.h linux-2.6.33/arch/sparc/include/asm/uaccess_32.h
3374 --- linux-2.6.33/arch/sparc/include/asm/uaccess_32.h    2010-02-24 13:52:17.000000000 -0500
3375 +++ linux-2.6.33/arch/sparc/include/asm/uaccess_32.h    2010-03-07 12:23:35.909670807 -0500
3376 @@ -249,14 +249,25 @@ extern unsigned long __copy_user(void __
3377
3378  static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
3379  {
3380 -       if (n && __access_ok((unsigned long) to, n))
3381 +       if ((long)n < 0)
3382 +               return n;
3383 +
3384 +       if (n && __access_ok((unsigned long) to, n)) {
3385 +               if (!__builtin_constant_p(n))
3386 +                       check_object_size(from, n, true);
3387                 return __copy_user(to, (__force void __user *) from, n);
3388 -       else
3389 +       } else
3390                 return n;
3391  }
3392
3393  static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
3394  {
3395 +       if ((long)n < 0)
3396 +               return n;
3397 +
3398 +       if (!__builtin_constant_p(n))
3399 +               check_object_size(from, n, true);
3400 +
3401         return __copy_user(to, (__force void __user *) from, n);
3402  }
3403
3404 @@ -272,19 +283,27 @@ static inline unsigned long copy_from_us
3405  {
3406         int sz = __compiletime_object_size(to);
3407
3408 +       if ((long)n < 0)
3409 +               return n;
3410 +
3411         if (unlikely(sz != -1 && sz < n)) {
3412                 copy_from_user_overflow();
3413                 return n;
3414         }
3415
3416 -       if (n && __access_ok((unsigned long) from, n))
3417 +       if (n && __access_ok((unsigned long) from, n)) {
3418 +               if (!__builtin_constant_p(n))
3419 +                       check_object_size(to, n, false);
3420                 return __copy_user((__force void __user *) to, from, n);
3421 -       else
3422 +       } else
3423                 return n;
3424  }
3425
3426  static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
3427  {
3428 +       if ((long)n < 0)
3429 +               return n;
3430 +
3431         return __copy_user((__force void __user *) to, from, n);
3432  }
3433
3434 diff -urNp linux-2.6.33/arch/sparc/include/asm/uaccess_64.h linux-2.6.33/arch/sparc/include/asm/uaccess_64.h
3435 --- linux-2.6.33/arch/sparc/include/asm/uaccess_64.h    2010-02-24 13:52:17.000000000 -0500
3436 +++ linux-2.6.33/arch/sparc/include/asm/uaccess_64.h    2010-03-07 12:23:35.909670807 -0500
3437 @@ -10,6 +10,7 @@
3438  #include <linux/compiler.h>
3439  #include <linux/string.h>
3440  #include <linux/thread_info.h>
3441 +#include <linux/kernel.h>
3442  #include <asm/asi.h>
3443  #include <asm/system.h>
3444  #include <asm/spitfire.h>
3445 @@ -204,6 +205,7 @@ __asm__ __volatile__(                                                       \
3446         : "=r" (x) : "r" (__m(addr)), "i" (retval))
3447
3448  extern int __get_user_bad(void);
3449 +extern void check_object_size(const void *ptr, unsigned long n, bool to);
3450
3451  extern void copy_from_user_overflow(void)
3452  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
3453 @@ -224,6 +226,12 @@ copy_from_user(void *to, const void __us
3454         int sz = __compiletime_object_size(to);
3455         unsigned long ret = size;
3456
3457 +       if ((long)size < 0 || size > INT_MAX)
3458 +               return size;
3459 +
3460 +       if (!__builtin_constant_p(size))
3461 +               check_object_size(to, size, false);
3462 +
3463         if (likely(sz == -1 || sz >= size)) {
3464                 ret = ___copy_from_user(to, from, size);
3465                 if (unlikely(ret))
3466 @@ -243,8 +251,15 @@ extern unsigned long copy_to_user_fixup(
3467  static inline unsigned long __must_check
3468  copy_to_user(void __user *to, const void *from, unsigned long size)
3469  {
3470 -       unsigned long ret = ___copy_to_user(to, from, size);
3471 +       unsigned long ret;
3472 +
3473 +       if ((long)size < 0 || size > INT_MAX)
3474 +               return size;
3475 +
3476 +       if (!__builtin_constant_p(size))
3477 +               check_object_size(from, size, true);
3478
3479 +       ret = ___copy_to_user(to, from, size);
3480         if (unlikely(ret))
3481                 ret = copy_to_user_fixup(to, from, size);
3482         return ret;
3483 diff -urNp linux-2.6.33/arch/sparc/kernel/iommu.c linux-2.6.33/arch/sparc/kernel/iommu.c
3484 --- linux-2.6.33/arch/sparc/kernel/iommu.c      2010-02-24 13:52:17.000000000 -0500
3485 +++ linux-2.6.33/arch/sparc/kernel/iommu.c      2010-03-07 12:23:35.909670807 -0500
3486 @@ -827,7 +827,7 @@ static void dma_4u_sync_sg_for_cpu(struc
3487         spin_unlock_irqrestore(&iommu->lock, flags);
3488  }
3489
3490 -static struct dma_map_ops sun4u_dma_ops = {
3491 +static const struct dma_map_ops sun4u_dma_ops = {
3492         .alloc_coherent         = dma_4u_alloc_coherent,
3493         .free_coherent          = dma_4u_free_coherent,
3494         .map_page               = dma_4u_map_page,
3495 @@ -838,7 +838,7 @@ static struct dma_map_ops sun4u_dma_ops
3496         .sync_sg_for_cpu        = dma_4u_sync_sg_for_cpu,
3497  };
3498
3499 -struct dma_map_ops *dma_ops = &sun4u_dma_ops;
3500 +const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
3501  EXPORT_SYMBOL(dma_ops);
3502
3503  extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
3504 diff -urNp linux-2.6.33/arch/sparc/kernel/ioport.c linux-2.6.33/arch/sparc/kernel/ioport.c
3505 --- linux-2.6.33/arch/sparc/kernel/ioport.c     2010-02-24 13:52:17.000000000 -0500
3506 +++ linux-2.6.33/arch/sparc/kernel/ioport.c     2010-03-07 12:23:35.909670807 -0500
3507 @@ -397,7 +397,7 @@ static void sbus_sync_sg_for_device(stru
3508         BUG();
3509  }
3510
3511 -struct dma_map_ops sbus_dma_ops = {
3512 +const struct dma_map_ops sbus_dma_ops = {
3513         .alloc_coherent         = sbus_alloc_coherent,
3514         .free_coherent          = sbus_free_coherent,
3515         .map_page               = sbus_map_page,
3516 @@ -408,7 +408,7 @@ struct dma_map_ops sbus_dma_ops = {
3517         .sync_sg_for_device     = sbus_sync_sg_for_device,
3518  };
3519
3520 -struct dma_map_ops *dma_ops = &sbus_dma_ops;
3521 +const struct dma_map_ops *dma_ops = &sbus_dma_ops;
3522  EXPORT_SYMBOL(dma_ops);
3523
3524  static int __init sparc_register_ioport(void)
3525 @@ -645,7 +645,7 @@ static void pci32_sync_sg_for_device(str
3526         }
3527  }
3528
3529 -struct dma_map_ops pci32_dma_ops = {
3530 +const struct dma_map_ops pci32_dma_ops = {
3531         .alloc_coherent         = pci32_alloc_coherent,
3532         .free_coherent          = pci32_free_coherent,
3533         .map_page               = pci32_map_page,
3534 diff -urNp linux-2.6.33/arch/sparc/kernel/kgdb_32.c linux-2.6.33/arch/sparc/kernel/kgdb_32.c
3535 --- linux-2.6.33/arch/sparc/kernel/kgdb_32.c    2010-02-24 13:52:17.000000000 -0500
3536 +++ linux-2.6.33/arch/sparc/kernel/kgdb_32.c    2010-03-07 12:23:35.909670807 -0500
3537 @@ -158,7 +158,7 @@ void kgdb_arch_exit(void)
3538  {
3539  }
3540
3541 -struct kgdb_arch arch_kgdb_ops = {
3542 +const struct kgdb_arch arch_kgdb_ops = {
3543         /* Breakpoint instruction: ta 0x7d */
3544         .gdb_bpt_instr          = { 0x91, 0xd0, 0x20, 0x7d },
3545  };
3546 diff -urNp linux-2.6.33/arch/sparc/kernel/kgdb_64.c linux-2.6.33/arch/sparc/kernel/kgdb_64.c
3547 --- linux-2.6.33/arch/sparc/kernel/kgdb_64.c    2010-02-24 13:52:17.000000000 -0500
3548 +++ linux-2.6.33/arch/sparc/kernel/kgdb_64.c    2010-03-07 12:23:35.909670807 -0500
3549 @@ -180,7 +180,7 @@ void kgdb_arch_exit(void)
3550  {
3551  }
3552
3553 -struct kgdb_arch arch_kgdb_ops = {
3554 +const struct kgdb_arch arch_kgdb_ops = {
3555         /* Breakpoint instruction: ta 0x72 */
3556         .gdb_bpt_instr          = { 0x91, 0xd0, 0x20, 0x72 },
3557  };
3558 diff -urNp linux-2.6.33/arch/sparc/kernel/Makefile linux-2.6.33/arch/sparc/kernel/Makefile
3559 --- linux-2.6.33/arch/sparc/kernel/Makefile     2010-02-24 13:52:17.000000000 -0500
3560 +++ linux-2.6.33/arch/sparc/kernel/Makefile     2010-03-07 12:23:35.909670807 -0500
3561 @@ -3,7 +3,7 @@
3562  #
3563
3564  asflags-y := -ansi
3565 -ccflags-y := -Werror
3566 +#ccflags-y := -Werror
3567
3568  extra-y     := head_$(BITS).o
3569  extra-y     += init_task.o
3570 diff -urNp linux-2.6.33/arch/sparc/kernel/pci_sun4v.c linux-2.6.33/arch/sparc/kernel/pci_sun4v.c
3571 --- linux-2.6.33/arch/sparc/kernel/pci_sun4v.c  2010-02-24 13:52:17.000000000 -0500
3572 +++ linux-2.6.33/arch/sparc/kernel/pci_sun4v.c  2010-03-07 12:23:35.909670807 -0500
3573 @@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
3574         spin_unlock_irqrestore(&iommu->lock, flags);
3575  }
3576
3577 -static struct dma_map_ops sun4v_dma_ops = {
3578 +static const struct dma_map_ops sun4v_dma_ops = {
3579         .alloc_coherent                 = dma_4v_alloc_coherent,
3580         .free_coherent                  = dma_4v_free_coherent,
3581         .map_page                       = dma_4v_map_page,
3582 diff -urNp linux-2.6.33/arch/sparc/kernel/sys_sparc_32.c linux-2.6.33/arch/sparc/kernel/sys_sparc_32.c
3583 --- linux-2.6.33/arch/sparc/kernel/sys_sparc_32.c       2010-02-24 13:52:17.000000000 -0500
3584 +++ linux-2.6.33/arch/sparc/kernel/sys_sparc_32.c       2010-03-07 12:23:35.909670807 -0500
3585 @@ -57,7 +57,7 @@ unsigned long arch_get_unmapped_area(str
3586         if (ARCH_SUN4C && len > 0x20000000)
3587                 return -ENOMEM;
3588         if (!addr)
3589 -               addr = TASK_UNMAPPED_BASE;
3590 +               addr = current->mm->mmap_base;
3591
3592         if (flags & MAP_SHARED)
3593                 addr = COLOUR_ALIGN(addr);
3594 diff -urNp linux-2.6.33/arch/sparc/kernel/sys_sparc_64.c linux-2.6.33/arch/sparc/kernel/sys_sparc_64.c
3595 --- linux-2.6.33/arch/sparc/kernel/sys_sparc_64.c       2010-02-24 13:52:17.000000000 -0500
3596 +++ linux-2.6.33/arch/sparc/kernel/sys_sparc_64.c       2010-03-07 12:23:35.909670807 -0500
3597 @@ -125,7 +125,7 @@ unsigned long arch_get_unmapped_area(str
3598                 /* We do not accept a shared mapping if it would violate
3599                  * cache aliasing constraints.
3600                  */
3601 -               if ((flags & MAP_SHARED) &&
3602 +               if ((filp || (flags & MAP_SHARED)) &&
3603                     ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3604                         return -EINVAL;
3605                 return addr;
3606 @@ -140,6 +140,10 @@ unsigned long arch_get_unmapped_area(str
3607         if (filp || (flags & MAP_SHARED))
3608                 do_color_align = 1;
3609
3610 +#ifdef CONFIG_PAX_RANDMMAP
3611 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
3612 +#endif
3613 +
3614         if (addr) {
3615                 if (do_color_align)
3616                         addr = COLOUR_ALIGN(addr, pgoff);
3617 @@ -153,9 +157,9 @@ unsigned long arch_get_unmapped_area(str
3618         }
3619
3620         if (len > mm->cached_hole_size) {
3621 -               start_addr = addr = mm->free_area_cache;
3622 +               start_addr = addr = mm->free_area_cache;
3623         } else {
3624 -               start_addr = addr = TASK_UNMAPPED_BASE;
3625 +               start_addr = addr = mm->mmap_base;
3626                 mm->cached_hole_size = 0;
3627         }
3628
3629 @@ -175,8 +179,8 @@ full_search:
3630                         vma = find_vma(mm, VA_EXCLUDE_END);
3631                 }
3632                 if (unlikely(task_size < addr)) {
3633 -                       if (start_addr != TASK_UNMAPPED_BASE) {
3634 -                               start_addr = addr = TASK_UNMAPPED_BASE;
3635 +                       if (start_addr != mm->mmap_base) {
3636 +                               start_addr = addr = mm->mmap_base;
3637                                 mm->cached_hole_size = 0;
3638                                 goto full_search;
3639                         }
3640 @@ -216,7 +220,7 @@ arch_get_unmapped_area_topdown(struct fi
3641                 /* We do not accept a shared mapping if it would violate
3642                  * cache aliasing constraints.
3643                  */
3644 -               if ((flags & MAP_SHARED) &&
3645 +               if ((filp || (flags & MAP_SHARED)) &&
3646                     ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
3647                         return -EINVAL;
3648                 return addr;
3649 @@ -386,6 +390,12 @@ void arch_pick_mmap_layout(struct mm_str
3650             gap == RLIM_INFINITY ||
3651             sysctl_legacy_va_layout) {
3652                 mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
3653 +
3654 +#ifdef CONFIG_PAX_RANDMMAP
3655 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
3656 +                       mm->mmap_base += mm->delta_mmap;
3657 +#endif
3658 +
3659                 mm->get_unmapped_area = arch_get_unmapped_area;
3660                 mm->unmap_area = arch_unmap_area;
3661         } else {
3662 @@ -398,6 +408,12 @@ void arch_pick_mmap_layout(struct mm_str
3663                         gap = (task_size / 6 * 5);
3664
3665                 mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
3666 +
3667 +#ifdef CONFIG_PAX_RANDMMAP
3668 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
3669 +                       mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
3670 +#endif
3671 +
3672                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
3673                 mm->unmap_area = arch_unmap_area_topdown;
3674         }
3675 diff -urNp linux-2.6.33/arch/sparc/kernel/traps_64.c linux-2.6.33/arch/sparc/kernel/traps_64.c
3676 --- linux-2.6.33/arch/sparc/kernel/traps_64.c   2010-02-24 13:52:17.000000000 -0500
3677 +++ linux-2.6.33/arch/sparc/kernel/traps_64.c   2010-03-07 12:23:35.909670807 -0500
3678 @@ -93,6 +93,12 @@ void bad_trap(struct pt_regs *regs, long
3679
3680         lvl -= 0x100;
3681         if (regs->tstate & TSTATE_PRIV) {
3682 +
3683 +#ifdef CONFIG_PAX_REFCOUNT
3684 +               if (lvl == 6)
3685 +                       pax_report_refcount_overflow(regs);
3686 +#endif
3687 +
3688                 sprintf(buffer, "Kernel bad sw trap %lx", lvl);
3689                 die_if_kernel(buffer, regs);
3690         }
3691 @@ -111,11 +117,16 @@ void bad_trap(struct pt_regs *regs, long
3692  void bad_trap_tl1(struct pt_regs *regs, long lvl)
3693  {
3694         char buffer[32];
3695 -
3696 +
3697         if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
3698                        0, lvl, SIGTRAP) == NOTIFY_STOP)
3699                 return;
3700
3701 +#ifdef CONFIG_PAX_REFCOUNT
3702 +       if (lvl == 6)
3703 +               pax_report_refcount_overflow(regs);
3704 +#endif
3705 +
3706         dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
3707
3708         sprintf (buffer, "Bad trap %lx at tl>0", lvl);
3709 diff -urNp linux-2.6.33/arch/sparc/lib/atomic_64.S linux-2.6.33/arch/sparc/lib/atomic_64.S
3710 --- linux-2.6.33/arch/sparc/lib/atomic_64.S     2010-02-24 13:52:17.000000000 -0500
3711 +++ linux-2.6.33/arch/sparc/lib/atomic_64.S     2010-03-07 12:23:35.913649556 -0500
3712 @@ -18,7 +18,12 @@
3713  atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
3714         BACKOFF_SETUP(%o2)
3715  1:     lduw    [%o1], %g1
3716 -       add     %g1, %o0, %g7
3717 +       addcc   %g1, %o0, %g7
3718 +
3719 +#ifdef CONFIG_PAX_REFCOUNT
3720 +       tvs     %icc, 6
3721 +#endif
3722 +
3723         cas     [%o1], %g1, %g7
3724         cmp     %g1, %g7
3725         bne,pn  %icc, 2f
3726 @@ -28,12 +33,32 @@ atomic_add: /* %o0 = increment, %o1 = at
3727  2:     BACKOFF_SPIN(%o2, %o3, 1b)
3728         .size   atomic_add, .-atomic_add
3729
3730 +       .globl  atomic_add_unchecked
3731 +       .type   atomic_add_unchecked,#function
3732 +atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3733 +       BACKOFF_SETUP(%o2)
3734 +1:     lduw    [%o1], %g1
3735 +       add     %g1, %o0, %g7
3736 +       cas     [%o1], %g1, %g7
3737 +       cmp     %g1, %g7
3738 +       bne,pn  %icc, 2f
3739 +        nop
3740 +       retl
3741 +        nop
3742 +2:     BACKOFF_SPIN(%o2, %o3, 1b)
3743 +       .size   atomic_add_unchecked, .-atomic_add_unchecked
3744 +
3745         .globl  atomic_sub
3746         .type   atomic_sub,#function
3747  atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3748         BACKOFF_SETUP(%o2)
3749  1:     lduw    [%o1], %g1
3750 -       sub     %g1, %o0, %g7
3751 +       subcc   %g1, %o0, %g7
3752 +
3753 +#ifdef CONFIG_PAX_REFCOUNT
3754 +       tvs     %icc, 6
3755 +#endif
3756 +
3757         cas     [%o1], %g1, %g7
3758         cmp     %g1, %g7
3759         bne,pn  %icc, 2f
3760 @@ -43,12 +68,32 @@ atomic_sub: /* %o0 = decrement, %o1 = at
3761  2:     BACKOFF_SPIN(%o2, %o3, 1b)
3762         .size   atomic_sub, .-atomic_sub
3763
3764 +       .globl  atomic_sub_unchecked
3765 +       .type   atomic_sub_unchecked,#function
3766 +atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
3767 +       BACKOFF_SETUP(%o2)
3768 +1:     lduw    [%o1], %g1
3769 +       sub     %g1, %o0, %g7
3770 +       cas     [%o1], %g1, %g7
3771 +       cmp     %g1, %g7
3772 +       bne,pn  %icc, 2f
3773 +        nop
3774 +       retl
3775 +        nop
3776 +2:     BACKOFF_SPIN(%o2, %o3, 1b)
3777 +       .size   atomic_sub_unchecked, .-atomic_sub_unchecked
3778 +
3779         .globl  atomic_add_ret
3780         .type   atomic_add_ret,#function
3781  atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3782         BACKOFF_SETUP(%o2)
3783  1:     lduw    [%o1], %g1
3784 -       add     %g1, %o0, %g7
3785 +       addcc   %g1, %o0, %g7
3786 +
3787 +#ifdef CONFIG_PAX_REFCOUNT
3788 +       tvs     %icc, 6
3789 +#endif
3790 +
3791         cas     [%o1], %g1, %g7
3792         cmp     %g1, %g7
3793         bne,pn  %icc, 2f
3794 @@ -64,7 +109,12 @@ atomic_add_ret: /* %o0 = increment, %o1
3795  atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
3796         BACKOFF_SETUP(%o2)
3797  1:     lduw    [%o1], %g1
3798 -       sub     %g1, %o0, %g7
3799 +       subcc   %g1, %o0, %g7
3800 +
3801 +#ifdef CONFIG_PAX_REFCOUNT
3802 +       tvs     %icc, 6
3803 +#endif
3804 +
3805         cas     [%o1], %g1, %g7
3806         cmp     %g1, %g7
3807         bne,pn  %icc, 2f
3808 @@ -80,7 +130,12 @@ atomic_sub_ret: /* %o0 = decrement, %o1
3809  atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
3810         BACKOFF_SETUP(%o2)
3811  1:     ldx     [%o1], %g1
3812 -       add     %g1, %o0, %g7
3813 +       addcc   %g1, %o0, %g7
3814 +
3815 +#ifdef CONFIG_PAX_REFCOUNT
3816 +       tvs     %xcc, 6
3817 +#endif
3818 +
3819         casx    [%o1], %g1, %g7
3820         cmp     %g1, %g7
3821         bne,pn  %xcc, 2f
3822 @@ -90,12 +145,32 @@ atomic64_add: /* %o0 = increment, %o1 =
3823  2:     BACKOFF_SPIN(%o2, %o3, 1b)
3824         .size   atomic64_add, .-atomic64_add
3825
3826 +       .globl  atomic64_add_unchecked
3827 +       .type   atomic64_add_unchecked,#function
3828 +atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3829 +       BACKOFF_SETUP(%o2)
3830 +1:     ldx     [%o1], %g1
3831 +       addcc   %g1, %o0, %g7
3832 +       casx    [%o1], %g1, %g7
3833 +       cmp     %g1, %g7
3834 +       bne,pn  %xcc, 2f
3835 +        nop
3836 +       retl
3837 +        nop
3838 +2:     BACKOFF_SPIN(%o2, %o3, 1b)
3839 +       .size   atomic64_add_unchecked, .-atomic64_add_unchecked
3840 +
3841         .globl  atomic64_sub
3842         .type   atomic64_sub,#function
3843  atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
3844         BACKOFF_SETUP(%o2)
3845  1:     ldx     [%o1], %g1
3846 -       sub     %g1, %o0, %g7
3847 +       subcc   %g1, %o0, %g7
3848 +
3849 +#ifdef CONFIG_PAX_REFCOUNT
3850 +       tvs     %xcc, 6
3851 +#endif
3852 +
3853         casx    [%o1], %g1, %g7
3854         cmp     %g1, %g7
3855         bne,pn  %xcc, 2f
3856 @@ -110,7 +185,12 @@ atomic64_sub: /* %o0 = decrement, %o1 =
3857  atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
3858         BACKOFF_SETUP(%o2)
3859  1:     ldx     [%o1], %g1
3860 -       add     %g1, %o0, %g7
3861 +       addcc   %g1, %o0, %g7
3862 +
3863 +#ifdef CONFIG_PAX_REFCOUNT
3864 +       tvs     %xcc, 6
3865 +#endif
3866 +
3867         casx    [%o1], %g1, %g7
3868         cmp     %g1, %g7
3869         bne,pn  %xcc, 2f
3870 @@ -121,12 +201,33 @@ atomic64_add_ret: /* %o0 = increment, %o
3871  2:     BACKOFF_SPIN(%o2, %o3, 1b)
3872         .size   atomic64_add_ret, .-atomic64_add_ret
3873
3874 +       .globl  atomic64_add_ret_unchecked
3875 +       .type   atomic64_add_ret_unchecked,#function
3876 +atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
3877 +       BACKOFF_SETUP(%o2)
3878 +1:     ldx     [%o1], %g1
3879 +       addcc   %g1, %o0, %g7
3880 +       casx    [%o1], %g1, %g7
3881 +       cmp     %g1, %g7
3882 +       bne,pn  %xcc, 2f
3883 +        add    %g7, %o0, %g7
3884 +       mov     %g7, %o0
3885 +       retl
3886 +        nop
3887 +2:     BACKOFF_SPIN(%o2, %o3, 1b)
3888 +       .size   atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
3889 +
3890         .globl  atomic64_sub_ret
3891         .type   atomic64_sub_ret,#function
3892  atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
3893         BACKOFF_SETUP(%o2)
3894  1:     ldx     [%o1], %g1
3895 -       sub     %g1, %o0, %g7
3896 +       subcc   %g1, %o0, %g7
3897 +
3898 +#ifdef CONFIG_PAX_REFCOUNT
3899 +       tvs     %xcc, 6
3900 +#endif
3901 +
3902         casx    [%o1], %g1, %g7
3903         cmp     %g1, %g7
3904         bne,pn  %xcc, 2f
3905 diff -urNp linux-2.6.33/arch/sparc/lib/ksyms.c linux-2.6.33/arch/sparc/lib/ksyms.c
3906 --- linux-2.6.33/arch/sparc/lib/ksyms.c 2010-02-24 13:52:17.000000000 -0500
3907 +++ linux-2.6.33/arch/sparc/lib/ksyms.c 2010-03-07 12:23:35.913649556 -0500
3908 @@ -142,8 +142,10 @@ EXPORT_SYMBOL(__downgrade_write);
3909
3910  /* Atomic counter implementation. */
3911  EXPORT_SYMBOL(atomic_add);
3912 +EXPORT_SYMBOL(atomic_add_unchecked);
3913  EXPORT_SYMBOL(atomic_add_ret);
3914  EXPORT_SYMBOL(atomic_sub);
3915 +EXPORT_SYMBOL(atomic_sub_unchecked);
3916  EXPORT_SYMBOL(atomic_sub_ret);
3917  EXPORT_SYMBOL(atomic64_add);
3918  EXPORT_SYMBOL(atomic64_add_ret);
3919 diff -urNp linux-2.6.33/arch/sparc/lib/rwsem_64.S linux-2.6.33/arch/sparc/lib/rwsem_64.S
3920 --- linux-2.6.33/arch/sparc/lib/rwsem_64.S      2010-02-24 13:52:17.000000000 -0500
3921 +++ linux-2.6.33/arch/sparc/lib/rwsem_64.S      2010-03-07 12:23:35.913649556 -0500
3922 @@ -11,7 +11,12 @@
3923         .globl          __down_read
3924  __down_read:
3925  1:     lduw            [%o0], %g1
3926 -       add             %g1, 1, %g7
3927 +       addcc           %g1, 1, %g7
3928 +
3929 +#ifdef CONFIG_PAX_REFCOUNT
3930 +       tvs     %icc, 6
3931 +#endif
3932 +
3933         cas             [%o0], %g1, %g7
3934         cmp             %g1, %g7
3935         bne,pn          %icc, 1b
3936 @@ -33,7 +38,12 @@ __down_read:
3937         .globl          __down_read_trylock
3938  __down_read_trylock:
3939  1:     lduw            [%o0], %g1
3940 -       add             %g1, 1, %g7
3941 +       addcc           %g1, 1, %g7
3942 +
3943 +#ifdef CONFIG_PAX_REFCOUNT
3944 +       tvs     %icc, 6
3945 +#endif
3946 +
3947         cmp             %g7, 0
3948         bl,pn           %icc, 2f
3949          mov            0, %o1
3950 @@ -51,7 +61,12 @@ __down_write:
3951         or              %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
3952  1:
3953         lduw            [%o0], %g3
3954 -       add             %g3, %g1, %g7
3955 +       addcc           %g3, %g1, %g7
3956 +
3957 +#ifdef CONFIG_PAX_REFCOUNT
3958 +       tvs     %icc, 6
3959 +#endif
3960 +
3961         cas             [%o0], %g3, %g7
3962         cmp             %g3, %g7
3963         bne,pn          %icc, 1b
3964 @@ -77,7 +92,12 @@ __down_write_trylock:
3965         cmp             %g3, 0
3966         bne,pn          %icc, 2f
3967          mov            0, %o1
3968 -       add             %g3, %g1, %g7
3969 +       addcc           %g3, %g1, %g7
3970 +
3971 +#ifdef CONFIG_PAX_REFCOUNT
3972 +       tvs     %icc, 6
3973 +#endif
3974 +
3975         cas             [%o0], %g3, %g7
3976         cmp             %g3, %g7
3977         bne,pn          %icc, 1b
3978 @@ -90,7 +110,12 @@ __down_write_trylock:
3979  __up_read:
3980  1:
3981         lduw            [%o0], %g1
3982 -       sub             %g1, 1, %g7
3983 +       subcc           %g1, 1, %g7
3984 +
3985 +#ifdef CONFIG_PAX_REFCOUNT
3986 +       tvs     %icc, 6
3987 +#endif
3988 +
3989         cas             [%o0], %g1, %g7
3990         cmp             %g1, %g7
3991         bne,pn          %icc, 1b
3992 @@ -118,7 +143,12 @@ __up_write:
3993         or              %g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
3994  1:
3995         lduw            [%o0], %g3
3996 -       sub             %g3, %g1, %g7
3997 +       subcc           %g3, %g1, %g7
3998 +
3999 +#ifdef CONFIG_PAX_REFCOUNT
4000 +       tvs     %icc, 6
4001 +#endif
4002 +
4003         cas             [%o0], %g3, %g7
4004         cmp             %g3, %g7
4005         bne,pn          %icc, 1b
4006 @@ -143,7 +173,12 @@ __downgrade_write:
4007         or              %g1, %lo(RWSEM_WAITING_BIAS), %g1
4008  1:
4009         lduw            [%o0], %g3
4010 -       sub             %g3, %g1, %g7
4011 +       subcc           %g3, %g1, %g7
4012 +
4013 +#ifdef CONFIG_PAX_REFCOUNT
4014 +       tvs     %icc, 6
4015 +#endif
4016 +
4017         cas             [%o0], %g3, %g7
4018         cmp             %g3, %g7
4019         bne,pn          %icc, 1b
4020 diff -urNp linux-2.6.33/arch/sparc/Makefile linux-2.6.33/arch/sparc/Makefile
4021 --- linux-2.6.33/arch/sparc/Makefile    2010-02-24 13:52:17.000000000 -0500
4022 +++ linux-2.6.33/arch/sparc/Makefile    2010-03-07 12:23:35.913649556 -0500
4023 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)    += arch/sparc
4024  # Export what is needed by arch/sparc/boot/Makefile
4025  export VMLINUX_INIT VMLINUX_MAIN
4026  VMLINUX_INIT := $(head-y) $(init-y)
4027 -VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
4028 +VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
4029  VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
4030  VMLINUX_MAIN += $(drivers-y) $(net-y)
4031
4032 diff -urNp linux-2.6.33/arch/sparc/mm/fault_32.c linux-2.6.33/arch/sparc/mm/fault_32.c
4033 --- linux-2.6.33/arch/sparc/mm/fault_32.c       2010-02-24 13:52:17.000000000 -0500
4034 +++ linux-2.6.33/arch/sparc/mm/fault_32.c       2010-03-07 12:23:35.913649556 -0500
4035 @@ -22,6 +22,9 @@
4036  #include <linux/interrupt.h>
4037  #include <linux/module.h>
4038  #include <linux/kdebug.h>
4039 +#include <linux/slab.h>
4040 +#include <linux/pagemap.h>
4041 +#include <linux/compiler.h>
4042
4043  #include <asm/system.h>
4044  #include <asm/page.h>
4045 @@ -168,6 +171,267 @@ static unsigned long compute_si_addr(str
4046         return safe_compute_effective_address(regs, insn);
4047  }
4048
4049 +#ifdef CONFIG_PAX_PAGEEXEC
4050 +#ifdef CONFIG_PAX_DLRESOLVE
4051 +static void pax_emuplt_close(struct vm_area_struct *vma)
4052 +{
4053 +       vma->vm_mm->call_dl_resolve = 0UL;
4054 +}
4055 +
4056 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4057 +{
4058 +       unsigned int *kaddr;
4059 +
4060 +       vmf->page = alloc_page(GFP_HIGHUSER);
4061 +       if (!vmf->page)
4062 +               return VM_FAULT_OOM;
4063 +
4064 +       kaddr = kmap(vmf->page);
4065 +       memset(kaddr, 0, PAGE_SIZE);
4066 +       kaddr[0] = 0x9DE3BFA8U; /* save */
4067 +       flush_dcache_page(vmf->page);
4068 +       kunmap(vmf->page);
4069 +       return VM_FAULT_MAJOR;
4070 +}
4071 +
4072 +static const struct vm_operations_struct pax_vm_ops = {
4073 +       .close = pax_emuplt_close,
4074 +       .fault = pax_emuplt_fault
4075 +};
4076 +
4077 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4078 +{
4079 +       int ret;
4080 +
4081 +       vma->vm_mm = current->mm;
4082 +       vma->vm_start = addr;
4083 +       vma->vm_end = addr + PAGE_SIZE;
4084 +       vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4085 +       vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4086 +       vma->vm_ops = &pax_vm_ops;
4087 +
4088 +       ret = insert_vm_struct(current->mm, vma);
4089 +       if (ret)
4090 +               return ret;
4091 +
4092 +       ++current->mm->total_vm;
4093 +       return 0;
4094 +}
4095 +#endif
4096 +
4097 +/*
4098 + * PaX: decide what to do with offenders (regs->pc = fault address)
4099 + *
4100 + * returns 1 when task should be killed
4101 + *         2 when patched PLT trampoline was detected
4102 + *         3 when unpatched PLT trampoline was detected
4103 + */
4104 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4105 +{
4106 +
4107 +#ifdef CONFIG_PAX_EMUPLT
4108 +       int err;
4109 +
4110 +       do { /* PaX: patched PLT emulation #1 */
4111 +               unsigned int sethi1, sethi2, jmpl;
4112 +
4113 +               err = get_user(sethi1, (unsigned int *)regs->pc);
4114 +               err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
4115 +               err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
4116 +
4117 +               if (err)
4118 +                       break;
4119 +
4120 +               if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4121 +                   (sethi2 & 0xFFC00000U) == 0x03000000U &&
4122 +                   (jmpl & 0xFFFFE000U) == 0x81C06000U)
4123 +               {
4124 +                       unsigned int addr;
4125 +
4126 +                       regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4127 +                       addr = regs->u_regs[UREG_G1];
4128 +                       addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4129 +                       regs->pc = addr;
4130 +                       regs->npc = addr+4;
4131 +                       return 2;
4132 +               }
4133 +       } while (0);
4134 +
4135 +       { /* PaX: patched PLT emulation #2 */
4136 +               unsigned int ba;
4137 +
4138 +               err = get_user(ba, (unsigned int *)regs->pc);
4139 +
4140 +               if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4141 +                       unsigned int addr;
4142 +
4143 +                       addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4144 +                       regs->pc = addr;
4145 +                       regs->npc = addr+4;
4146 +                       return 2;
4147 +               }
4148 +       }
4149 +
4150 +       do { /* PaX: patched PLT emulation #3 */
4151 +               unsigned int sethi, jmpl, nop;
4152 +
4153 +               err = get_user(sethi, (unsigned int *)regs->pc);
4154 +               err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
4155 +               err |= get_user(nop, (unsigned int *)(regs->pc+8));
4156 +
4157 +               if (err)
4158 +                       break;
4159 +
4160 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4161 +                   (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4162 +                   nop == 0x01000000U)
4163 +               {
4164 +                       unsigned int addr;
4165 +
4166 +                       addr = (sethi & 0x003FFFFFU) << 10;
4167 +                       regs->u_regs[UREG_G1] = addr;
4168 +                       addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4169 +                       regs->pc = addr;
4170 +                       regs->npc = addr+4;
4171 +                       return 2;
4172 +               }
4173 +       } while (0);
4174 +
4175 +       do { /* PaX: unpatched PLT emulation step 1 */
4176 +               unsigned int sethi, ba, nop;
4177 +
4178 +               err = get_user(sethi, (unsigned int *)regs->pc);
4179 +               err |= get_user(ba, (unsigned int *)(regs->pc+4));
4180 +               err |= get_user(nop, (unsigned int *)(regs->pc+8));
4181 +
4182 +               if (err)
4183 +                       break;
4184 +
4185 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4186 +                   ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4187 +                   nop == 0x01000000U)
4188 +               {
4189 +                       unsigned int addr, save, call;
4190 +
4191 +                       if ((ba & 0xFFC00000U) == 0x30800000U)
4192 +                               addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
4193 +                       else
4194 +                               addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
4195 +
4196 +                       err = get_user(save, (unsigned int *)addr);
4197 +                       err |= get_user(call, (unsigned int *)(addr+4));
4198 +                       err |= get_user(nop, (unsigned int *)(addr+8));
4199 +                       if (err)
4200 +                               break;
4201 +
4202 +#ifdef CONFIG_PAX_DLRESOLVE
4203 +                       if (save == 0x9DE3BFA8U &&
4204 +                           (call & 0xC0000000U) == 0x40000000U &&
4205 +                           nop == 0x01000000U)
4206 +                       {
4207 +                               struct vm_area_struct *vma;
4208 +                               unsigned long call_dl_resolve;
4209 +
4210 +                               down_read(&current->mm->mmap_sem);
4211 +                               call_dl_resolve = current->mm->call_dl_resolve;
4212 +                               up_read(&current->mm->mmap_sem);
4213 +                               if (likely(call_dl_resolve))
4214 +                                       goto emulate;
4215 +
4216 +                               vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4217 +
4218 +                               down_write(&current->mm->mmap_sem);
4219 +                               if (current->mm->call_dl_resolve) {
4220 +                                       call_dl_resolve = current->mm->call_dl_resolve;
4221 +                                       up_write(&current->mm->mmap_sem);
4222 +                                       if (vma)
4223 +                                               kmem_cache_free(vm_area_cachep, vma);
4224 +                                       goto emulate;
4225 +                               }
4226 +
4227 +                               call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4228 +                               if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4229 +                                       up_write(&current->mm->mmap_sem);
4230 +                                       if (vma)
4231 +                                               kmem_cache_free(vm_area_cachep, vma);
4232 +                                       return 1;
4233 +                               }
4234 +
4235 +                               if (pax_insert_vma(vma, call_dl_resolve)) {
4236 +                                       up_write(&current->mm->mmap_sem);
4237 +                                       kmem_cache_free(vm_area_cachep, vma);
4238 +                                       return 1;
4239 +                               }
4240 +
4241 +                               current->mm->call_dl_resolve = call_dl_resolve;
4242 +                               up_write(&current->mm->mmap_sem);
4243 +
4244 +emulate:
4245 +                               regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4246 +                               regs->pc = call_dl_resolve;
4247 +                               regs->npc = addr+4;
4248 +                               return 3;
4249 +                       }
4250 +#endif
4251 +
4252 +                       /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4253 +                       if ((save & 0xFFC00000U) == 0x05000000U &&
4254 +                           (call & 0xFFFFE000U) == 0x85C0A000U &&
4255 +                           nop == 0x01000000U)
4256 +                       {
4257 +                               regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4258 +                               regs->u_regs[UREG_G2] = addr + 4;
4259 +                               addr = (save & 0x003FFFFFU) << 10;
4260 +                               addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
4261 +                               regs->pc = addr;
4262 +                               regs->npc = addr+4;
4263 +                               return 3;
4264 +                       }
4265 +               }
4266 +       } while (0);
4267 +
4268 +       do { /* PaX: unpatched PLT emulation step 2 */
4269 +               unsigned int save, call, nop;
4270 +
4271 +               err = get_user(save, (unsigned int *)(regs->pc-4));
4272 +               err |= get_user(call, (unsigned int *)regs->pc);
4273 +               err |= get_user(nop, (unsigned int *)(regs->pc+4));
4274 +               if (err)
4275 +                       break;
4276 +
4277 +               if (save == 0x9DE3BFA8U &&
4278 +                   (call & 0xC0000000U) == 0x40000000U &&
4279 +                   nop == 0x01000000U)
4280 +               {
4281 +                       unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
4282 +
4283 +                       regs->u_regs[UREG_RETPC] = regs->pc;
4284 +                       regs->pc = dl_resolve;
4285 +                       regs->npc = dl_resolve+4;
4286 +                       return 3;
4287 +               }
4288 +       } while (0);
4289 +#endif
4290 +
4291 +       return 1;
4292 +}
4293 +
4294 +void pax_report_insns(void *pc, void *sp)
4295 +{
4296 +       unsigned long i;
4297 +
4298 +       printk(KERN_ERR "PAX: bytes at PC: ");
4299 +       for (i = 0; i < 8; i++) {
4300 +               unsigned int c;
4301 +               if (get_user(c, (unsigned int *)pc+i))
4302 +                       printk(KERN_CONT "???????? ");
4303 +               else
4304 +                       printk(KERN_CONT "%08x ", c);
4305 +       }
4306 +       printk("\n");
4307 +}
4308 +#endif
4309 +
4310  asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
4311                                unsigned long address)
4312  {
4313 @@ -234,6 +498,24 @@ good_area:
4314                 if(!(vma->vm_flags & VM_WRITE))
4315                         goto bad_area;
4316         } else {
4317 +
4318 +#ifdef CONFIG_PAX_PAGEEXEC
4319 +               if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
4320 +                       up_read(&mm->mmap_sem);
4321 +                       switch (pax_handle_fetch_fault(regs)) {
4322 +
4323 +#ifdef CONFIG_PAX_EMUPLT
4324 +                       case 2:
4325 +                       case 3:
4326 +                               return;
4327 +#endif
4328 +
4329 +                       }
4330 +                       pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
4331 +                       do_group_exit(SIGKILL);
4332 +               }
4333 +#endif
4334 +
4335                 /* Allow reads even for write-only mappings */
4336                 if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
4337                         goto bad_area;
4338 diff -urNp linux-2.6.33/arch/sparc/mm/fault_64.c linux-2.6.33/arch/sparc/mm/fault_64.c
4339 --- linux-2.6.33/arch/sparc/mm/fault_64.c       2010-02-24 13:52:17.000000000 -0500
4340 +++ linux-2.6.33/arch/sparc/mm/fault_64.c       2010-03-07 12:23:35.913649556 -0500
4341 @@ -21,6 +21,9 @@
4342  #include <linux/kprobes.h>
4343  #include <linux/kdebug.h>
4344  #include <linux/percpu.h>
4345 +#include <linux/slab.h>
4346 +#include <linux/pagemap.h>
4347 +#include <linux/compiler.h>
4348
4349  #include <asm/page.h>
4350  #include <asm/pgtable.h>
4351 @@ -244,6 +247,456 @@ static void noinline __kprobes bogus_32b
4352         show_regs(regs);
4353  }
4354
4355 +#ifdef CONFIG_PAX_PAGEEXEC
4356 +#ifdef CONFIG_PAX_DLRESOLVE
4357 +static void pax_emuplt_close(struct vm_area_struct *vma)
4358 +{
4359 +       vma->vm_mm->call_dl_resolve = 0UL;
4360 +}
4361 +
4362 +static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
4363 +{
4364 +       unsigned int *kaddr;
4365 +
4366 +       vmf->page = alloc_page(GFP_HIGHUSER);
4367 +       if (!vmf->page)
4368 +               return VM_FAULT_OOM;
4369 +
4370 +       kaddr = kmap(vmf->page);
4371 +       memset(kaddr, 0, PAGE_SIZE);
4372 +       kaddr[0] = 0x9DE3BFA8U; /* save */
4373 +       flush_dcache_page(vmf->page);
4374 +       kunmap(vmf->page);
4375 +       return VM_FAULT_MAJOR;
4376 +}
4377 +
4378 +static const struct vm_operations_struct pax_vm_ops = {
4379 +       .close = pax_emuplt_close,
4380 +       .fault = pax_emuplt_fault
4381 +};
4382 +
4383 +static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
4384 +{
4385 +       int ret;
4386 +
4387 +       vma->vm_mm = current->mm;
4388 +       vma->vm_start = addr;
4389 +       vma->vm_end = addr + PAGE_SIZE;
4390 +       vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
4391 +       vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
4392 +       vma->vm_ops = &pax_vm_ops;
4393 +
4394 +       ret = insert_vm_struct(current->mm, vma);
4395 +       if (ret)
4396 +               return ret;
4397 +
4398 +       ++current->mm->total_vm;
4399 +       return 0;
4400 +}
4401 +#endif
4402 +
4403 +/*
4404 + * PaX: decide what to do with offenders (regs->tpc = fault address)
4405 + *
4406 + * returns 1 when task should be killed
4407 + *         2 when patched PLT trampoline was detected
4408 + *         3 when unpatched PLT trampoline was detected
4409 + */
4410 +static int pax_handle_fetch_fault(struct pt_regs *regs)
4411 +{
4412 +
4413 +#ifdef CONFIG_PAX_EMUPLT
4414 +       int err;
4415 +
4416 +       do { /* PaX: patched PLT emulation #1 */
4417 +               unsigned int sethi1, sethi2, jmpl;
4418 +
4419 +               err = get_user(sethi1, (unsigned int *)regs->tpc);
4420 +               err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
4421 +               err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
4422 +
4423 +               if (err)
4424 +                       break;
4425 +
4426 +               if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
4427 +                   (sethi2 & 0xFFC00000U) == 0x03000000U &&
4428 +                   (jmpl & 0xFFFFE000U) == 0x81C06000U)
4429 +               {
4430 +                       unsigned long addr;
4431 +
4432 +                       regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
4433 +                       addr = regs->u_regs[UREG_G1];
4434 +                       addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4435 +
4436 +                       if (test_thread_flag(TIF_32BIT))
4437 +                               addr &= 0xFFFFFFFFUL;
4438 +
4439 +                       regs->tpc = addr;
4440 +                       regs->tnpc = addr+4;
4441 +                       return 2;
4442 +               }
4443 +       } while (0);
4444 +
4445 +       { /* PaX: patched PLT emulation #2 */
4446 +               unsigned int ba;
4447 +
4448 +               err = get_user(ba, (unsigned int *)regs->tpc);
4449 +
4450 +               if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
4451 +                       unsigned long addr;
4452 +
4453 +                       addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4454 +
4455 +                       if (test_thread_flag(TIF_32BIT))
4456 +                               addr &= 0xFFFFFFFFUL;
4457 +
4458 +                       regs->tpc = addr;
4459 +                       regs->tnpc = addr+4;
4460 +                       return 2;
4461 +               }
4462 +       }
4463 +
4464 +       do { /* PaX: patched PLT emulation #3 */
4465 +               unsigned int sethi, jmpl, nop;
4466 +
4467 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4468 +               err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
4469 +               err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4470 +
4471 +               if (err)
4472 +                       break;
4473 +
4474 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4475 +                   (jmpl & 0xFFFFE000U) == 0x81C06000U &&
4476 +                   nop == 0x01000000U)
4477 +               {
4478 +                       unsigned long addr;
4479 +
4480 +                       addr = (sethi & 0x003FFFFFU) << 10;
4481 +                       regs->u_regs[UREG_G1] = addr;
4482 +                       addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4483 +
4484 +                       if (test_thread_flag(TIF_32BIT))
4485 +                               addr &= 0xFFFFFFFFUL;
4486 +
4487 +                       regs->tpc = addr;
4488 +                       regs->tnpc = addr+4;
4489 +                       return 2;
4490 +               }
4491 +       } while (0);
4492 +
4493 +       do { /* PaX: patched PLT emulation #4 */
4494 +               unsigned int sethi, mov1, call, mov2;
4495 +
4496 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4497 +               err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
4498 +               err |= get_user(call, (unsigned int *)(regs->tpc+8));
4499 +               err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
4500 +
4501 +               if (err)
4502 +                       break;
4503 +
4504 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4505 +                   mov1 == 0x8210000FU &&
4506 +                   (call & 0xC0000000U) == 0x40000000U &&
4507 +                   mov2 == 0x9E100001U)
4508 +               {
4509 +                       unsigned long addr;
4510 +
4511 +                       regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
4512 +                       addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4513 +
4514 +                       if (test_thread_flag(TIF_32BIT))
4515 +                               addr &= 0xFFFFFFFFUL;
4516 +
4517 +                       regs->tpc = addr;
4518 +                       regs->tnpc = addr+4;
4519 +                       return 2;
4520 +               }
4521 +       } while (0);
4522 +
4523 +       do { /* PaX: patched PLT emulation #5 */
4524 +               unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
4525 +
4526 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4527 +               err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4528 +               err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4529 +               err |= get_user(or1, (unsigned int *)(regs->tpc+12));
4530 +               err |= get_user(or2, (unsigned int *)(regs->tpc+16));
4531 +               err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
4532 +               err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
4533 +               err |= get_user(nop, (unsigned int *)(regs->tpc+28));
4534 +
4535 +               if (err)
4536 +                       break;
4537 +
4538 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4539 +                   (sethi1 & 0xFFC00000U) == 0x03000000U &&
4540 +                   (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4541 +                   (or1 & 0xFFFFE000U) == 0x82106000U &&
4542 +                   (or2 & 0xFFFFE000U) == 0x8A116000U &&
4543 +                   sllx == 0x83287020U &&
4544 +                   jmpl == 0x81C04005U &&
4545 +                   nop == 0x01000000U)
4546 +               {
4547 +                       unsigned long addr;
4548 +
4549 +                       regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4550 +                       regs->u_regs[UREG_G1] <<= 32;
4551 +                       regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4552 +                       addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4553 +                       regs->tpc = addr;
4554 +                       regs->tnpc = addr+4;
4555 +                       return 2;
4556 +               }
4557 +       } while (0);
4558 +
4559 +       do { /* PaX: patched PLT emulation #6 */
4560 +               unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
4561 +
4562 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4563 +               err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
4564 +               err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
4565 +               err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
4566 +               err |= get_user(or, (unsigned int *)(regs->tpc+16));
4567 +               err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
4568 +               err |= get_user(nop, (unsigned int *)(regs->tpc+24));
4569 +
4570 +               if (err)
4571 +                       break;
4572 +
4573 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4574 +                   (sethi1 & 0xFFC00000U) == 0x03000000U &&
4575 +                   (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4576 +                   sllx == 0x83287020U &&
4577 +                   (or & 0xFFFFE000U) == 0x8A116000U &&
4578 +                   jmpl == 0x81C04005U &&
4579 +                   nop == 0x01000000U)
4580 +               {
4581 +                       unsigned long addr;
4582 +
4583 +                       regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
4584 +                       regs->u_regs[UREG_G1] <<= 32;
4585 +                       regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
4586 +                       addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
4587 +                       regs->tpc = addr;
4588 +                       regs->tnpc = addr+4;
4589 +                       return 2;
4590 +               }
4591 +       } while (0);
4592 +
4593 +       do { /* PaX: unpatched PLT emulation step 1 */
4594 +               unsigned int sethi, ba, nop;
4595 +
4596 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4597 +               err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4598 +               err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4599 +
4600 +               if (err)
4601 +                       break;
4602 +
4603 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4604 +                   ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
4605 +                   nop == 0x01000000U)
4606 +               {
4607 +                       unsigned long addr;
4608 +                       unsigned int save, call;
4609 +                       unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
4610 +
4611 +                       if ((ba & 0xFFC00000U) == 0x30800000U)
4612 +                               addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
4613 +                       else
4614 +                               addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4615 +
4616 +                       if (test_thread_flag(TIF_32BIT))
4617 +                               addr &= 0xFFFFFFFFUL;
4618 +
4619 +                       err = get_user(save, (unsigned int *)addr);
4620 +                       err |= get_user(call, (unsigned int *)(addr+4));
4621 +                       err |= get_user(nop, (unsigned int *)(addr+8));
4622 +                       if (err)
4623 +                               break;
4624 +
4625 +#ifdef CONFIG_PAX_DLRESOLVE
4626 +                       if (save == 0x9DE3BFA8U &&
4627 +                           (call & 0xC0000000U) == 0x40000000U &&
4628 +                           nop == 0x01000000U)
4629 +                       {
4630 +                               struct vm_area_struct *vma;
4631 +                               unsigned long call_dl_resolve;
4632 +
4633 +                               down_read(&current->mm->mmap_sem);
4634 +                               call_dl_resolve = current->mm->call_dl_resolve;
4635 +                               up_read(&current->mm->mmap_sem);
4636 +                               if (likely(call_dl_resolve))
4637 +                                       goto emulate;
4638 +
4639 +                               vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
4640 +
4641 +                               down_write(&current->mm->mmap_sem);
4642 +                               if (current->mm->call_dl_resolve) {
4643 +                                       call_dl_resolve = current->mm->call_dl_resolve;
4644 +                                       up_write(&current->mm->mmap_sem);
4645 +                                       if (vma)
4646 +                                               kmem_cache_free(vm_area_cachep, vma);
4647 +                                       goto emulate;
4648 +                               }
4649 +
4650 +                               call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
4651 +                               if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
4652 +                                       up_write(&current->mm->mmap_sem);
4653 +                                       if (vma)
4654 +                                               kmem_cache_free(vm_area_cachep, vma);
4655 +                                       return 1;
4656 +                               }
4657 +
4658 +                               if (pax_insert_vma(vma, call_dl_resolve)) {
4659 +                                       up_write(&current->mm->mmap_sem);
4660 +                                       kmem_cache_free(vm_area_cachep, vma);
4661 +                                       return 1;
4662 +                               }
4663 +
4664 +                               current->mm->call_dl_resolve = call_dl_resolve;
4665 +                               up_write(&current->mm->mmap_sem);
4666 +
4667 +emulate:
4668 +                               regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4669 +                               regs->tpc = call_dl_resolve;
4670 +                               regs->tnpc = addr+4;
4671 +                               return 3;
4672 +                       }
4673 +#endif
4674 +
4675 +                       /* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
4676 +                       if ((save & 0xFFC00000U) == 0x05000000U &&
4677 +                           (call & 0xFFFFE000U) == 0x85C0A000U &&
4678 +                           nop == 0x01000000U)
4679 +                       {
4680 +                               regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4681 +                               regs->u_regs[UREG_G2] = addr + 4;
4682 +                               addr = (save & 0x003FFFFFU) << 10;
4683 +                               addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
4684 +
4685 +                               if (test_thread_flag(TIF_32BIT))
4686 +                                       addr &= 0xFFFFFFFFUL;
4687 +
4688 +                               regs->tpc = addr;
4689 +                               regs->tnpc = addr+4;
4690 +                               return 3;
4691 +                       }
4692 +
4693 +                       /* PaX: 64-bit PLT stub */
4694 +                       err = get_user(sethi1, (unsigned int *)addr);
4695 +                       err |= get_user(sethi2, (unsigned int *)(addr+4));
4696 +                       err |= get_user(or1, (unsigned int *)(addr+8));
4697 +                       err |= get_user(or2, (unsigned int *)(addr+12));
4698 +                       err |= get_user(sllx, (unsigned int *)(addr+16));
4699 +                       err |= get_user(add, (unsigned int *)(addr+20));
4700 +                       err |= get_user(jmpl, (unsigned int *)(addr+24));
4701 +                       err |= get_user(nop, (unsigned int *)(addr+28));
4702 +                       if (err)
4703 +                               break;
4704 +
4705 +                       if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
4706 +                           (sethi2 & 0xFFC00000U) == 0x0B000000U &&
4707 +                           (or1 & 0xFFFFE000U) == 0x88112000U &&
4708 +                           (or2 & 0xFFFFE000U) == 0x8A116000U &&
4709 +                           sllx == 0x89293020U &&
4710 +                           add == 0x8A010005U &&
4711 +                           jmpl == 0x89C14000U &&
4712 +                           nop == 0x01000000U)
4713 +                       {
4714 +                               regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
4715 +                               regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
4716 +                               regs->u_regs[UREG_G4] <<= 32;
4717 +                               regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
4718 +                               regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
4719 +                               regs->u_regs[UREG_G4] = addr + 24;
4720 +                               addr = regs->u_regs[UREG_G5];
4721 +                               regs->tpc = addr;
4722 +                               regs->tnpc = addr+4;
4723 +                               return 3;
4724 +                       }
4725 +               }
4726 +       } while (0);
4727 +
4728 +#ifdef CONFIG_PAX_DLRESOLVE
4729 +       do { /* PaX: unpatched PLT emulation step 2 */
4730 +               unsigned int save, call, nop;
4731 +
4732 +               err = get_user(save, (unsigned int *)(regs->tpc-4));
4733 +               err |= get_user(call, (unsigned int *)regs->tpc);
4734 +               err |= get_user(nop, (unsigned int *)(regs->tpc+4));
4735 +               if (err)
4736 +                       break;
4737 +
4738 +               if (save == 0x9DE3BFA8U &&
4739 +                   (call & 0xC0000000U) == 0x40000000U &&
4740 +                   nop == 0x01000000U)
4741 +               {
4742 +                       unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
4743 +
4744 +                       if (test_thread_flag(TIF_32BIT))
4745 +                               dl_resolve &= 0xFFFFFFFFUL;
4746 +
4747 +                       regs->u_regs[UREG_RETPC] = regs->tpc;
4748 +                       regs->tpc = dl_resolve;
4749 +                       regs->tnpc = dl_resolve+4;
4750 +                       return 3;
4751 +               }
4752 +       } while (0);
4753 +#endif
4754 +
4755 +       do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
4756 +               unsigned int sethi, ba, nop;
4757 +
4758 +               err = get_user(sethi, (unsigned int *)regs->tpc);
4759 +               err |= get_user(ba, (unsigned int *)(regs->tpc+4));
4760 +               err |= get_user(nop, (unsigned int *)(regs->tpc+8));
4761 +
4762 +               if (err)
4763 +                       break;
4764 +
4765 +               if ((sethi & 0xFFC00000U) == 0x03000000U &&
4766 +                   (ba & 0xFFF00000U) == 0x30600000U &&
4767 +                   nop == 0x01000000U)
4768 +               {
4769 +                       unsigned long addr;
4770 +
4771 +                       addr = (sethi & 0x003FFFFFU) << 10;
4772 +                       regs->u_regs[UREG_G1] = addr;
4773 +                       addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
4774 +
4775 +                       if (test_thread_flag(TIF_32BIT))
4776 +                               addr &= 0xFFFFFFFFUL;
4777 +
4778 +                       regs->tpc = addr;
4779 +                       regs->tnpc = addr+4;
4780 +                       return 2;
4781 +               }
4782 +       } while (0);
4783 +
4784 +#endif
4785 +
4786 +       return 1;
4787 +}
4788 +
4789 +void pax_report_insns(void *pc, void *sp)
4790 +{
4791 +       unsigned long i;
4792 +
4793 +       printk(KERN_ERR "PAX: bytes at PC: ");
4794 +       for (i = 0; i < 8; i++) {
4795 +               unsigned int c;
4796 +               if (get_user(c, (unsigned int *)pc+i))
4797 +                       printk(KERN_CONT "???????? ");
4798 +               else
4799 +                       printk(KERN_CONT "%08x ", c);
4800 +       }
4801 +       printk("\n");
4802 +}
4803 +#endif
4804 +
4805  asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
4806  {
4807         struct mm_struct *mm = current->mm;
4808 @@ -312,6 +765,29 @@ asmlinkage void __kprobes do_sparc64_fau
4809         if (!vma)
4810                 goto bad_area;
4811
4812 +#ifdef CONFIG_PAX_PAGEEXEC
4813 +       /* PaX: detect ITLB misses on non-exec pages */
4814 +       if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
4815 +           !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
4816 +       {
4817 +               if (address != regs->tpc)
4818 +                       goto good_area;
4819 +
4820 +               up_read(&mm->mmap_sem);
4821 +               switch (pax_handle_fetch_fault(regs)) {
4822 +
4823 +#ifdef CONFIG_PAX_EMUPLT
4824 +               case 2:
4825 +               case 3:
4826 +                       return;
4827 +#endif
4828 +
4829 +               }
4830 +               pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
4831 +               do_group_exit(SIGKILL);
4832 +       }
4833 +#endif
4834 +
4835         /* Pure DTLB misses do not tell us whether the fault causing
4836          * load/store/atomic was a write or not, it only says that there
4837          * was no match.  So in such a case we (carefully) read the
4838 diff -urNp linux-2.6.33/arch/sparc/mm/init_32.c linux-2.6.33/arch/sparc/mm/init_32.c
4839 --- linux-2.6.33/arch/sparc/mm/init_32.c        2010-02-24 13:52:17.000000000 -0500
4840 +++ linux-2.6.33/arch/sparc/mm/init_32.c        2010-03-07 12:23:35.913649556 -0500
4841 @@ -317,6 +317,9 @@ extern void device_scan(void);
4842  pgprot_t PAGE_SHARED __read_mostly;
4843  EXPORT_SYMBOL(PAGE_SHARED);
4844
4845 +pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
4846 +EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
4847 +
4848  void __init paging_init(void)
4849  {
4850         switch(sparc_cpu_model) {
4851 @@ -345,17 +348,17 @@ void __init paging_init(void)
4852
4853         /* Initialize the protection map with non-constant, MMU dependent values. */
4854         protection_map[0] = PAGE_NONE;
4855 -       protection_map[1] = PAGE_READONLY;
4856 -       protection_map[2] = PAGE_COPY;
4857 -       protection_map[3] = PAGE_COPY;
4858 +       protection_map[1] = PAGE_READONLY_NOEXEC;
4859 +       protection_map[2] = PAGE_COPY_NOEXEC;
4860 +       protection_map[3] = PAGE_COPY_NOEXEC;
4861         protection_map[4] = PAGE_READONLY;
4862         protection_map[5] = PAGE_READONLY;
4863         protection_map[6] = PAGE_COPY;
4864         protection_map[7] = PAGE_COPY;
4865         protection_map[8] = PAGE_NONE;
4866 -       protection_map[9] = PAGE_READONLY;
4867 -       protection_map[10] = PAGE_SHARED;
4868 -       protection_map[11] = PAGE_SHARED;
4869 +       protection_map[9] = PAGE_READONLY_NOEXEC;
4870 +       protection_map[10] = PAGE_SHARED_NOEXEC;
4871 +       protection_map[11] = PAGE_SHARED_NOEXEC;
4872         protection_map[12] = PAGE_READONLY;
4873         protection_map[13] = PAGE_READONLY;
4874         protection_map[14] = PAGE_SHARED;
4875 diff -urNp linux-2.6.33/arch/sparc/mm/Makefile linux-2.6.33/arch/sparc/mm/Makefile
4876 --- linux-2.6.33/arch/sparc/mm/Makefile 2010-02-24 13:52:17.000000000 -0500
4877 +++ linux-2.6.33/arch/sparc/mm/Makefile 2010-03-07 12:23:35.913649556 -0500
4878 @@ -2,7 +2,7 @@
4879  #
4880
4881  asflags-y := -ansi
4882 -ccflags-y := -Werror
4883 +#ccflags-y := -Werror
4884
4885  obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
4886  obj-y                   += fault_$(BITS).o
4887 diff -urNp linux-2.6.33/arch/sparc/mm/srmmu.c linux-2.6.33/arch/sparc/mm/srmmu.c
4888 --- linux-2.6.33/arch/sparc/mm/srmmu.c  2010-02-24 13:52:17.000000000 -0500
4889 +++ linux-2.6.33/arch/sparc/mm/srmmu.c  2010-03-07 12:23:35.913649556 -0500
4890 @@ -2198,6 +2198,13 @@ void __init ld_mmu_srmmu(void)
4891         PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
4892         BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
4893         BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
4894 +
4895 +#ifdef CONFIG_PAX_PAGEEXEC
4896 +       PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
4897 +       BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
4898 +       BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
4899 +#endif
4900 +
4901         BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
4902         page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
4903
4904 diff -urNp linux-2.6.33/arch/um/include/asm/kmap_types.h linux-2.6.33/arch/um/include/asm/kmap_types.h
4905 --- linux-2.6.33/arch/um/include/asm/kmap_types.h       2010-02-24 13:52:17.000000000 -0500
4906 +++ linux-2.6.33/arch/um/include/asm/kmap_types.h       2010-03-07 12:23:35.913649556 -0500
4907 @@ -23,6 +23,7 @@ enum km_type {
4908         KM_IRQ1,
4909         KM_SOFTIRQ0,
4910         KM_SOFTIRQ1,
4911 +       KM_CLEARPAGE,
4912         KM_TYPE_NR
4913  };
4914
4915 diff -urNp linux-2.6.33/arch/um/include/asm/page.h linux-2.6.33/arch/um/include/asm/page.h
4916 --- linux-2.6.33/arch/um/include/asm/page.h     2010-02-24 13:52:17.000000000 -0500
4917 +++ linux-2.6.33/arch/um/include/asm/page.h     2010-03-07 12:23:35.913649556 -0500
4918 @@ -14,6 +14,9 @@
4919  #define PAGE_SIZE      (_AC(1, UL) << PAGE_SHIFT)
4920  #define PAGE_MASK      (~(PAGE_SIZE-1))
4921
4922 +#define ktla_ktva(addr)                        (addr)
4923 +#define ktva_ktla(addr)                        (addr)
4924 +
4925  #ifndef __ASSEMBLY__
4926
4927  struct page;
4928 diff -urNp linux-2.6.33/arch/um/sys-i386/syscalls.c linux-2.6.33/arch/um/sys-i386/syscalls.c
4929 --- linux-2.6.33/arch/um/sys-i386/syscalls.c    2010-02-24 13:52:17.000000000 -0500
4930 +++ linux-2.6.33/arch/um/sys-i386/syscalls.c    2010-03-07 12:23:35.913649556 -0500
4931 @@ -11,6 +11,21 @@
4932  #include "asm/uaccess.h"
4933  #include "asm/unistd.h"
4934
4935 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
4936 +{
4937 +       unsigned long pax_task_size = TASK_SIZE;
4938 +
4939 +#ifdef CONFIG_PAX_SEGMEXEC
4940 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
4941 +               pax_task_size = SEGMEXEC_TASK_SIZE;
4942 +#endif
4943 +
4944 +       if (len > pax_task_size || addr > pax_task_size - len)
4945 +               return -EINVAL;
4946 +
4947 +       return 0;
4948 +}
4949 +
4950  /*
4951   * Perform the select(nd, in, out, ex, tv) and mmap() system
4952   * calls. Linux/i386 didn't use to be able to handle more than
4953 diff -urNp linux-2.6.33/arch/x86/boot/bitops.h linux-2.6.33/arch/x86/boot/bitops.h
4954 --- linux-2.6.33/arch/x86/boot/bitops.h 2010-02-24 13:52:17.000000000 -0500
4955 +++ linux-2.6.33/arch/x86/boot/bitops.h 2010-03-07 12:23:35.913649556 -0500
4956 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int
4957         u8 v;
4958         const u32 *p = (const u32 *)addr;
4959
4960 -       asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
4961 +       asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
4962         return v;
4963  }
4964
4965 @@ -37,7 +37,7 @@ static inline int variable_test_bit(int
4966
4967  static inline void set_bit(int nr, void *addr)
4968  {
4969 -       asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
4970 +       asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
4971  }
4972
4973  #endif /* BOOT_BITOPS_H */
4974 diff -urNp linux-2.6.33/arch/x86/boot/boot.h linux-2.6.33/arch/x86/boot/boot.h
4975 --- linux-2.6.33/arch/x86/boot/boot.h   2010-02-24 13:52:17.000000000 -0500
4976 +++ linux-2.6.33/arch/x86/boot/boot.h   2010-03-07 12:23:35.913649556 -0500
4977 @@ -82,7 +82,7 @@ static inline void io_delay(void)
4978  static inline u16 ds(void)
4979  {
4980         u16 seg;
4981 -       asm("movw %%ds,%0" : "=rm" (seg));
4982 +       asm volatile("movw %%ds,%0" : "=rm" (seg));
4983         return seg;
4984  }
4985
4986 @@ -178,7 +178,7 @@ static inline void wrgs32(u32 v, addr_t
4987  static inline int memcmp(const void *s1, const void *s2, size_t len)
4988  {
4989         u8 diff;
4990 -       asm("repe; cmpsb; setnz %0"
4991 +       asm volatile("repe; cmpsb; setnz %0"
4992             : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
4993         return diff;
4994  }
4995 diff -urNp linux-2.6.33/arch/x86/boot/compressed/head_32.S linux-2.6.33/arch/x86/boot/compressed/head_32.S
4996 --- linux-2.6.33/arch/x86/boot/compressed/head_32.S     2010-02-24 13:52:17.000000000 -0500
4997 +++ linux-2.6.33/arch/x86/boot/compressed/head_32.S     2010-03-07 12:23:35.913649556 -0500
4998 @@ -76,7 +76,7 @@ ENTRY(startup_32)
4999         notl    %eax
5000         andl    %eax, %ebx
5001  #else
5002 -       movl    $LOAD_PHYSICAL_ADDR, %ebx
5003 +       movl    $____LOAD_PHYSICAL_ADDR, %ebx
5004  #endif
5005
5006         /* Target address to relocate to for decompression */
5007 @@ -149,7 +149,7 @@ relocated:
5008   * and where it was actually loaded.
5009   */
5010         movl    %ebp, %ebx
5011 -       subl    $LOAD_PHYSICAL_ADDR, %ebx
5012 +       subl    $____LOAD_PHYSICAL_ADDR, %ebx
5013         jz      2f      /* Nothing to be done if loaded at compiled addr. */
5014  /*
5015   * Process relocations.
5016 @@ -157,8 +157,7 @@ relocated:
5017
5018  1:     subl    $4, %edi
5019         movl    (%edi), %ecx
5020 -       testl   %ecx, %ecx
5021 -       jz      2f
5022 +       jecxz   2f
5023         addl    %ebx, -__PAGE_OFFSET(%ebx, %ecx)
5024         jmp     1b
5025  2:
5026 diff -urNp linux-2.6.33/arch/x86/boot/compressed/head_64.S linux-2.6.33/arch/x86/boot/compressed/head_64.S
5027 --- linux-2.6.33/arch/x86/boot/compressed/head_64.S     2010-02-24 13:52:17.000000000 -0500
5028 +++ linux-2.6.33/arch/x86/boot/compressed/head_64.S     2010-03-07 12:23:35.913649556 -0500
5029 @@ -91,7 +91,7 @@ ENTRY(startup_32)
5030         notl    %eax
5031         andl    %eax, %ebx
5032  #else
5033 -       movl    $LOAD_PHYSICAL_ADDR, %ebx
5034 +       movl    $____LOAD_PHYSICAL_ADDR, %ebx
5035  #endif
5036
5037         /* Target address to relocate to for decompression */
5038 @@ -233,7 +233,7 @@ ENTRY(startup_64)
5039         notq    %rax
5040         andq    %rax, %rbp
5041  #else
5042 -       movq    $LOAD_PHYSICAL_ADDR, %rbp
5043 +       movq    $____LOAD_PHYSICAL_ADDR, %rbp
5044  #endif
5045
5046         /* Target address to relocate to for decompression */
5047 diff -urNp linux-2.6.33/arch/x86/boot/compressed/misc.c linux-2.6.33/arch/x86/boot/compressed/misc.c
5048 --- linux-2.6.33/arch/x86/boot/compressed/misc.c        2010-02-24 13:52:17.000000000 -0500
5049 +++ linux-2.6.33/arch/x86/boot/compressed/misc.c        2010-03-07 12:23:35.913649556 -0500
5050 @@ -292,7 +292,7 @@ static void parse_elf(void *output)
5051                 case PT_LOAD:
5052  #ifdef CONFIG_RELOCATABLE
5053                         dest = output;
5054 -                       dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
5055 +                       dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
5056  #else
5057                         dest = (void *)(phdr->p_paddr);
5058  #endif
5059 @@ -339,7 +339,7 @@ asmlinkage void decompress_kernel(void *
5060                 error("Destination address too large");
5061  #endif
5062  #ifndef CONFIG_RELOCATABLE
5063 -       if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
5064 +       if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
5065                 error("Wrong destination address");
5066  #endif
5067
5068 diff -urNp linux-2.6.33/arch/x86/boot/compressed/mkpiggy.c linux-2.6.33/arch/x86/boot/compressed/mkpiggy.c
5069 --- linux-2.6.33/arch/x86/boot/compressed/mkpiggy.c     2010-02-24 13:52:17.000000000 -0500
5070 +++ linux-2.6.33/arch/x86/boot/compressed/mkpiggy.c     2010-03-07 12:23:35.913649556 -0500
5071 @@ -74,7 +74,7 @@ int main(int argc, char *argv[])
5072
5073         offs = (olen > ilen) ? olen - ilen : 0;
5074         offs += olen >> 12;     /* Add 8 bytes for each 32K block */
5075 -       offs += 32*1024 + 18;   /* Add 32K + 18 bytes slack */
5076 +       offs += 64*1024;        /* Add 64K bytes slack */
5077         offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
5078
5079         printf(".section \".rodata.compressed\",\"a\",@progbits\n");
5080 diff -urNp linux-2.6.33/arch/x86/boot/compressed/relocs.c linux-2.6.33/arch/x86/boot/compressed/relocs.c
5081 --- linux-2.6.33/arch/x86/boot/compressed/relocs.c      2010-02-24 13:52:17.000000000 -0500
5082 +++ linux-2.6.33/arch/x86/boot/compressed/relocs.c      2010-03-07 12:23:35.917681499 -0500
5083 @@ -13,8 +13,11 @@
5084
5085  static void die(char *fmt, ...);
5086
5087 +#include "../../../../include/generated/autoconf.h"
5088 +
5089  #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
5090  static Elf32_Ehdr ehdr;
5091 +static Elf32_Phdr *phdr;
5092  static unsigned long reloc_count, reloc_idx;
5093  static unsigned long *relocs;
5094
5095 @@ -270,9 +273,39 @@ static void read_ehdr(FILE *fp)
5096         }
5097  }
5098
5099 +static void read_phdrs(FILE *fp)
5100 +{
5101 +       unsigned int i;
5102 +
5103 +       phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
5104 +       if (!phdr) {
5105 +               die("Unable to allocate %d program headers\n",
5106 +                   ehdr.e_phnum);
5107 +       }
5108 +       if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
5109 +               die("Seek to %d failed: %s\n",
5110 +                       ehdr.e_phoff, strerror(errno));
5111 +       }
5112 +       if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
5113 +               die("Cannot read ELF program headers: %s\n",
5114 +                       strerror(errno));
5115 +       }
5116 +       for(i = 0; i < ehdr.e_phnum; i++) {
5117 +               phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
5118 +               phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
5119 +               phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
5120 +               phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
5121 +               phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
5122 +               phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
5123 +               phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
5124 +               phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
5125 +       }
5126 +
5127 +}
5128 +
5129  static void read_shdrs(FILE *fp)
5130  {
5131 -       int i;
5132 +       unsigned int i;
5133         Elf32_Shdr shdr;
5134
5135         secs = calloc(ehdr.e_shnum, sizeof(struct section));
5136 @@ -307,7 +340,7 @@ static void read_shdrs(FILE *fp)
5137
5138  static void read_strtabs(FILE *fp)
5139  {
5140 -       int i;
5141 +       unsigned int i;
5142         for (i = 0; i < ehdr.e_shnum; i++) {
5143                 struct section *sec = &secs[i];
5144                 if (sec->shdr.sh_type != SHT_STRTAB) {
5145 @@ -332,7 +365,7 @@ static void read_strtabs(FILE *fp)
5146
5147  static void read_symtabs(FILE *fp)
5148  {
5149 -       int i,j;
5150 +       unsigned int i,j;
5151         for (i = 0; i < ehdr.e_shnum; i++) {
5152                 struct section *sec = &secs[i];
5153                 if (sec->shdr.sh_type != SHT_SYMTAB) {
5154 @@ -365,7 +398,9 @@ static void read_symtabs(FILE *fp)
5155
5156  static void read_relocs(FILE *fp)
5157  {
5158 -       int i,j;
5159 +       unsigned int i,j;
5160 +       uint32_t base;
5161 +
5162         for (i = 0; i < ehdr.e_shnum; i++) {
5163                 struct section *sec = &secs[i];
5164                 if (sec->shdr.sh_type != SHT_REL) {
5165 @@ -385,9 +420,18 @@ static void read_relocs(FILE *fp)
5166                         die("Cannot read symbol table: %s\n",
5167                                 strerror(errno));
5168                 }
5169 +               base = 0;
5170 +               for (j = 0; j < ehdr.e_phnum; j++) {
5171 +                       if (phdr[j].p_type != PT_LOAD )
5172 +                               continue;
5173 +                       if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
5174 +                               continue;
5175 +                       base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
5176 +                       break;
5177 +               }
5178                 for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
5179                         Elf32_Rel *rel = &sec->reltab[j];
5180 -                       rel->r_offset = elf32_to_cpu(rel->r_offset);
5181 +                       rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
5182                         rel->r_info   = elf32_to_cpu(rel->r_info);
5183                 }
5184         }
5185 @@ -396,14 +440,14 @@ static void read_relocs(FILE *fp)
5186
5187  static void print_absolute_symbols(void)
5188  {
5189 -       int i;
5190 +       unsigned int i;
5191         printf("Absolute symbols\n");
5192         printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
5193         for (i = 0; i < ehdr.e_shnum; i++) {
5194                 struct section *sec = &secs[i];
5195                 char *sym_strtab;
5196                 Elf32_Sym *sh_symtab;
5197 -               int j;
5198 +               unsigned int j;
5199
5200                 if (sec->shdr.sh_type != SHT_SYMTAB) {
5201                         continue;
5202 @@ -431,14 +475,14 @@ static void print_absolute_symbols(void)
5203
5204  static void print_absolute_relocs(void)
5205  {
5206 -       int i, printed = 0;
5207 +       unsigned int i, printed = 0;
5208
5209         for (i = 0; i < ehdr.e_shnum; i++) {
5210                 struct section *sec = &secs[i];
5211                 struct section *sec_applies, *sec_symtab;
5212                 char *sym_strtab;
5213                 Elf32_Sym *sh_symtab;
5214 -               int j;
5215 +               unsigned int j;
5216                 if (sec->shdr.sh_type != SHT_REL) {
5217                         continue;
5218                 }
5219 @@ -499,13 +543,13 @@ static void print_absolute_relocs(void)
5220
5221  static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
5222  {
5223 -       int i;
5224 +       unsigned int i;
5225         /* Walk through the relocations */
5226         for (i = 0; i < ehdr.e_shnum; i++) {
5227                 char *sym_strtab;
5228                 Elf32_Sym *sh_symtab;
5229                 struct section *sec_applies, *sec_symtab;
5230 -               int j;
5231 +               unsigned int j;
5232                 struct section *sec = &secs[i];
5233
5234                 if (sec->shdr.sh_type != SHT_REL) {
5235 @@ -530,6 +574,22 @@ static void walk_relocs(void (*visit)(El
5236                             !is_rel_reloc(sym_name(sym_strtab, sym))) {
5237                                 continue;
5238                         }
5239 +                       /* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
5240 +                       if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
5241 +                               continue;
5242 +
5243 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
5244 +                       /* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
5245 +                       if (!strcmp(sec_name(sym->st_shndx), ".data") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
5246 +                               continue;
5247 +                       if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
5248 +                               continue;
5249 +                       if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
5250 +                               continue;
5251 +                       if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
5252 +                               continue;
5253 +#endif
5254 +
5255                         switch (r_type) {
5256                         case R_386_NONE:
5257                         case R_386_PC32:
5258 @@ -571,7 +631,7 @@ static int cmp_relocs(const void *va, co
5259
5260  static void emit_relocs(int as_text)
5261  {
5262 -       int i;
5263 +       unsigned int i;
5264         /* Count how many relocations I have and allocate space for them. */
5265         reloc_count = 0;
5266         walk_relocs(count_reloc);
5267 @@ -665,6 +725,7 @@ int main(int argc, char **argv)
5268                         fname, strerror(errno));
5269         }
5270         read_ehdr(fp);
5271 +       read_phdrs(fp);
5272         read_shdrs(fp);
5273         read_strtabs(fp);
5274         read_symtabs(fp);
5275 diff -urNp linux-2.6.33/arch/x86/boot/cpucheck.c linux-2.6.33/arch/x86/boot/cpucheck.c
5276 --- linux-2.6.33/arch/x86/boot/cpucheck.c       2010-02-24 13:52:17.000000000 -0500
5277 +++ linux-2.6.33/arch/x86/boot/cpucheck.c       2010-03-07 12:23:35.917681499 -0500
5278 @@ -74,7 +74,7 @@ static int has_fpu(void)
5279         u16 fcw = -1, fsw = -1;
5280         u32 cr0;
5281
5282 -       asm("movl %%cr0,%0" : "=r" (cr0));
5283 +       asm volatile("movl %%cr0,%0" : "=r" (cr0));
5284         if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
5285                 cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
5286                 asm volatile("movl %0,%%cr0" : : "r" (cr0));
5287 @@ -90,7 +90,7 @@ static int has_eflag(u32 mask)
5288  {
5289         u32 f0, f1;
5290
5291 -       asm("pushfl ; "
5292 +       asm volatile("pushfl ; "
5293             "pushfl ; "
5294             "popl %0 ; "
5295             "movl %0,%1 ; "
5296 @@ -115,7 +115,7 @@ static void get_flags(void)
5297                 set_bit(X86_FEATURE_FPU, cpu.flags);
5298
5299         if (has_eflag(X86_EFLAGS_ID)) {
5300 -               asm("cpuid"
5301 +               asm volatile("cpuid"
5302                     : "=a" (max_intel_level),
5303                       "=b" (cpu_vendor[0]),
5304                       "=d" (cpu_vendor[1]),
5305 @@ -124,7 +124,7 @@ static void get_flags(void)
5306
5307                 if (max_intel_level >= 0x00000001 &&
5308                     max_intel_level <= 0x0000ffff) {
5309 -                       asm("cpuid"
5310 +                       asm volatile("cpuid"
5311                             : "=a" (tfms),
5312                               "=c" (cpu.flags[4]),
5313                               "=d" (cpu.flags[0])
5314 @@ -136,7 +136,7 @@ static void get_flags(void)
5315                                 cpu.model += ((tfms >> 16) & 0xf) << 4;
5316                 }
5317
5318 -               asm("cpuid"
5319 +               asm volatile("cpuid"
5320                     : "=a" (max_amd_level)
5321                     : "a" (0x80000000)
5322                     : "ebx", "ecx", "edx");
5323 @@ -144,7 +144,7 @@ static void get_flags(void)
5324                 if (max_amd_level >= 0x80000001 &&
5325                     max_amd_level <= 0x8000ffff) {
5326                         u32 eax = 0x80000001;
5327 -                       asm("cpuid"
5328 +                       asm volatile("cpuid"
5329                             : "+a" (eax),
5330                               "=c" (cpu.flags[6]),
5331                               "=d" (cpu.flags[1])
5332 @@ -203,9 +203,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5333                 u32 ecx = MSR_K7_HWCR;
5334                 u32 eax, edx;
5335
5336 -               asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5337 +               asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5338                 eax &= ~(1 << 15);
5339 -               asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5340 +               asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5341
5342                 get_flags();    /* Make sure it really did something */
5343                 err = check_flags();
5344 @@ -218,9 +218,9 @@ int check_cpu(int *cpu_level_ptr, int *r
5345                 u32 ecx = MSR_VIA_FCR;
5346                 u32 eax, edx;
5347
5348 -               asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5349 +               asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5350                 eax |= (1<<1)|(1<<7);
5351 -               asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5352 +               asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5353
5354                 set_bit(X86_FEATURE_CX8, cpu.flags);
5355                 err = check_flags();
5356 @@ -231,12 +231,12 @@ int check_cpu(int *cpu_level_ptr, int *r
5357                 u32 eax, edx;
5358                 u32 level = 1;
5359
5360 -               asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5361 -               asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5362 -               asm("cpuid"
5363 +               asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
5364 +               asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
5365 +               asm volatile("cpuid"
5366                     : "+a" (level), "=d" (cpu.flags[0])
5367                     : : "ecx", "ebx");
5368 -               asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5369 +               asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
5370
5371                 err = check_flags();
5372         }
5373 diff -urNp linux-2.6.33/arch/x86/boot/header.S linux-2.6.33/arch/x86/boot/header.S
5374 --- linux-2.6.33/arch/x86/boot/header.S 2010-02-24 13:52:17.000000000 -0500
5375 +++ linux-2.6.33/arch/x86/boot/header.S 2010-03-07 12:23:35.917681499 -0500
5376 @@ -224,7 +224,7 @@ setup_data:         .quad 0                 # 64-bit physical
5377                                                 # single linked list of
5378                                                 # struct setup_data
5379
5380 -pref_address:          .quad LOAD_PHYSICAL_ADDR        # preferred load addr
5381 +pref_address:          .quad ____LOAD_PHYSICAL_ADDR    # preferred load addr
5382
5383  #define ZO_INIT_SIZE   (ZO__end - ZO_startup_32 + ZO_z_extract_offset)
5384  #define VO_INIT_SIZE   (VO__end - VO__text)
5385 diff -urNp linux-2.6.33/arch/x86/boot/video-vesa.c linux-2.6.33/arch/x86/boot/video-vesa.c
5386 --- linux-2.6.33/arch/x86/boot/video-vesa.c     2010-02-24 13:52:17.000000000 -0500
5387 +++ linux-2.6.33/arch/x86/boot/video-vesa.c     2010-03-07 12:23:35.917681499 -0500
5388 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
5389
5390         boot_params.screen_info.vesapm_seg = oreg.es;
5391         boot_params.screen_info.vesapm_off = oreg.di;
5392 +       boot_params.screen_info.vesapm_size = oreg.cx;
5393  }
5394
5395  /*
5396 diff -urNp linux-2.6.33/arch/x86/ia32/ia32_signal.c linux-2.6.33/arch/x86/ia32/ia32_signal.c
5397 --- linux-2.6.33/arch/x86/ia32/ia32_signal.c    2010-02-24 13:52:17.000000000 -0500
5398 +++ linux-2.6.33/arch/x86/ia32/ia32_signal.c    2010-03-07 12:23:35.917681499 -0500
5399 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct
5400         sp -= frame_size;
5401         /* Align the stack pointer according to the i386 ABI,
5402          * i.e. so that on function entry ((sp + 4) & 15) == 0. */
5403 -       sp = ((sp + 4) & -16ul) - 4;
5404 +       sp = ((sp - 12) & -16ul) - 4;
5405         return (void __user *) sp;
5406  }
5407
5408 @@ -503,7 +503,7 @@ int ia32_setup_rt_frame(int sig, struct
5409                 0xb8,
5410                 __NR_ia32_rt_sigreturn,
5411                 0x80cd,
5412 -               0,
5413 +               0
5414         };
5415
5416         frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
5417 diff -urNp linux-2.6.33/arch/x86/include/asm/alternative.h linux-2.6.33/arch/x86/include/asm/alternative.h
5418 --- linux-2.6.33/arch/x86/include/asm/alternative.h     2010-02-24 13:52:17.000000000 -0500
5419 +++ linux-2.6.33/arch/x86/include/asm/alternative.h     2010-03-07 12:23:35.917681499 -0500
5420 @@ -86,7 +86,7 @@ static inline void alternatives_smp_swit
5421        "         .byte 664f-663f\n"                     /* replacementlen  */   \
5422        "         .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */   \
5423        ".previous\n"                                                    \
5424 -      ".section .altinstr_replacement, \"ax\"\n"                       \
5425 +      ".section .altinstr_replacement, \"a\"\n"                        \
5426        "663:\n\t" newinstr "\n664:\n"           /* replacement     */   \
5427        ".previous"
5428
5429 diff -urNp linux-2.6.33/arch/x86/include/asm/apm.h linux-2.6.33/arch/x86/include/asm/apm.h
5430 --- linux-2.6.33/arch/x86/include/asm/apm.h     2010-02-24 13:52:17.000000000 -0500
5431 +++ linux-2.6.33/arch/x86/include/asm/apm.h     2010-03-07 12:23:35.917681499 -0500
5432 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
5433         __asm__ __volatile__(APM_DO_ZERO_SEGS
5434                 "pushl %%edi\n\t"
5435                 "pushl %%ebp\n\t"
5436 -               "lcall *%%cs:apm_bios_entry\n\t"
5437 +               "lcall *%%ss:apm_bios_entry\n\t"
5438                 "setc %%al\n\t"
5439                 "popl %%ebp\n\t"
5440                 "popl %%edi\n\t"
5441 @@ -58,7 +58,7 @@ static inline u8 apm_bios_call_simple_as
5442         __asm__ __volatile__(APM_DO_ZERO_SEGS
5443                 "pushl %%edi\n\t"
5444                 "pushl %%ebp\n\t"
5445 -               "lcall *%%cs:apm_bios_entry\n\t"
5446 +               "lcall *%%ss:apm_bios_entry\n\t"
5447                 "setc %%bl\n\t"
5448                 "popl %%ebp\n\t"
5449                 "popl %%edi\n\t"
5450 diff -urNp linux-2.6.33/arch/x86/include/asm/atomic_32.h linux-2.6.33/arch/x86/include/asm/atomic_32.h
5451 --- linux-2.6.33/arch/x86/include/asm/atomic_32.h       2010-02-24 13:52:17.000000000 -0500
5452 +++ linux-2.6.33/arch/x86/include/asm/atomic_32.h       2010-03-07 12:23:35.917681499 -0500
5453 @@ -25,6 +25,17 @@ static inline int atomic_read(const atom
5454  }
5455
5456  /**
5457 + * atomic_read_unchecked - read atomic variable
5458 + * @v: pointer of type atomic_unchecked_t
5459 + *
5460 + * Atomically reads the value of @v.
5461 + */
5462 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5463 +{
5464 +       return v->counter;
5465 +}
5466 +
5467 +/**
5468   * atomic_set - set atomic variable
5469   * @v: pointer of type atomic_t
5470   * @i: required value
5471 @@ -37,6 +48,18 @@ static inline void atomic_set(atomic_t *
5472  }
5473
5474  /**
5475 + * atomic_set_unchecked - set atomic variable
5476 + * @v: pointer of type atomic_unchecked_t
5477 + * @i: required value
5478 + *
5479 + * Atomically sets the value of @v to @i.
5480 + */
5481 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5482 +{
5483 +       v->counter = i;
5484 +}
5485 +
5486 +/**
5487   * atomic_add - add integer to atomic variable
5488   * @i: integer value to add
5489   * @v: pointer of type atomic_t
5490 @@ -45,7 +68,29 @@ static inline void atomic_set(atomic_t *
5491   */
5492  static inline void atomic_add(int i, atomic_t *v)
5493  {
5494 -       asm volatile(LOCK_PREFIX "addl %1,%0"
5495 +       asm volatile(LOCK_PREFIX "addl %1,%0\n"
5496 +
5497 +#ifdef CONFIG_PAX_REFCOUNT
5498 +                    "jno 0f\n"
5499 +                    LOCK_PREFIX "subl %1,%0\n"
5500 +                    "into\n0:\n"
5501 +                    _ASM_EXTABLE(0b, 0b)
5502 +#endif
5503 +
5504 +                    : "+m" (v->counter)
5505 +                    : "ir" (i));
5506 +}
5507 +
5508 +/**
5509 + * atomic_add_unchecked - add integer to atomic variable
5510 + * @i: integer value to add
5511 + * @v: pointer of type atomic_unchecked_t
5512 + *
5513 + * Atomically adds @i to @v.
5514 + */
5515 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
5516 +{
5517 +       asm volatile(LOCK_PREFIX "addl %1,%0\n"
5518                      : "+m" (v->counter)
5519                      : "ir" (i));
5520  }
5521 @@ -59,7 +104,29 @@ static inline void atomic_add(int i, ato
5522   */
5523  static inline void atomic_sub(int i, atomic_t *v)
5524  {
5525 -       asm volatile(LOCK_PREFIX "subl %1,%0"
5526 +       asm volatile(LOCK_PREFIX "subl %1,%0\n"
5527 +
5528 +#ifdef CONFIG_PAX_REFCOUNT
5529 +                    "jno 0f\n"
5530 +                    LOCK_PREFIX "addl %1,%0\n"
5531 +                    "into\n0:\n"
5532 +                    _ASM_EXTABLE(0b, 0b)
5533 +#endif
5534 +
5535 +                    : "+m" (v->counter)
5536 +                    : "ir" (i));
5537 +}
5538 +
5539 +/**
5540 + * atomic_sub_unchecked - subtract integer from atomic variable
5541 + * @i: integer value to subtract
5542 + * @v: pointer of type atomic_t
5543 + *
5544 + * Atomically subtracts @i from @v.
5545 + */
5546 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
5547 +{
5548 +       asm volatile(LOCK_PREFIX "subl %1,%0\n"
5549                      : "+m" (v->counter)
5550                      : "ir" (i));
5551  }
5552 @@ -77,7 +144,16 @@ static inline int atomic_sub_and_test(in
5553  {
5554         unsigned char c;
5555
5556 -       asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
5557 +       asm volatile(LOCK_PREFIX "subl %2,%0\n"
5558 +
5559 +#ifdef CONFIG_PAX_REFCOUNT
5560 +                    "jno 0f\n"
5561 +                    LOCK_PREFIX "addl %2,%0\n"
5562 +                    "into\n0:\n"
5563 +                    _ASM_EXTABLE(0b, 0b)
5564 +#endif
5565 +
5566 +                    "sete %1\n"
5567                      : "+m" (v->counter), "=qm" (c)
5568                      : "ir" (i) : "memory");
5569         return c;
5570 @@ -91,7 +167,30 @@ static inline int atomic_sub_and_test(in
5571   */
5572  static inline void atomic_inc(atomic_t *v)
5573  {
5574 -       asm volatile(LOCK_PREFIX "incl %0"
5575 +       asm volatile(LOCK_PREFIX "incl %0\n"
5576 +
5577 +#ifdef CONFIG_PAX_REFCOUNT
5578 +                    "into\n0:\n"
5579 +                    ".pushsection .fixup,\"ax\"\n"
5580 +                    "1:\n"
5581 +                    LOCK_PREFIX "decl %0\n"
5582 +                    "jmp 0b\n"
5583 +                    ".popsection\n"
5584 +                    _ASM_EXTABLE(0b, 1b)
5585 +#endif
5586 +
5587 +                    : "+m" (v->counter));
5588 +}
5589 +
5590 +/**
5591 + * atomic_inc_unchecked - increment atomic variable
5592 + * @v: pointer of type atomic_unchecked_t
5593 + *
5594 + * Atomically increments @v by 1.
5595 + */
5596 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5597 +{
5598 +       asm volatile(LOCK_PREFIX "incl %0\n"
5599                      : "+m" (v->counter));
5600  }
5601
5602 @@ -103,7 +202,18 @@ static inline void atomic_inc(atomic_t *
5603   */
5604  static inline void atomic_dec(atomic_t *v)
5605  {
5606 -       asm volatile(LOCK_PREFIX "decl %0"
5607 +       asm volatile(LOCK_PREFIX "decl %0\n"
5608 +
5609 +#ifdef CONFIG_PAX_REFCOUNT
5610 +                    "into\n0:\n"
5611 +                    ".pushsection .fixup,\"ax\"\n"
5612 +                    "1: \n"
5613 +                    LOCK_PREFIX "incl %0\n"
5614 +                    "jmp 0b\n"
5615 +                    ".popsection\n"
5616 +                    _ASM_EXTABLE(0b, 1b)
5617 +#endif
5618 +
5619                      : "+m" (v->counter));
5620  }
5621
5622 @@ -119,7 +229,19 @@ static inline int atomic_dec_and_test(at
5623  {
5624         unsigned char c;
5625
5626 -       asm volatile(LOCK_PREFIX "decl %0; sete %1"
5627 +       asm volatile(LOCK_PREFIX "decl %0\n"
5628 +
5629 +#ifdef CONFIG_PAX_REFCOUNT
5630 +                    "into\n0:\n"
5631 +                    ".pushsection .fixup,\"ax\"\n"
5632 +                    "1: \n"
5633 +                    LOCK_PREFIX "incl %0\n"
5634 +                    "jmp 0b\n"
5635 +                    ".popsection\n"
5636 +                    _ASM_EXTABLE(0b, 1b)
5637 +#endif
5638 +
5639 +                    "sete %1\n"
5640                      : "+m" (v->counter), "=qm" (c)
5641                      : : "memory");
5642         return c != 0;
5643 @@ -137,7 +259,19 @@ static inline int atomic_inc_and_test(at
5644  {
5645         unsigned char c;
5646
5647 -       asm volatile(LOCK_PREFIX "incl %0; sete %1"
5648 +       asm volatile(LOCK_PREFIX "incl %0\n"
5649 +
5650 +#ifdef CONFIG_PAX_REFCOUNT
5651 +                    "into\n0:\n"
5652 +                    ".pushsection .fixup,\"ax\"\n"
5653 +                    "1: \n"
5654 +                    LOCK_PREFIX "decl %0\n"
5655 +                    "jmp 0b\n"
5656 +                    ".popsection\n"
5657 +                    _ASM_EXTABLE(0b, 1b)
5658 +#endif
5659 +
5660 +                    "sete %1\n"
5661                      : "+m" (v->counter), "=qm" (c)
5662                      : : "memory");
5663         return c != 0;
5664 @@ -156,7 +290,16 @@ static inline int atomic_add_negative(in
5665  {
5666         unsigned char c;
5667
5668 -       asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
5669 +       asm volatile(LOCK_PREFIX "addl %2,%0\n"
5670 +
5671 +#ifdef CONFIG_PAX_REFCOUNT
5672 +                    "jno 0f\n"
5673 +                    LOCK_PREFIX "subl %2,%0\n"
5674 +                    "into\n0:\n"
5675 +                    _ASM_EXTABLE(0b, 0b)
5676 +#endif
5677 +
5678 +                    "sets %1\n"
5679                      : "+m" (v->counter), "=qm" (c)
5680                      : "ir" (i) : "memory");
5681         return c;
5682 @@ -179,6 +322,46 @@ static inline int atomic_add_return(int
5683  #endif
5684         /* Modern 486+ processor */
5685         __i = i;
5686 +       asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
5687 +
5688 +#ifdef CONFIG_PAX_REFCOUNT
5689 +                    "jno 0f\n"
5690 +                    "movl %0, %1\n"
5691 +                    "into\n0:\n"
5692 +                    _ASM_EXTABLE(0b, 0b)
5693 +#endif
5694 +
5695 +                    : "+r" (i), "+m" (v->counter)
5696 +                    : : "memory");
5697 +       return i + __i;
5698 +
5699 +#ifdef CONFIG_M386
5700 +no_xadd: /* Legacy 386 processor */
5701 +       local_irq_save(flags);
5702 +       __i = atomic_read(v);
5703 +       atomic_set(v, i + __i);
5704 +       local_irq_restore(flags);
5705 +       return i + __i;
5706 +#endif
5707 +}
5708 +
5709 +/**
5710 + * atomic_add_return_unchecked - add integer and return
5711 + * @v: pointer of type atomic_unchecked_t
5712 + * @i: integer value to add
5713 + *
5714 + * Atomically adds @i to @v and returns @i + @v
5715 + */
5716 +static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
5717 +{
5718 +       int __i;
5719 +#ifdef CONFIG_M386
5720 +       unsigned long flags;
5721 +       if (unlikely(boot_cpu_data.x86 <= 3))
5722 +               goto no_xadd;
5723 +#endif
5724 +       /* Modern 486+ processor */
5725 +       __i = i;
5726         asm volatile(LOCK_PREFIX "xaddl %0, %1"
5727                      : "+r" (i), "+m" (v->counter)
5728                      : : "memory");
5729 @@ -227,22 +410,34 @@ static inline int atomic_xchg(atomic_t *
5730   */
5731  static inline int atomic_add_unless(atomic_t *v, int a, int u)
5732  {
5733 -       int c, old;
5734 +       int c, old, new;
5735         c = atomic_read(v);
5736         for (;;) {
5737 -               if (unlikely(c == (u)))
5738 +               if (unlikely(c == u))
5739                         break;
5740 -               old = atomic_cmpxchg((v), c, c + (a));
5741 +
5742 +               asm volatile("addl %2,%0\n"
5743 +
5744 +#ifdef CONFIG_PAX_REFCOUNT
5745 +                            "into\n0:\n"
5746 +                            _ASM_EXTABLE(0b, 0b)
5747 +#endif
5748 +
5749 +                            : "=r" (new)
5750 +                            : "0" (c), "ir" (a));
5751 +
5752 +               old = atomic_cmpxchg(v, c, new);
5753                 if (likely(old == c))
5754                         break;
5755                 c = old;
5756         }
5757 -       return c != (u);
5758 +       return c != u;
5759  }
5760
5761  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
5762
5763  #define atomic_inc_return(v)  (atomic_add_return(1, v))
5764 +#define atomic_inc_return_unchecked(v)  (atomic_add_return_unchecked(1, v))
5765  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
5766
5767  /* These are x86-specific, used by some header files */
5768 @@ -266,6 +461,14 @@ typedef struct {
5769         u64 __aligned(8) counter;
5770  } atomic64_t;
5771
5772 +#ifdef CONFIG_PAX_REFCOUNT
5773 +typedef struct {
5774 +       u64 __aligned(8) counter;
5775 +} atomic64_unchecked_t;
5776 +#else
5777 +typedef atomic64_t atomic64_unchecked_t;
5778 +#endif
5779 +
5780  #define ATOMIC64_INIT(val)     { (val) }
5781
5782  extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
5783 diff -urNp linux-2.6.33/arch/x86/include/asm/atomic_64.h linux-2.6.33/arch/x86/include/asm/atomic_64.h
5784 --- linux-2.6.33/arch/x86/include/asm/atomic_64.h       2010-02-24 13:52:17.000000000 -0500
5785 +++ linux-2.6.33/arch/x86/include/asm/atomic_64.h       2010-03-07 12:23:35.917681499 -0500
5786 @@ -24,6 +24,17 @@ static inline int atomic_read(const atom
5787  }
5788
5789  /**
5790 + * atomic_read_unchecked - read atomic variable
5791 + * @v: pointer of type atomic_unchecked_t
5792 + *
5793 + * Atomically reads the value of @v.
5794 + */
5795 +static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
5796 +{
5797 +       return v->counter;
5798 +}
5799 +
5800 +/**
5801   * atomic_set - set atomic variable
5802   * @v: pointer of type atomic_t
5803   * @i: required value
5804 @@ -36,6 +47,18 @@ static inline void atomic_set(atomic_t *
5805  }
5806
5807  /**
5808 + * atomic_set_unchecked - set atomic variable
5809 + * @v: pointer of type atomic_unchecked_t
5810 + * @i: required value
5811 + *
5812 + * Atomically sets the value of @v to @i.
5813 + */
5814 +static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
5815 +{
5816 +       v->counter = i;
5817 +}
5818 +
5819 +/**
5820   * atomic_add - add integer to atomic variable
5821   * @i: integer value to add
5822   * @v: pointer of type atomic_t
5823 @@ -44,7 +67,29 @@ static inline void atomic_set(atomic_t *
5824   */
5825  static inline void atomic_add(int i, atomic_t *v)
5826  {
5827 -       asm volatile(LOCK_PREFIX "addl %1,%0"
5828 +       asm volatile(LOCK_PREFIX "addl %1,%0\n"
5829 +
5830 +#ifdef CONFIG_PAX_REFCOUNT
5831 +                    "jno 0f\n"
5832 +                    LOCK_PREFIX "subl %1,%0\n"
5833 +                    "int $4\n0:\n"
5834 +                    _ASM_EXTABLE(0b, 0b)
5835 +#endif
5836 +
5837 +                    : "=m" (v->counter)
5838 +                    : "ir" (i), "m" (v->counter));
5839 +}
5840 +
5841 +/**
5842 + * atomic_add_unchecked - add integer to atomic variable
5843 + * @i: integer value to add
5844 + * @v: pointer of type atomic_unchecked_t
5845 + *
5846 + * Atomically adds @i to @v.
5847 + */
5848 +static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
5849 +{
5850 +       asm volatile(LOCK_PREFIX "addl %1,%0\n"
5851                      : "=m" (v->counter)
5852                      : "ir" (i), "m" (v->counter));
5853  }
5854 @@ -58,7 +103,29 @@ static inline void atomic_add(int i, ato
5855   */
5856  static inline void atomic_sub(int i, atomic_t *v)
5857  {
5858 -       asm volatile(LOCK_PREFIX "subl %1,%0"
5859 +       asm volatile(LOCK_PREFIX "subl %1,%0\n"
5860 +
5861 +#ifdef CONFIG_PAX_REFCOUNT
5862 +                    "jno 0f\n"
5863 +                    LOCK_PREFIX "addl %1,%0\n"
5864 +                    "int $4\n0:\n"
5865 +                    _ASM_EXTABLE(0b, 0b)
5866 +#endif
5867 +
5868 +                    : "=m" (v->counter)
5869 +                    : "ir" (i), "m" (v->counter));
5870 +}
5871 +
5872 +/**
5873 + * atomic_sub_unchecked - subtract the atomic variable
5874 + * @i: integer value to subtract
5875 + * @v: pointer of type atomic_unchecked_t
5876 + *
5877 + * Atomically subtracts @i from @v.
5878 + */
5879 +static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
5880 +{
5881 +       asm volatile(LOCK_PREFIX "subl %1,%0\n"
5882                      : "=m" (v->counter)
5883                      : "ir" (i), "m" (v->counter));
5884  }
5885 @@ -76,7 +143,16 @@ static inline int atomic_sub_and_test(in
5886  {
5887         unsigned char c;
5888
5889 -       asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
5890 +       asm volatile(LOCK_PREFIX "subl %2,%0\n"
5891 +
5892 +#ifdef CONFIG_PAX_REFCOUNT
5893 +                    "jno 0f\n"
5894 +                    LOCK_PREFIX "addl %2,%0\n"
5895 +                    "int $4\n0:\n"
5896 +                    _ASM_EXTABLE(0b, 0b)
5897 +#endif
5898 +
5899 +                    "sete %1\n"
5900                      : "=m" (v->counter), "=qm" (c)
5901                      : "ir" (i), "m" (v->counter) : "memory");
5902         return c;
5903 @@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
5904   */
5905  static inline void atomic_inc(atomic_t *v)
5906  {
5907 -       asm volatile(LOCK_PREFIX "incl %0"
5908 +       asm volatile(LOCK_PREFIX "incl %0\n"
5909 +
5910 +#ifdef CONFIG_PAX_REFCOUNT
5911 +                    "jno 0f\n"
5912 +                    "int $4\n0:\n"
5913 +                    ".pushsection .fixup,\"ax\"\n"
5914 +                    "1:\n"
5915 +                    LOCK_PREFIX "decl %0\n"
5916 +                    "jmp 0b\n"
5917 +                    ".popsection\n"
5918 +                    _ASM_EXTABLE(0b, 1b)
5919 +#endif
5920 +
5921 +                    : "=m" (v->counter)
5922 +                    : "m" (v->counter));
5923 +}
5924 +
5925 +/**
5926 + * atomic_inc_unchecked - increment atomic variable
5927 + * @v: pointer of type atomic_unchecked_t
5928 + *
5929 + * Atomically increments @v by 1.
5930 + */
5931 +static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
5932 +{
5933 +       asm volatile(LOCK_PREFIX "incl %0\n"
5934                      : "=m" (v->counter)
5935                      : "m" (v->counter));
5936  }
5937 @@ -103,7 +204,19 @@ static inline void atomic_inc(atomic_t *
5938   */
5939  static inline void atomic_dec(atomic_t *v)
5940  {
5941 -       asm volatile(LOCK_PREFIX "decl %0"
5942 +       asm volatile(LOCK_PREFIX "decl %0\n"
5943 +
5944 +#ifdef CONFIG_PAX_REFCOUNT
5945 +                    "jno 0f\n"
5946 +                    "int $4\n0:\n"
5947 +                    ".pushsection .fixup,\"ax\"\n"
5948 +                    "1: \n"
5949 +                    LOCK_PREFIX "incl %0\n"
5950 +                    "jmp 0b\n"
5951 +                    ".popsection\n"
5952 +                    _ASM_EXTABLE(0b, 1b)
5953 +#endif
5954 +
5955                      : "=m" (v->counter)
5956                      : "m" (v->counter));
5957  }
5958 @@ -120,7 +233,20 @@ static inline int atomic_dec_and_test(at
5959  {
5960         unsigned char c;
5961
5962 -       asm volatile(LOCK_PREFIX "decl %0; sete %1"
5963 +       asm volatile(LOCK_PREFIX "decl %0\n"
5964 +
5965 +#ifdef CONFIG_PAX_REFCOUNT
5966 +                    "jno 0f\n"
5967 +                    "int $4\n0:\n"
5968 +                    ".pushsection .fixup,\"ax\"\n"
5969 +                    "1: \n"
5970 +                    LOCK_PREFIX "incl %0\n"
5971 +                    "jmp 0b\n"
5972 +                    ".popsection\n"
5973 +                    _ASM_EXTABLE(0b, 1b)
5974 +#endif
5975 +
5976 +                    "sete %1\n"
5977                      : "=m" (v->counter), "=qm" (c)
5978                      : "m" (v->counter) : "memory");
5979         return c != 0;
5980 @@ -138,7 +264,20 @@ static inline int atomic_inc_and_test(at
5981  {
5982         unsigned char c;
5983
5984 -       asm volatile(LOCK_PREFIX "incl %0; sete %1"
5985 +       asm volatile(LOCK_PREFIX "incl %0\n"
5986 +
5987 +#ifdef CONFIG_PAX_REFCOUNT
5988 +                    "jno 0f\n"
5989 +                    "int $4\n0:\n"
5990 +                    ".pushsection .fixup,\"ax\"\n"
5991 +                    "1: \n"
5992 +                    LOCK_PREFIX "decl %0\n"
5993 +                    "jmp 0b\n"
5994 +                    ".popsection\n"
5995 +                    _ASM_EXTABLE(0b, 1b)
5996 +#endif
5997 +
5998 +                    "sete %1\n"
5999                      : "=m" (v->counter), "=qm" (c)
6000                      : "m" (v->counter) : "memory");
6001         return c != 0;
6002 @@ -157,7 +296,16 @@ static inline int atomic_add_negative(in
6003  {
6004         unsigned char c;
6005
6006 -       asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
6007 +       asm volatile(LOCK_PREFIX "addl %2,%0\n"
6008 +
6009 +#ifdef CONFIG_PAX_REFCOUNT
6010 +                    "jno 0f\n"
6011 +                    LOCK_PREFIX "subl %2,%0\n"
6012 +                    "int $4\n0:\n"
6013 +                    _ASM_EXTABLE(0b, 0b)
6014 +#endif
6015 +
6016 +                    "sets %1\n"
6017                      : "=m" (v->counter), "=qm" (c)
6018                      : "ir" (i), "m" (v->counter) : "memory");
6019         return c;
6020 @@ -173,7 +321,15 @@ static inline int atomic_add_negative(in
6021  static inline int atomic_add_return(int i, atomic_t *v)
6022  {
6023         int __i = i;
6024 -       asm volatile(LOCK_PREFIX "xaddl %0, %1"
6025 +       asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
6026 +
6027 +#ifdef CONFIG_PAX_REFCOUNT
6028 +                    "jno 0f\n"
6029 +                    "movl %0, %1\n"
6030 +                    "int $4\n0:\n"
6031 +                    _ASM_EXTABLE(0b, 0b)
6032 +#endif
6033 +
6034                      : "+r" (i), "+m" (v->counter)
6035                      : : "memory");
6036         return i + __i;
6037 @@ -204,6 +360,18 @@ static inline long atomic64_read(const a
6038  }
6039
6040  /**
6041 + * atomic64_read_unchecked - read atomic64 variable
6042 + * @v: pointer of type atomic64_unchecked_t
6043 + *
6044 + * Atomically reads the value of @v.
6045 + * Doesn't imply a read memory barrier.
6046 + */
6047 +static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
6048 +{
6049 +       return v->counter;
6050 +}
6051 +
6052 +/**
6053   * atomic64_set - set atomic64 variable
6054   * @v: pointer to type atomic64_t
6055   * @i: required value
6056 @@ -216,6 +384,18 @@ static inline void atomic64_set(atomic64
6057  }
6058
6059  /**
6060 + * atomic64_set_unchecked - set atomic64 variable
6061 + * @v: pointer to type atomic64_unchecked_t
6062 + * @i: required value
6063 + *
6064 + * Atomically sets the value of @v to @i.
6065 + */
6066 +static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
6067 +{
6068 +       v->counter = i;
6069 +}
6070 +
6071 +/**
6072   * atomic64_add - add integer to atomic64 variable
6073   * @i: integer value to add
6074   * @v: pointer to type atomic64_t
6075 @@ -224,6 +404,28 @@ static inline void atomic64_set(atomic64
6076   */
6077  static inline void atomic64_add(long i, atomic64_t *v)
6078  {
6079 +       asm volatile(LOCK_PREFIX "addq %1,%0\n"
6080 +
6081 +#ifdef CONFIG_PAX_REFCOUNT
6082 +                    "jno 0f\n"
6083 +                    LOCK_PREFIX "subq %1,%0\n"
6084 +                    "int $4\n0:\n"
6085 +                    _ASM_EXTABLE(0b, 0b)
6086 +#endif
6087 +
6088 +                    : "=m" (v->counter)
6089 +                    : "er" (i), "m" (v->counter));
6090 +}
6091 +
6092 +/**
6093 + * atomic64_add_unchecked - add integer to atomic64 variable
6094 + * @i: integer value to add
6095 + * @v: pointer to type atomic64_unchecked_t
6096 + *
6097 + * Atomically adds @i to @v.
6098 + */
6099 +static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
6100 +{
6101         asm volatile(LOCK_PREFIX "addq %1,%0"
6102                      : "=m" (v->counter)
6103                      : "er" (i), "m" (v->counter));
6104 @@ -238,7 +440,15 @@ static inline void atomic64_add(long i,
6105   */
6106  static inline void atomic64_sub(long i, atomic64_t *v)
6107  {
6108 -       asm volatile(LOCK_PREFIX "subq %1,%0"
6109 +       asm volatile(LOCK_PREFIX "subq %1,%0\n"
6110 +
6111 +#ifdef CONFIG_PAX_REFCOUNT
6112 +                    "jno 0f\n"
6113 +                    LOCK_PREFIX "addq %1,%0\n"
6114 +                    "int $4\n0:\n"
6115 +                    _ASM_EXTABLE(0b, 0b)
6116 +#endif
6117 +
6118                      : "=m" (v->counter)
6119                      : "er" (i), "m" (v->counter));
6120  }
6121 @@ -256,7 +466,16 @@ static inline int atomic64_sub_and_test(
6122  {
6123         unsigned char c;
6124
6125 -       asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
6126 +       asm volatile(LOCK_PREFIX "subq %2,%0\n"
6127 +
6128 +#ifdef CONFIG_PAX_REFCOUNT
6129 +                    "jno 0f\n"
6130 +                    LOCK_PREFIX "addq %2,%0\n"
6131 +                    "int $4\n0:\n"
6132 +                    _ASM_EXTABLE(0b, 0b)
6133 +#endif
6134 +
6135 +                    "sete %1\n"
6136                      : "=m" (v->counter), "=qm" (c)
6137                      : "er" (i), "m" (v->counter) : "memory");
6138         return c;
6139 @@ -270,6 +489,31 @@ static inline int atomic64_sub_and_test(
6140   */
6141  static inline void atomic64_inc(atomic64_t *v)
6142  {
6143 +       asm volatile(LOCK_PREFIX "incq %0\n"
6144 +
6145 +#ifdef CONFIG_PAX_REFCOUNT
6146 +                    "jno 0f\n"
6147 +                    "int $4\n0:\n"
6148 +                    ".pushsection .fixup,\"ax\"\n"
6149 +                    "1:\n"
6150 +                    LOCK_PREFIX "decq %0\n"
6151 +                    "jmp 0b\n"
6152 +                    ".popsection\n"
6153 +                    _ASM_EXTABLE(0b, 1b)
6154 +#endif
6155 +
6156 +                    : "=m" (v->counter)
6157 +                    : "m" (v->counter));
6158 +}
6159 +
6160 +/**
6161 + * atomic64_inc_unchecked - increment atomic64 variable
6162 + * @v: pointer to type atomic64_unchecked_t
6163 + *
6164 + * Atomically increments @v by 1.
6165 + */
6166 +static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
6167 +{
6168         asm volatile(LOCK_PREFIX "incq %0"
6169                      : "=m" (v->counter)
6170                      : "m" (v->counter));
6171 @@ -283,7 +527,19 @@ static inline void atomic64_inc(atomic64
6172   */
6173  static inline void atomic64_dec(atomic64_t *v)
6174  {
6175 -       asm volatile(LOCK_PREFIX "decq %0"
6176 +       asm volatile(LOCK_PREFIX "decq %0\n"
6177 +
6178 +#ifdef CONFIG_PAX_REFCOUNT
6179 +                    "jno 0f\n"
6180 +                    "int $4\n0:\n"
6181 +                    ".pushsection .fixup,\"ax\"\n"
6182 +                    "1: \n"
6183 +                    LOCK_PREFIX "incq %0\n"
6184 +                    "jmp 0b\n"
6185 +                    ".popsection\n"
6186 +                    _ASM_EXTABLE(0b, 1b)
6187 +#endif
6188 +
6189                      : "=m" (v->counter)
6190                      : "m" (v->counter));
6191  }
6192 @@ -300,7 +556,20 @@ static inline int atomic64_dec_and_test(
6193  {
6194         unsigned char c;
6195
6196 -       asm volatile(LOCK_PREFIX "decq %0; sete %1"
6197 +       asm volatile(LOCK_PREFIX "decq %0\n"
6198 +
6199 +#ifdef CONFIG_PAX_REFCOUNT
6200 +                    "jno 0f\n"
6201 +                    "int $4\n0:\n"
6202 +                    ".pushsection .fixup,\"ax\"\n"
6203 +                    "1: \n"
6204 +                    LOCK_PREFIX "incq %0\n"
6205 +                    "jmp 0b\n"
6206 +                    ".popsection\n"
6207 +                    _ASM_EXTABLE(0b, 1b)
6208 +#endif
6209 +
6210 +                    "sete %1\n"
6211                      : "=m" (v->counter), "=qm" (c)
6212                      : "m" (v->counter) : "memory");
6213         return c != 0;
6214 @@ -318,7 +587,20 @@ static inline int atomic64_inc_and_test(
6215  {
6216         unsigned char c;
6217
6218 -       asm volatile(LOCK_PREFIX "incq %0; sete %1"
6219 +       asm volatile(LOCK_PREFIX "incq %0\n"
6220 +
6221 +#ifdef CONFIG_PAX_REFCOUNT
6222 +                    "jno 0f\n"
6223 +                    "int $4\n0:\n"
6224 +                    ".pushsection .fixup,\"ax\"\n"
6225 +                    "1: \n"
6226 +                    LOCK_PREFIX "decq %0\n"
6227 +                    "jmp 0b\n"
6228 +                    ".popsection\n"
6229 +                    _ASM_EXTABLE(0b, 1b)
6230 +#endif
6231 +
6232 +                    "sete %1\n"
6233                      : "=m" (v->counter), "=qm" (c)
6234                      : "m" (v->counter) : "memory");
6235         return c != 0;
6236 @@ -337,7 +619,16 @@ static inline int atomic64_add_negative(
6237  {
6238         unsigned char c;
6239
6240 -       asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
6241 +       asm volatile(LOCK_PREFIX "addq %2,%0\n"
6242 +
6243 +#ifdef CONFIG_PAX_REFCOUNT
6244 +                    "jno 0f\n"
6245 +                    LOCK_PREFIX "subq %2,%0\n"
6246 +                    "int $4\n0:\n"
6247 +                    _ASM_EXTABLE(0b, 0b)
6248 +#endif
6249 +
6250 +                    "sets %1\n"
6251                      : "=m" (v->counter), "=qm" (c)
6252                      : "er" (i), "m" (v->counter) : "memory");
6253         return c;
6254 @@ -353,7 +644,31 @@ static inline int atomic64_add_negative(
6255  static inline long atomic64_add_return(long i, atomic64_t *v)
6256  {
6257         long __i = i;
6258 -       asm volatile(LOCK_PREFIX "xaddq %0, %1;"
6259 +       asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
6260 +
6261 +#ifdef CONFIG_PAX_REFCOUNT
6262 +                    "jno 0f\n"
6263 +                    "movq %0, %1\n"
6264 +                    "int $4\n0:\n"
6265 +                    _ASM_EXTABLE(0b, 0b)
6266 +#endif
6267 +
6268 +                    : "+r" (i), "+m" (v->counter)
6269 +                    : : "memory");
6270 +       return i + __i;
6271 +}
6272 +
6273 +/**
6274 + * atomic64_add_return_unchecked - add and return
6275 + * @i: integer value to add
6276 + * @v: pointer to type atomic64_unchecked_t
6277 + *
6278 + * Atomically adds @i to @v and returns @i + @v
6279 + */
6280 +static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
6281 +{
6282 +       long __i = i;
6283 +       asm volatile(LOCK_PREFIX "xaddq %0, %1"
6284                      : "+r" (i), "+m" (v->counter)
6285                      : : "memory");
6286         return i + __i;
6287 @@ -365,6 +680,7 @@ static inline long atomic64_sub_return(l
6288  }
6289
6290  #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
6291 +#define atomic64_inc_return_unchecked(v)  (atomic64_add_return_unchecked(1, (v)))
6292  #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
6293
6294  static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
6295 @@ -398,17 +714,29 @@ static inline long atomic_xchg(atomic_t
6296   */
6297  static inline int atomic_add_unless(atomic_t *v, int a, int u)
6298  {
6299 -       int c, old;
6300 +       int c, old, new;
6301         c = atomic_read(v);
6302         for (;;) {
6303 -               if (unlikely(c == (u)))
6304 +               if (unlikely(c == u))
6305                         break;
6306 -               old = atomic_cmpxchg((v), c, c + (a));
6307 +
6308 +               asm volatile("addl %2,%0\n"
6309 +
6310 +#ifdef CONFIG_PAX_REFCOUNT
6311 +                            "jno 0f\n"
6312 +                            "int $4\n0:\n"
6313 +                            _ASM_EXTABLE(0b, 0b)
6314 +#endif
6315 +
6316 +                            : "=r" (new)
6317 +                            : "0" (c), "ir" (a));
6318 +
6319 +               old = atomic_cmpxchg(v, c, new);
6320                 if (likely(old == c))
6321                         break;
6322                 c = old;
6323         }
6324 -       return c != (u);
6325 +       return c != u;
6326  }
6327
6328  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
6329 @@ -424,17 +752,29 @@ static inline int atomic_add_unless(atom
6330   */
6331  static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
6332  {
6333 -       long c, old;
6334 +       long c, old, new;
6335         c = atomic64_read(v);
6336         for (;;) {
6337 -               if (unlikely(c == (u)))
6338 +               if (unlikely(c == u))
6339                         break;
6340 -               old = atomic64_cmpxchg((v), c, c + (a));
6341 +
6342 +               asm volatile("addq %2,%0\n"
6343 +
6344 +#ifdef CONFIG_PAX_REFCOUNT
6345 +                            "jno 0f\n"
6346 +                            "int $4\n0:\n"
6347 +                            _ASM_EXTABLE(0b, 0b)
6348 +#endif
6349 +
6350 +                            : "=r" (new)
6351 +                            : "0" (c), "er" (a));
6352 +
6353 +               old = atomic64_cmpxchg((v), c, new);
6354                 if (likely(old == c))
6355                         break;
6356                 c = old;
6357         }
6358 -       return c != (u);
6359 +       return c != u;
6360  }
6361
6362  /**
6363 diff -urNp linux-2.6.33/arch/x86/include/asm/boot.h linux-2.6.33/arch/x86/include/asm/boot.h
6364 --- linux-2.6.33/arch/x86/include/asm/boot.h    2010-02-24 13:52:17.000000000 -0500
6365 +++ linux-2.6.33/arch/x86/include/asm/boot.h    2010-03-07 12:23:35.917681499 -0500
6366 @@ -11,10 +11,15 @@
6367  #include <asm/pgtable_types.h>
6368
6369  /* Physical address where kernel should be loaded. */
6370 -#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
6371 +#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
6372                                 + (CONFIG_PHYSICAL_ALIGN - 1)) \
6373                                 & ~(CONFIG_PHYSICAL_ALIGN - 1))
6374
6375 +#ifndef __ASSEMBLY__
6376 +extern unsigned char __LOAD_PHYSICAL_ADDR[];
6377 +#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
6378 +#endif
6379 +
6380  /* Minimum kernel alignment, as a power of two */
6381  #ifdef CONFIG_X86_64
6382  #define MIN_KERNEL_ALIGN_LG2   PMD_SHIFT
6383 diff -urNp linux-2.6.33/arch/x86/include/asm/cache.h linux-2.6.33/arch/x86/include/asm/cache.h
6384 --- linux-2.6.33/arch/x86/include/asm/cache.h   2010-02-24 13:52:17.000000000 -0500
6385 +++ linux-2.6.33/arch/x86/include/asm/cache.h   2010-03-07 12:23:35.917681499 -0500
6386 @@ -8,6 +8,7 @@
6387  #define L1_CACHE_BYTES (1 << L1_CACHE_SHIFT)
6388
6389  #define __read_mostly __attribute__((__section__(".data.read_mostly")))
6390 +#define __read_only __attribute__((__section__(".data.read_only")))
6391
6392  #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
6393  #define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
6394 diff -urNp linux-2.6.33/arch/x86/include/asm/checksum_32.h linux-2.6.33/arch/x86/include/asm/checksum_32.h
6395 --- linux-2.6.33/arch/x86/include/asm/checksum_32.h     2010-02-24 13:52:17.000000000 -0500
6396 +++ linux-2.6.33/arch/x86/include/asm/checksum_32.h     2010-03-07 12:23:35.917681499 -0500
6397 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
6398                                             int len, __wsum sum,
6399                                             int *src_err_ptr, int *dst_err_ptr);
6400
6401 +asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
6402 +                                                 int len, __wsum sum,
6403 +                                                 int *src_err_ptr, int *dst_err_ptr);
6404 +
6405 +asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
6406 +                                                 int len, __wsum sum,
6407 +                                                 int *src_err_ptr, int *dst_err_ptr);
6408 +
6409  /*
6410   *     Note: when you get a NULL pointer exception here this means someone
6411   *     passed in an incorrect kernel address to one of these functions.
6412 @@ -50,7 +58,7 @@ static inline __wsum csum_partial_copy_f
6413                                                  int *err_ptr)
6414  {
6415         might_sleep();
6416 -       return csum_partial_copy_generic((__force void *)src, dst,
6417 +       return csum_partial_copy_generic_from_user((__force void *)src, dst,
6418                                          len, sum, err_ptr, NULL);
6419  }
6420
6421 @@ -178,7 +186,7 @@ static inline __wsum csum_and_copy_to_us
6422  {
6423         might_sleep();
6424         if (access_ok(VERIFY_WRITE, dst, len))
6425 -               return csum_partial_copy_generic(src, (__force void *)dst,
6426 +               return csum_partial_copy_generic_to_user(src, (__force void *)dst,
6427                                                  len, sum, NULL, err_ptr);
6428
6429         if (len)
6430 diff -urNp linux-2.6.33/arch/x86/include/asm/desc.h linux-2.6.33/arch/x86/include/asm/desc.h
6431 --- linux-2.6.33/arch/x86/include/asm/desc.h    2010-02-24 13:52:17.000000000 -0500
6432 +++ linux-2.6.33/arch/x86/include/asm/desc.h    2010-03-07 12:23:35.917681499 -0500
6433 @@ -4,6 +4,7 @@
6434  #include <asm/desc_defs.h>
6435  #include <asm/ldt.h>
6436  #include <asm/mmu.h>
6437 +#include <asm/pgtable.h>
6438  #include <linux/smp.h>
6439
6440  static inline void fill_ldt(struct desc_struct *desc,
6441 @@ -15,6 +16,7 @@ static inline void fill_ldt(struct desc_
6442         desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
6443         desc->type = (info->read_exec_only ^ 1) << 1;
6444         desc->type |= info->contents << 2;
6445 +       desc->type |= info->seg_not_present ^ 1;
6446         desc->s = 1;
6447         desc->dpl = 0x3;
6448         desc->p = info->seg_not_present ^ 1;
6449 @@ -31,16 +33,12 @@ static inline void fill_ldt(struct desc_
6450  }
6451
6452  extern struct desc_ptr idt_descr;
6453 -extern gate_desc idt_table[];
6454 -
6455 -struct gdt_page {
6456 -       struct desc_struct gdt[GDT_ENTRIES];
6457 -} __attribute__((aligned(PAGE_SIZE)));
6458 -DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
6459 +extern gate_desc idt_table[256];
6460
6461 +extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
6462  static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
6463  {
6464 -       return per_cpu(gdt_page, cpu).gdt;
6465 +       return cpu_gdt_table[cpu];
6466  }
6467
6468  #ifdef CONFIG_X86_64
6469 @@ -115,19 +113,24 @@ static inline void paravirt_free_ldt(str
6470  static inline void native_write_idt_entry(gate_desc *idt, int entry,
6471                                           const gate_desc *gate)
6472  {
6473 +       pax_open_kernel();
6474         memcpy(&idt[entry], gate, sizeof(*gate));
6475 +       pax_close_kernel();
6476  }
6477
6478  static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
6479                                           const void *desc)
6480  {
6481 +       pax_open_kernel();
6482         memcpy(&ldt[entry], desc, 8);
6483 +       pax_close_kernel();
6484  }
6485
6486  static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
6487                                           const void *desc, int type)
6488  {
6489         unsigned int size;
6490 +
6491         switch (type) {
6492         case DESC_TSS:
6493                 size = sizeof(tss_desc);
6494 @@ -139,7 +142,10 @@ static inline void native_write_gdt_entr
6495                 size = sizeof(struct desc_struct);
6496                 break;
6497         }
6498 +
6499 +       pax_open_kernel();
6500         memcpy(&gdt[entry], desc, size);
6501 +       pax_close_kernel();
6502  }
6503
6504  static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
6505 @@ -211,7 +217,9 @@ static inline void native_set_ldt(const
6506
6507  static inline void native_load_tr_desc(void)
6508  {
6509 +       pax_open_kernel();
6510         asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
6511 +       pax_close_kernel();
6512  }
6513
6514  static inline void native_load_gdt(const struct desc_ptr *dtr)
6515 @@ -246,8 +254,10 @@ static inline void native_load_tls(struc
6516         unsigned int i;
6517         struct desc_struct *gdt = get_cpu_gdt_table(cpu);
6518
6519 +       pax_open_kernel();
6520         for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
6521                 gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
6522 +       pax_close_kernel();
6523  }
6524
6525  #define _LDT_empty(info)                               \
6526 @@ -392,4 +402,16 @@ static inline void set_system_intr_gate_
6527         _set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
6528  }
6529
6530 +#ifdef CONFIG_X86_32
6531 +static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
6532 +{
6533 +       struct desc_struct d;
6534 +
6535 +       if (likely(limit))
6536 +               limit = (limit - 1UL) >> PAGE_SHIFT;
6537 +       pack_descriptor(&d, base, limit, 0xFB, 0xC);
6538 +       write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
6539 +}
6540 +#endif
6541 +
6542  #endif /* _ASM_X86_DESC_H */
6543 diff -urNp linux-2.6.33/arch/x86/include/asm/device.h linux-2.6.33/arch/x86/include/asm/device.h
6544 --- linux-2.6.33/arch/x86/include/asm/device.h  2010-02-24 13:52:17.000000000 -0500
6545 +++ linux-2.6.33/arch/x86/include/asm/device.h  2010-03-07 12:23:35.917681499 -0500
6546 @@ -6,7 +6,7 @@ struct dev_archdata {
6547         void    *acpi_handle;
6548  #endif
6549  #ifdef CONFIG_X86_64
6550 -struct dma_map_ops *dma_ops;
6551 +       const struct dma_map_ops *dma_ops;
6552  #endif
6553  #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
6554         void *iommu; /* hook for IOMMU specific extension */
6555 diff -urNp linux-2.6.33/arch/x86/include/asm/dma-mapping.h linux-2.6.33/arch/x86/include/asm/dma-mapping.h
6556 --- linux-2.6.33/arch/x86/include/asm/dma-mapping.h     2010-02-24 13:52:17.000000000 -0500
6557 +++ linux-2.6.33/arch/x86/include/asm/dma-mapping.h     2010-03-07 12:23:35.917681499 -0500
6558 @@ -26,9 +26,9 @@ extern int iommu_merge;
6559  extern struct device x86_dma_fallback_dev;
6560  extern int panic_on_overflow;
6561
6562 -extern struct dma_map_ops *dma_ops;
6563 +extern const struct dma_map_ops *dma_ops;
6564
6565 -static inline struct dma_map_ops *get_dma_ops(struct device *dev)
6566 +static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
6567  {
6568  #ifdef CONFIG_X86_32
6569         return dma_ops;
6570 @@ -45,7 +45,7 @@ static inline struct dma_map_ops *get_dm
6571  /* Make sure we keep the same behaviour */
6572  static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
6573  {
6574 -       struct dma_map_ops *ops = get_dma_ops(dev);
6575 +       const struct dma_map_ops *ops = get_dma_ops(dev);
6576         if (ops->mapping_error)
6577                 return ops->mapping_error(dev, dma_addr);
6578
6579 @@ -123,7 +123,7 @@ static inline void *
6580  dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
6581                 gfp_t gfp)
6582  {
6583 -       struct dma_map_ops *ops = get_dma_ops(dev);
6584 +       const struct dma_map_ops *ops = get_dma_ops(dev);
6585         void *memory;
6586
6587         gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
6588 @@ -150,7 +150,7 @@ dma_alloc_coherent(struct device *dev, s
6589  static inline void dma_free_coherent(struct device *dev, size_t size,
6590                                      void *vaddr, dma_addr_t bus)
6591  {
6592 -       struct dma_map_ops *ops = get_dma_ops(dev);
6593 +       const struct dma_map_ops *ops = get_dma_ops(dev);
6594
6595         WARN_ON(irqs_disabled());       /* for portability */
6596
6597 diff -urNp linux-2.6.33/arch/x86/include/asm/e820.h linux-2.6.33/arch/x86/include/asm/e820.h
6598 --- linux-2.6.33/arch/x86/include/asm/e820.h    2010-02-24 13:52:17.000000000 -0500
6599 +++ linux-2.6.33/arch/x86/include/asm/e820.h    2010-03-07 12:23:35.917681499 -0500
6600 @@ -64,7 +64,7 @@ struct e820map {
6601  #define ISA_START_ADDRESS      0xa0000
6602  #define ISA_END_ADDRESS                0x100000
6603
6604 -#define BIOS_BEGIN             0x000a0000
6605 +#define BIOS_BEGIN             0x000c0000
6606  #define BIOS_END               0x00100000
6607
6608  #ifdef __KERNEL__
6609 diff -urNp linux-2.6.33/arch/x86/include/asm/elf.h linux-2.6.33/arch/x86/include/asm/elf.h
6610 --- linux-2.6.33/arch/x86/include/asm/elf.h     2010-02-24 13:52:17.000000000 -0500
6611 +++ linux-2.6.33/arch/x86/include/asm/elf.h     2010-03-07 12:23:35.917681499 -0500
6612 @@ -237,7 +237,25 @@ extern int force_personality32;
6613     the loader.  We need to make sure that it is out of the way of the program
6614     that it will "exec", and that there is sufficient room for the brk.  */
6615
6616 +#ifdef CONFIG_PAX_SEGMEXEC
6617 +#define ELF_ET_DYN_BASE                ((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
6618 +#else
6619  #define ELF_ET_DYN_BASE                (TASK_SIZE / 3 * 2)
6620 +#endif
6621 +
6622 +#ifdef CONFIG_PAX_ASLR
6623 +#ifdef CONFIG_X86_32
6624 +#define PAX_ELF_ET_DYN_BASE    0x10000000UL
6625 +
6626 +#define PAX_DELTA_MMAP_LEN     (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
6627 +#define PAX_DELTA_STACK_LEN    (current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
6628 +#else
6629 +#define PAX_ELF_ET_DYN_BASE    0x400000UL
6630 +
6631 +#define PAX_DELTA_MMAP_LEN     ((test_thread_flag(TIF_IA32)) ? 16 : 32)
6632 +#define PAX_DELTA_STACK_LEN    ((test_thread_flag(TIF_IA32)) ? 16 : 32)
6633 +#endif
6634 +#endif
6635
6636  /* This yields a mask that user programs can use to figure out what
6637     instruction set this CPU supports.  This could be done in user space,
6638 @@ -291,8 +309,7 @@ do {                                                                        \
6639  #define ARCH_DLINFO                                                    \
6640  do {                                                                   \
6641         if (vdso_enabled)                                               \
6642 -               NEW_AUX_ENT(AT_SYSINFO_EHDR,                            \
6643 -                           (unsigned long)current->mm->context.vdso);  \
6644 +               NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
6645  } while (0)
6646
6647  #define AT_SYSINFO             32
6648 @@ -303,7 +320,7 @@ do {                                                                        \
6649
6650  #endif /* !CONFIG_X86_32 */
6651
6652 -#define VDSO_CURRENT_BASE      ((unsigned long)current->mm->context.vdso)
6653 +#define VDSO_CURRENT_BASE      (current->mm->context.vdso)
6654
6655  #define VDSO_ENTRY                                                     \
6656         ((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
6657 @@ -317,7 +334,4 @@ extern int arch_setup_additional_pages(s
6658  extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
6659  #define compat_arch_setup_additional_pages     syscall32_setup_pages
6660
6661 -extern unsigned long arch_randomize_brk(struct mm_struct *mm);
6662 -#define arch_randomize_brk arch_randomize_brk
6663 -
6664  #endif /* _ASM_X86_ELF_H */
6665 diff -urNp linux-2.6.33/arch/x86/include/asm/futex.h linux-2.6.33/arch/x86/include/asm/futex.h
6666 --- linux-2.6.33/arch/x86/include/asm/futex.h   2010-02-24 13:52:17.000000000 -0500
6667 +++ linux-2.6.33/arch/x86/include/asm/futex.h   2010-03-07 12:23:35.917681499 -0500
6668 @@ -11,6 +11,40 @@
6669  #include <asm/processor.h>
6670  #include <asm/system.h>
6671
6672 +#ifdef CONFIG_X86_32
6673 +#define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)    \
6674 +       asm volatile(                                           \
6675 +                    "movw\t%w6, %%ds\n"                        \
6676 +                    "1:\t" insn "\n"                           \
6677 +                    "2:\tpushl\t%%ss\n"                        \
6678 +                    "\tpopl\t%%ds\n"                           \
6679 +                    "\t.section .fixup,\"ax\"\n"               \
6680 +                    "3:\tmov\t%3, %1\n"                        \
6681 +                    "\tjmp\t2b\n"                              \
6682 +                    "\t.previous\n"                            \
6683 +                    _ASM_EXTABLE(1b, 3b)                       \
6684 +                    : "=r" (oldval), "=r" (ret), "+m" (*uaddr) \
6685 +                    : "i" (-EFAULT), "0" (oparg), "1" (0), "r" (__USER_DS))
6686 +
6687 +#define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)    \
6688 +       asm volatile("movw\t%w7, %%es\n"                        \
6689 +                    "1:\tmovl\t%%es:%2, %0\n"                  \
6690 +                    "\tmovl\t%0, %3\n"                         \
6691 +                    "\t" insn "\n"                             \
6692 +                    "2:\t" LOCK_PREFIX "cmpxchgl %3, %%es:%2\n"\
6693 +                    "\tjnz\t1b\n"                              \
6694 +                    "3:\tpushl\t%%ss\n"                        \
6695 +                    "\tpopl\t%%es\n"                           \
6696 +                    "\t.section .fixup,\"ax\"\n"               \
6697 +                    "4:\tmov\t%5, %1\n"                        \
6698 +                    "\tjmp\t3b\n"                              \
6699 +                    "\t.previous\n"                            \
6700 +                    _ASM_EXTABLE(1b, 4b)                       \
6701 +                    _ASM_EXTABLE(2b, 4b)                       \
6702 +                    : "=&a" (oldval), "=&r" (ret),             \
6703 +                      "+m" (*uaddr), "=&r" (tem)               \
6704 +                    : "r" (oparg), "i" (-EFAULT), "1" (0), "r" (__USER_DS))
6705 +#else
6706  #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)    \
6707         asm volatile("1:\t" insn "\n"                           \
6708                      "2:\t.section .fixup,\"ax\"\n"             \
6709 @@ -36,8 +70,9 @@
6710                      : "=&a" (oldval), "=&r" (ret),             \
6711                        "+m" (*uaddr), "=&r" (tem)               \
6712                      : "r" (oparg), "i" (-EFAULT), "1" (0))
6713 +#endif
6714
6715 -static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
6716 +static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
6717  {
6718         int op = (encoded_op >> 28) & 7;
6719         int cmp = (encoded_op >> 24) & 15;
6720 @@ -61,11 +96,20 @@ static inline int futex_atomic_op_inuser
6721
6722         switch (op) {
6723         case FUTEX_OP_SET:
6724 +#ifdef CONFIG_X86_32
6725 +               __futex_atomic_op1("xchgl %0, %%ds:%2", ret, oldval, uaddr, oparg);
6726 +#else
6727                 __futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
6728 +#endif
6729                 break;
6730         case FUTEX_OP_ADD:
6731 +#ifdef CONFIG_X86_32
6732 +               __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %%ds:%2", ret, oldval,
6733 +                                  uaddr, oparg);
6734 +#else
6735                 __futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
6736                                    uaddr, oparg);
6737 +#endif
6738                 break;
6739         case FUTEX_OP_OR:
6740                 __futex_atomic_op2("orl %4, %3", ret, oldval, uaddr, oparg);
6741 @@ -109,7 +153,7 @@ static inline int futex_atomic_op_inuser
6742         return ret;
6743  }
6744
6745 -static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
6746 +static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
6747                                                 int newval)
6748  {
6749
6750 @@ -122,14 +166,27 @@ static inline int futex_atomic_cmpxchg_i
6751         if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
6752                 return -EFAULT;
6753
6754 -       asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
6755 +       asm volatile(
6756 +#ifdef CONFIG_X86_32
6757 +                    "\tmovw %w5, %%ds\n"
6758 +                    "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
6759 +                    "2:\tpushl   %%ss\n"
6760 +                    "\tpopl    %%ds\n"
6761 +                    "\t.section .fixup, \"ax\"\n"
6762 +#else
6763 +                    "1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
6764                      "2:\t.section .fixup, \"ax\"\n"
6765 +#endif
6766                      "3:\tmov     %2, %0\n"
6767                      "\tjmp     2b\n"
6768                      "\t.previous\n"
6769                      _ASM_EXTABLE(1b, 3b)
6770                      : "=a" (oldval), "+m" (*uaddr)
6771 +#ifdef CONFIG_X86_32
6772 +                    : "i" (-EFAULT), "r" (newval), "0" (oldval), "r" (__USER_DS)
6773 +#else
6774                      : "i" (-EFAULT), "r" (newval), "0" (oldval)
6775 +#endif
6776                      : "memory"
6777         );
6778
6779 diff -urNp linux-2.6.33/arch/x86/include/asm/i387.h linux-2.6.33/arch/x86/include/asm/i387.h
6780 --- linux-2.6.33/arch/x86/include/asm/i387.h    2010-02-24 13:52:17.000000000 -0500
6781 +++ linux-2.6.33/arch/x86/include/asm/i387.h    2010-03-07 12:23:35.917681499 -0500
6782 @@ -197,13 +197,8 @@ static inline int fxrstor_checking(struc
6783  }
6784
6785  /* We need a safe address that is cheap to find and that is already
6786 -   in L1 during context switch. The best choices are unfortunately
6787 -   different for UP and SMP */
6788 -#ifdef CONFIG_SMP
6789 -#define safe_address (__per_cpu_offset[0])
6790 -#else
6791 -#define safe_address (kstat_cpu(0).cpustat.user)
6792 -#endif
6793 +   in L1 during context switch. */
6794 +#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
6795
6796  /*
6797   * These must be called with preempt disabled
6798 diff -urNp linux-2.6.33/arch/x86/include/asm/io_64.h linux-2.6.33/arch/x86/include/asm/io_64.h
6799 --- linux-2.6.33/arch/x86/include/asm/io_64.h   2010-02-24 13:52:17.000000000 -0500
6800 +++ linux-2.6.33/arch/x86/include/asm/io_64.h   2010-03-07 12:23:35.917681499 -0500
6801 @@ -140,6 +140,17 @@ __OUTS(l)
6802
6803  #include <linux/vmalloc.h>
6804
6805 +#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
6806 +static inline int valid_phys_addr_range(unsigned long addr, size_t count)
6807 +{
6808 +       return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
6809 +}
6810 +
6811 +static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
6812 +{
6813 +       return (pfn + (count >> PAGE_SHIFT)) < (1 << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
6814 +}
6815 +
6816  #include <asm-generic/iomap.h>
6817
6818  void __memcpy_fromio(void *, unsigned long, unsigned);
6819 diff -urNp linux-2.6.33/arch/x86/include/asm/iommu.h linux-2.6.33/arch/x86/include/asm/iommu.h
6820 --- linux-2.6.33/arch/x86/include/asm/iommu.h   2010-02-24 13:52:17.000000000 -0500
6821 +++ linux-2.6.33/arch/x86/include/asm/iommu.h   2010-03-07 12:23:35.917681499 -0500
6822 @@ -1,7 +1,7 @@
6823  #ifndef _ASM_X86_IOMMU_H
6824  #define _ASM_X86_IOMMU_H
6825
6826 -extern struct dma_map_ops nommu_dma_ops;
6827 +extern const struct dma_map_ops nommu_dma_ops;
6828  extern int force_iommu, no_iommu;
6829  extern int iommu_detected;
6830  extern int iommu_pass_through;
6831 diff -urNp linux-2.6.33/arch/x86/include/asm/irqflags.h linux-2.6.33/arch/x86/include/asm/irqflags.h
6832 --- linux-2.6.33/arch/x86/include/asm/irqflags.h        2010-02-24 13:52:17.000000000 -0500
6833 +++ linux-2.6.33/arch/x86/include/asm/irqflags.h        2010-03-07 12:23:35.921647784 -0500
6834 @@ -142,10 +142,75 @@ static inline unsigned long __raw_local_
6835         sti;                                    \
6836         sysexit
6837
6838 +/* PaX: special register usage in entry_64.S, beware */
6839 +#ifdef CONFIG_PAX_KERNEXEC
6840 +       .macro ljmpq sel, off
6841 +       .byte 0x48; ljmp *1234f(%rip)
6842 +       .pushsection .rodata
6843 +       .align 16
6844 +       1234: .quad \off; .word \sel
6845 +       .popsection
6846 +       .endm
6847 +
6848 +#define PAX_EXIT_KERNEL                        \
6849 +       mov %cs, %rsi;                  \
6850 +       cmp $__KERNEXEC_KERNEL_CS, %esi;\
6851 +       jnz 2f;                         \
6852 +       mov %cr0, %rsi;                 \
6853 +       btc $16, %rsi;                  \
6854 +       ljmpq __KERNEL_CS, 1f;          \
6855 +1:     mov %rsi, %cr0;                 \
6856 +2:
6857 +
6858 +#define PAX_ENTER_KERNEL               \
6859 +       mov %cr0, %rsi;                 \
6860 +       bts $16, %rsi;                  \
6861 +       jnc 1f;                         \
6862 +       mov %cs, %esi;                  \
6863 +       cmp $__KERNEL_CS, %esi;         \
6864 +       jz 3f;                          \
6865 +       ljmpq __KERNEL_CS, 3f;          \
6866 +1:     ljmpq __KERNEXEC_KERNEL_CS, 2f; \
6867 +2:     mov %rsi, %cr0;                 \
6868 +3:
6869 +#else
6870 +#define PAX_EXIT_KERNEL
6871 +#define PAX_ENTER_KERNEL
6872 +#endif
6873 +
6874  #else
6875  #define INTERRUPT_RETURN               iret
6876  #define ENABLE_INTERRUPTS_SYSEXIT      sti; sysexit
6877  #define GET_CR0_INTO_EAX               movl %cr0, %eax
6878 +
6879 +/* PaX: special register usage in entry_32.S, beware */
6880 +#ifdef CONFIG_PAX_KERNEXEC
6881 +#define PAX_EXIT_KERNEL                        \
6882 +       mov %cs, %esi;                  \
6883 +       cmp $__KERNEXEC_KERNEL_CS, %esi;\
6884 +       jnz 2f;                         \
6885 +       mov %cr0, %esi;                 \
6886 +       btc $16, %esi;                  \
6887 +       ljmp $__KERNEL_CS, $1f;         \
6888 +1:     mov %esi, %cr0;                 \
6889 +2:
6890 +
6891 +#define PAX_ENTER_KERNEL               \
6892 +       mov %cr0, %esi;                 \
6893 +       bts $16, %esi;                  \
6894 +       jnc 1f;                         \
6895 +       mov %cs, %esi;                  \
6896 +       cmp $__KERNEL_CS, %esi;         \
6897 +       jz 3f;                          \
6898 +       ljmp $__KERNEL_CS, $3f;         \
6899 +1:     ljmp $__KERNEXEC_KERNEL_CS, $2f;\
6900 +2:     mov %esi, %cr0;                 \
6901 +3:
6902 +#else
6903 +#define PAX_EXIT_KERNEL
6904 +#define PAX_ENTER_KERNEL
6905 +#endif
6906 +
6907  #endif
6908
6909
6910 diff -urNp linux-2.6.33/arch/x86/include/asm/kvm_host.h linux-2.6.33/arch/x86/include/asm/kvm_host.h
6911 --- linux-2.6.33/arch/x86/include/asm/kvm_host.h        2010-02-24 13:52:17.000000000 -0500
6912 +++ linux-2.6.33/arch/x86/include/asm/kvm_host.h        2010-03-07 12:23:35.921647784 -0500
6913 @@ -536,7 +536,7 @@ struct kvm_x86_ops {
6914         const struct trace_print_flags *exit_reasons_str;
6915  };
6916
6917 -extern struct kvm_x86_ops *kvm_x86_ops;
6918 +extern const struct kvm_x86_ops *kvm_x86_ops;
6919
6920  int kvm_mmu_module_init(void);
6921  void kvm_mmu_module_exit(void);
6922 diff -urNp linux-2.6.33/arch/x86/include/asm/local.h linux-2.6.33/arch/x86/include/asm/local.h
6923 --- linux-2.6.33/arch/x86/include/asm/local.h   2010-02-24 13:52:17.000000000 -0500
6924 +++ linux-2.6.33/arch/x86/include/asm/local.h   2010-03-07 12:23:35.921647784 -0500
6925 @@ -18,26 +18,90 @@ typedef struct {
6926
6927  static inline void local_inc(local_t *l)
6928  {
6929 -       asm volatile(_ASM_INC "%0"
6930 +       asm volatile(_ASM_INC "%0\n"
6931 +
6932 +#ifdef CONFIG_PAX_REFCOUNT
6933 +#ifdef CONFIG_X86_32
6934 +                    "into\n0:\n"
6935 +#else
6936 +                    "jno 0f\n"
6937 +                    "int $4\n0:\n"
6938 +#endif
6939 +                    ".pushsection .fixup,\"ax\"\n"
6940 +                    "1:\n"
6941 +                    _ASM_DEC "%0\n"
6942 +                    "jmp 0b\n"
6943 +                    ".popsection\n"
6944 +                    _ASM_EXTABLE(0b, 1b)
6945 +#endif
6946 +
6947                      : "+m" (l->a.counter));
6948  }
6949
6950  static inline void local_dec(local_t *l)
6951  {
6952 -       asm volatile(_ASM_DEC "%0"
6953 +       asm volatile(_ASM_DEC "%0\n"
6954 +
6955 +#ifdef CONFIG_PAX_REFCOUNT
6956 +#ifdef CONFIG_X86_32
6957 +                    "into\n0:\n"
6958 +#else
6959 +                    "jno 0f\n"
6960 +                    "int $4\n0:\n"
6961 +#endif
6962 +                    ".pushsection .fixup,\"ax\"\n"
6963 +                    "1:\n"
6964 +                    _ASM_INC "%0\n"
6965 +                    "jmp 0b\n"
6966 +                    ".popsection\n"
6967 +                    _ASM_EXTABLE(0b, 1b)
6968 +#endif
6969 +
6970                      : "+m" (l->a.counter));
6971  }
6972
6973  static inline void local_add(long i, local_t *l)
6974  {
6975 -       asm volatile(_ASM_ADD "%1,%0"
6976 +       asm volatile(_ASM_ADD "%1,%0\n"
6977 +
6978 +#ifdef CONFIG_PAX_REFCOUNT
6979 +#ifdef CONFIG_X86_32
6980 +                    "into\n0:\n"
6981 +#else
6982 +                    "jno 0f\n"
6983 +                    "int $4\n0:\n"
6984 +#endif
6985 +                    ".pushsection .fixup,\"ax\"\n"
6986 +                    "1:\n"
6987 +                    _ASM_SUB "%1,%0\n"
6988 +                    "jmp 0b\n"
6989 +                    ".popsection\n"
6990 +                    _ASM_EXTABLE(0b, 1b)
6991 +#endif
6992 +
6993                      : "+m" (l->a.counter)
6994                      : "ir" (i));
6995  }
6996
6997  static inline void local_sub(long i, local_t *l)
6998  {
6999 -       asm volatile(_ASM_SUB "%1,%0"
7000 +       asm volatile(_ASM_SUB "%1,%0\n"
7001 +
7002 +#ifdef CONFIG_PAX_REFCOUNT
7003 +#ifdef CONFIG_X86_32
7004 +                    "into\n0:\n"
7005 +#else
7006 +                    "jno 0f\n"
7007 +                    "int $4\n0:\n"
7008 +#endif
7009 +                    ".pushsection .fixup,\"ax\"\n"
7010 +                    "1:\n"
7011 +                    _ASM_ADD "%1,%0\n"
7012 +                    "jmp 0b\n"
7013 +                    ".popsection\n"
7014 +                    _ASM_EXTABLE(0b, 1b)
7015 +#endif
7016 +
7017                      : "+m" (l->a.counter)
7018                      : "ir" (i));
7019  }
7020 @@ -55,7 +119,24 @@ static inline int local_sub_and_test(lon
7021  {
7022         unsigned char c;
7023
7024 -       asm volatile(_ASM_SUB "%2,%0; sete %1"
7025 +       asm volatile(_ASM_SUB "%2,%0\n"
7026 +
7027 +#ifdef CONFIG_PAX_REFCOUNT
7028 +#ifdef CONFIG_X86_32
7029 +                    "into\n0:\n"
7030 +#else
7031 +                    "jno 0f\n"
7032 +                    "int $4\n0:\n"
7033 +#endif
7034 +                    ".pushsection .fixup,\"ax\"\n"
7035 +                    "1:\n"
7036 +                    _ASM_ADD "%2,%0\n"
7037 +                    "jmp 0b\n"
7038 +                    ".popsection\n"
7039 +                    _ASM_EXTABLE(0b, 1b)
7040 +#endif
7041 +
7042 +                    "sete %1\n"
7043                      : "+m" (l->a.counter), "=qm" (c)
7044                      : "ir" (i) : "memory");
7045         return c;
7046 @@ -73,7 +154,24 @@ static inline int local_dec_and_test(loc
7047  {
7048         unsigned char c;
7049
7050 -       asm volatile(_ASM_DEC "%0; sete %1"
7051 +       asm volatile(_ASM_DEC "%0\n"
7052 +
7053 +#ifdef CONFIG_PAX_REFCOUNT
7054 +#ifdef CONFIG_X86_32
7055 +                    "into\n0:\n"
7056 +#else
7057 +                    "jno 0f\n"
7058 +                    "int $4\n0:\n"
7059 +#endif
7060 +                    ".pushsection .fixup,\"ax\"\n"
7061 +                    "1:\n"
7062 +                    _ASM_INC "%0\n"
7063 +                    "jmp 0b\n"
7064 +                    ".popsection\n"
7065 +                    _ASM_EXTABLE(0b, 1b)
7066 +#endif
7067 +
7068 +                    "sete %1\n"
7069                      : "+m" (l->a.counter), "=qm" (c)
7070                      : : "memory");
7071         return c != 0;
7072 @@ -91,7 +189,24 @@ static inline int local_inc_and_test(loc
7073  {
7074         unsigned char c;
7075
7076 -       asm volatile(_ASM_INC "%0; sete %1"
7077 +       asm volatile(_ASM_INC "%0\n"
7078 +
7079 +#ifdef CONFIG_PAX_REFCOUNT
7080 +#ifdef CONFIG_X86_32
7081 +                    "into\n0:\n"
7082 +#else
7083 +                    "jno 0f\n"
7084 +                    "int $4\n0:\n"
7085 +#endif
7086 +                    ".pushsection .fixup,\"ax\"\n"
7087 +                    "1:\n"
7088 +                    _ASM_DEC "%0\n"
7089 +                    "jmp 0b\n"
7090 +                    ".popsection\n"
7091 +                    _ASM_EXTABLE(0b, 1b)
7092 +#endif
7093 +
7094 +                    "sete %1\n"
7095                      : "+m" (l->a.counter), "=qm" (c)
7096                      : : "memory");
7097         return c != 0;
7098 @@ -110,7 +225,24 @@ static inline int local_add_negative(lon
7099  {
7100         unsigned char c;
7101
7102 -       asm volatile(_ASM_ADD "%2,%0; sets %1"
7103 +       asm volatile(_ASM_ADD "%2,%0\n"
7104 +
7105 +#ifdef CONFIG_PAX_REFCOUNT
7106 +#ifdef CONFIG_X86_32
7107 +                    "into\n0:\n"
7108 +#else
7109 +                    "jno 0f\n"
7110 +                    "int $4\n0:\n"
7111 +#endif
7112 +                    ".pushsection .fixup,\"ax\"\n"
7113 +                    "1:\n"
7114 +                    _ASM_SUB "%2,%0\n"
7115 +                    "jmp 0b\n"
7116 +                    ".popsection\n"
7117 +                    _ASM_EXTABLE(0b, 1b)
7118 +#endif
7119 +
7120 +                    "sets %1\n"
7121                      : "+m" (l->a.counter), "=qm" (c)
7122                      : "ir" (i) : "memory");
7123         return c;
7124 @@ -133,7 +265,23 @@ static inline long local_add_return(long
7125  #endif
7126         /* Modern 486+ processor */
7127         __i = i;
7128 -       asm volatile(_ASM_XADD "%0, %1;"
7129 +       asm volatile(_ASM_XADD "%0, %1\n"
7130 +
7131 +#ifdef CONFIG_PAX_REFCOUNT
7132 +#ifdef CONFIG_X86_32
7133 +                    "into\n0:\n"
7134 +#else
7135 +                    "jno 0f\n"
7136 +                    "int $4\n0:\n"
7137 +#endif
7138 +                    ".pushsection .fixup,\"ax\"\n"
7139 +                    "1:\n"
7140 +                    _ASM_MOV "%0,%1\n"
7141 +                    "jmp 0b\n"
7142 +                    ".popsection\n"
7143 +                    _ASM_EXTABLE(0b, 1b)
7144 +#endif
7145 +
7146                      : "+r" (i), "+m" (l->a.counter)
7147                      : : "memory");
7148         return i + __i;
7149 diff -urNp linux-2.6.33/arch/x86/include/asm/microcode.h linux-2.6.33/arch/x86/include/asm/microcode.h
7150 --- linux-2.6.33/arch/x86/include/asm/microcode.h       2010-02-24 13:52:17.000000000 -0500
7151 +++ linux-2.6.33/arch/x86/include/asm/microcode.h       2010-03-07 12:23:35.921647784 -0500
7152 @@ -12,13 +12,13 @@ struct device;
7153  enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
7154
7155  struct microcode_ops {
7156 -       enum ucode_state (*request_microcode_user) (int cpu,
7157 +       enum ucode_state (* const request_microcode_user) (int cpu,
7158                                 const void __user *buf, size_t size);
7159
7160 -       enum ucode_state (*request_microcode_fw) (int cpu,
7161 +       enum ucode_state (* const request_microcode_fw) (int cpu,
7162                                 struct device *device);
7163
7164 -       void (*microcode_fini_cpu) (int cpu);
7165 +       void (* const microcode_fini_cpu) (int cpu);
7166
7167         /*
7168          * The generic 'microcode_core' part guarantees that
7169 @@ -38,18 +38,18 @@ struct ucode_cpu_info {
7170  extern struct ucode_cpu_info ucode_cpu_info[];
7171
7172  #ifdef CONFIG_MICROCODE_INTEL
7173 -extern struct microcode_ops * __init init_intel_microcode(void);
7174 +extern const struct microcode_ops * __init init_intel_microcode(void);
7175  #else
7176 -static inline struct microcode_ops * __init init_intel_microcode(void)
7177 +static inline const struct microcode_ops * __init init_intel_microcode(void)
7178  {
7179         return NULL;
7180  }
7181  #endif /* CONFIG_MICROCODE_INTEL */
7182
7183  #ifdef CONFIG_MICROCODE_AMD
7184 -extern struct microcode_ops * __init init_amd_microcode(void);
7185 +extern const struct microcode_ops * __init init_amd_microcode(void);
7186  #else
7187 -static inline struct microcode_ops * __init init_amd_microcode(void)
7188 +static inline const struct microcode_ops * __init init_amd_microcode(void)
7189  {
7190         return NULL;
7191  }
7192 diff -urNp linux-2.6.33/arch/x86/include/asm/mman.h linux-2.6.33/arch/x86/include/asm/mman.h
7193 --- linux-2.6.33/arch/x86/include/asm/mman.h    2010-02-24 13:52:17.000000000 -0500
7194 +++ linux-2.6.33/arch/x86/include/asm/mman.h    2010-03-07 12:23:35.921647784 -0500
7195 @@ -5,4 +5,14 @@
7196
7197  #include <asm-generic/mman.h>
7198
7199 +#ifdef __KERNEL__
7200 +#ifndef __ASSEMBLY__
7201 +#ifdef CONFIG_X86_32
7202 +#define arch_mmap_check        i386_mmap_check
7203 +int i386_mmap_check(unsigned long addr, unsigned long len,
7204 +               unsigned long flags);
7205 +#endif
7206 +#endif
7207 +#endif
7208 +
7209  #endif /* _ASM_X86_MMAN_H */
7210 diff -urNp linux-2.6.33/arch/x86/include/asm/mmu_context.h linux-2.6.33/arch/x86/include/asm/mmu_context.h
7211 --- linux-2.6.33/arch/x86/include/asm/mmu_context.h     2010-02-24 13:52:17.000000000 -0500
7212 +++ linux-2.6.33/arch/x86/include/asm/mmu_context.h     2010-03-07 12:23:35.921647784 -0500
7213 @@ -34,11 +34,17 @@ static inline void switch_mm(struct mm_s
7214                              struct task_struct *tsk)
7215  {
7216         unsigned cpu = smp_processor_id();
7217 +#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
7218 +       int tlbstate = TLBSTATE_OK;
7219 +#endif
7220
7221         if (likely(prev != next)) {
7222                 /* stop flush ipis for the previous mm */
7223                 cpumask_clear_cpu(cpu, mm_cpumask(prev));
7224  #ifdef CONFIG_SMP
7225 +#ifdef CONFIG_X86_32
7226 +               tlbstate = percpu_read(cpu_tlbstate.state);
7227 +#endif
7228                 percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
7229                 percpu_write(cpu_tlbstate.active_mm, next);
7230  #endif
7231 @@ -52,6 +58,26 @@ static inline void switch_mm(struct mm_s
7232                  */
7233                 if (unlikely(prev->context.ldt != next->context.ldt))
7234                         load_LDT_nolock(&next->context);
7235 +
7236 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7237 +               if (!(__supported_pte_mask & _PAGE_NX)) {
7238 +                       smp_mb__before_clear_bit();
7239 +                       cpu_clear(cpu, prev->context.cpu_user_cs_mask);
7240 +                       smp_mb__after_clear_bit();
7241 +                       cpu_set(cpu, next->context.cpu_user_cs_mask);
7242 +               }
7243 +#endif
7244 +
7245 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7246 +               if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
7247 +                            prev->context.user_cs_limit != next->context.user_cs_limit))
7248 +                       set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7249 +#ifdef CONFIG_SMP
7250 +               else if (unlikely(tlbstate != TLBSTATE_OK))
7251 +                       set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7252 +#endif
7253 +#endif
7254 +
7255         }
7256  #ifdef CONFIG_SMP
7257         else {
7258 @@ -65,6 +91,19 @@ static inline void switch_mm(struct mm_s
7259                          */
7260                         load_cr3(next->pgd);
7261                         load_LDT_nolock(&next->context);
7262 +
7263 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
7264 +                       if (!(__supported_pte_mask & _PAGE_NX))
7265 +                               cpu_set(cpu, next->context.cpu_user_cs_mask);
7266 +#endif
7267 +
7268 +#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
7269 +#ifdef CONFIG_PAX_PAGEEXEC
7270 +                       if (!((next->pax_flags & MF_PAX_PAGEEXEC) && (__supported_pte_mask & _PAGE_NX)))
7271 +#endif
7272 +                               set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
7273 +#endif
7274 +
7275                 }
7276         }
7277  #endif
7278 diff -urNp linux-2.6.33/arch/x86/include/asm/mmu.h linux-2.6.33/arch/x86/include/asm/mmu.h
7279 --- linux-2.6.33/arch/x86/include/asm/mmu.h     2010-02-24 13:52:17.000000000 -0500
7280 +++ linux-2.6.33/arch/x86/include/asm/mmu.h     2010-03-07 12:23:35.921647784 -0500
7281 @@ -9,10 +9,23 @@
7282   * we put the segment information here.
7283   */
7284  typedef struct {
7285 -       void *ldt;
7286 +       struct desc_struct *ldt;
7287         int size;
7288         struct mutex lock;
7289 -       void *vdso;
7290 +       unsigned long vdso;
7291 +
7292 +#ifdef CONFIG_X86_32
7293 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
7294 +       unsigned long user_cs_base;
7295 +       unsigned long user_cs_limit;
7296 +
7297 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
7298 +       cpumask_t cpu_user_cs_mask;
7299 +#endif
7300 +
7301 +#endif
7302 +#endif
7303 +
7304  } mm_context_t;
7305
7306  #ifdef CONFIG_SMP
7307 diff -urNp linux-2.6.33/arch/x86/include/asm/module.h linux-2.6.33/arch/x86/include/asm/module.h
7308 --- linux-2.6.33/arch/x86/include/asm/module.h  2010-02-24 13:52:17.000000000 -0500
7309 +++ linux-2.6.33/arch/x86/include/asm/module.h  2010-03-07 12:23:35.921647784 -0500
7310 @@ -65,7 +65,12 @@
7311  # else
7312  #  define MODULE_STACKSIZE ""
7313  # endif
7314 -# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
7315 +# ifdef CONFIG_GRKERNSEC
7316 +#  define MODULE_GRSEC "GRSECURITY "
7317 +# else
7318 +#  define MODULE_GRSEC ""
7319 +# endif
7320 +# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC
7321  #endif
7322
7323  #endif /* _ASM_X86_MODULE_H */
7324 diff -urNp linux-2.6.33/arch/x86/include/asm/page_32_types.h linux-2.6.33/arch/x86/include/asm/page_32_types.h
7325 --- linux-2.6.33/arch/x86/include/asm/page_32_types.h   2010-02-24 13:52:17.000000000 -0500
7326 +++ linux-2.6.33/arch/x86/include/asm/page_32_types.h   2010-03-07 12:23:35.921647784 -0500
7327 @@ -15,6 +15,10 @@
7328   */
7329  #define __PAGE_OFFSET          _AC(CONFIG_PAGE_OFFSET, UL)
7330
7331 +#ifdef CONFIG_PAX_PAGEEXEC
7332 +#define CONFIG_ARCH_TRACK_EXEC_LIMIT 1
7333 +#endif
7334 +
7335  #ifdef CONFIG_4KSTACKS
7336  #define THREAD_ORDER   0
7337  #else
7338 diff -urNp linux-2.6.33/arch/x86/include/asm/page_64_types.h linux-2.6.33/arch/x86/include/asm/page_64_types.h
7339 --- linux-2.6.33/arch/x86/include/asm/page_64_types.h   2010-02-24 13:52:17.000000000 -0500
7340 +++ linux-2.6.33/arch/x86/include/asm/page_64_types.h   2010-03-07 12:23:35.921647784 -0500
7341 @@ -39,6 +39,9 @@
7342  #define __START_KERNEL         (__START_KERNEL_map + __PHYSICAL_START)
7343  #define __START_KERNEL_map     _AC(0xffffffff80000000, UL)
7344
7345 +#define ktla_ktva(addr)                (addr)
7346 +#define ktva_ktla(addr)                (addr)
7347 +
7348  /* See Documentation/x86/x86_64/mm.txt for a description of the memory map. */
7349  #define __PHYSICAL_MASK_SHIFT  46
7350  #define __VIRTUAL_MASK_SHIFT   47
7351 diff -urNp linux-2.6.33/arch/x86/include/asm/paravirt.h linux-2.6.33/arch/x86/include/asm/paravirt.h
7352 --- linux-2.6.33/arch/x86/include/asm/paravirt.h        2010-02-24 13:52:17.000000000 -0500
7353 +++ linux-2.6.33/arch/x86/include/asm/paravirt.h        2010-03-07 12:23:55.597717555 -0500
7354 @@ -729,6 +729,21 @@ static inline void __set_fixmap(unsigned
7355         pv_mmu_ops.set_fixmap(idx, phys, flags);
7356  }
7357
7358 +#ifdef CONFIG_PAX_KERNEXEC
7359 +static inline unsigned long pax_open_kernel(void)
7360 +{
7361 +       return pv_mmu_ops.pax_open_kernel();
7362 +}
7363 +
7364 +static inline unsigned long pax_close_kernel(void)
7365 +{
7366 +       return pv_mmu_ops.pax_close_kernel();
7367 +}
7368 +#else
7369 +static inline unsigned long pax_open_kernel(void) { return 0; }
7370 +static inline unsigned long pax_close_kernel(void) { return 0; }
7371 +#endif
7372 +
7373  #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
7374
7375  static inline int arch_spin_is_locked(struct arch_spinlock *lock)
7376 @@ -945,7 +960,7 @@ extern void default_banner(void);
7377
7378  #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
7379  #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
7380 -#define PARA_INDIRECT(addr)    *%cs:addr
7381 +#define PARA_INDIRECT(addr)    *%ss:addr
7382  #endif
7383
7384  #define INTERRUPT_RETURN                                               \
7385 @@ -980,6 +995,34 @@ extern void default_banner(void);
7386                   CLBR_NONE,                                            \
7387                   jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
7388
7389 +#ifdef CONFIG_PAX_KERNEXEC
7390 +#define PAX_EXIT_KERNEL                                        \
7391 +       push %eax; push %ecx;                           \
7392 +       mov %cs, %eax;                                  \
7393 +       cmp $__KERNEXEC_KERNEL_CS, %eax;                \
7394 +       jnz 2f;                                         \
7395 +       call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
7396 +       btc $16, %eax;                                  \
7397 +       ljmp $__KERNEL_CS, $1f;                         \
7398 +1:     call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);\
7399 +2:     pop %ecx; pop %eax;                             \
7400 +
7401 +#define PAX_ENTER_KERNEL                               \
7402 +       push %eax; push %ecx;                           \
7403 +       call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
7404 +       bts $16, %eax;                                  \
7405 +       jnc 1f;                                         \
7406 +       mov %cs, %ecx;                                  \
7407 +       cmp $__KERNEL_CS, %ecx;                         \
7408 +       jz 3f;                                          \
7409 +       ljmp $__KERNEL_CS, $3f;                         \
7410 +1:     ljmp $__KERNEXEC_KERNEL_CS, $2f;                \
7411 +2:     call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);\
7412 +3:     pop %ecx; pop %eax;
7413 +#else
7414 +#define PAX_EXIT_KERNEL
7415 +#define PAX_ENTER_KERNEL
7416 +#endif
7417
7418  #else  /* !CONFIG_X86_32 */
7419
7420 @@ -1022,6 +1065,44 @@ extern void default_banner(void);
7421         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),    \
7422                   CLBR_NONE,                                            \
7423                   jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
7424 +
7425 +#ifdef CONFIG_PAX_KERNEXEC
7426 +       .macro ljmpq sel, off
7427 +       .byte 0x48; ljmp *1234f(%rip)
7428 +       .pushsection .rodata
7429 +       .align 16
7430 +       1234: .quad \off; .word \sel
7431 +       .popsection
7432 +       .endm
7433 +
7434 +#define PAX_EXIT_KERNEL                                        \
7435 +       push %rax; push %rcx;                           \
7436 +       mov %cs, %rax;                                  \
7437 +       cmp $__KERNEXEC_KERNEL_CS, %eax;                \
7438 +       jnz 2f;                                         \
7439 +       call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
7440 +       btc $16, %rax;                                  \
7441 +       ljmpq __KERNEL_CS, 1f;                          \
7442 +1:     call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);\
7443 +2:     pop %rcx; pop %rax;                             \
7444 +
7445 +#define PAX_ENTER_KERNEL                               \
7446 +       push %rax; push %rcx;                           \
7447 +       call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0); \
7448 +       bts $16, %rax;                                  \
7449 +       jnc 1f;                                         \
7450 +       mov %cs, %rcx;                                  \
7451 +       cmp $__KERNEL_CS, %ecx;                         \
7452 +       jz 3f;                                          \
7453 +       ljmpq __KERNEL_CS, 3f;                          \
7454 +1:     ljmpq __KERNEXEC_KERNEL_CS, 2f;                 \
7455 +2:     call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);\
7456 +3:     pop %rcx; pop %rax;
7457 +#else
7458 +#define PAX_EXIT_KERNEL
7459 +#define PAX_ENTER_KERNEL
7460 +#endif
7461 +
7462  #endif /* CONFIG_X86_32 */
7463
7464  #endif /* __ASSEMBLY__ */
7465 diff -urNp linux-2.6.33/arch/x86/include/asm/paravirt_types.h linux-2.6.33/arch/x86/include/asm/paravirt_types.h
7466 --- linux-2.6.33/arch/x86/include/asm/paravirt_types.h  2010-02-24 13:52:17.000000000 -0500
7467 +++ linux-2.6.33/arch/x86/include/asm/paravirt_types.h  2010-03-07 12:23:35.921647784 -0500
7468 @@ -316,6 +316,12 @@ struct pv_mmu_ops {
7469            an mfn.  We can tell which is which from the index. */
7470         void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
7471                            phys_addr_t phys, pgprot_t flags);
7472 +
7473 +#ifdef CONFIG_PAX_KERNEXEC
7474 +       unsigned long (*pax_open_kernel)(void);
7475 +       unsigned long (*pax_close_kernel)(void);
7476 +#endif
7477 +
7478  };
7479
7480  struct arch_spinlock;
7481 diff -urNp linux-2.6.33/arch/x86/include/asm/pci_x86.h linux-2.6.33/arch/x86/include/asm/pci_x86.h
7482 --- linux-2.6.33/arch/x86/include/asm/pci_x86.h 2010-02-24 13:52:17.000000000 -0500
7483 +++ linux-2.6.33/arch/x86/include/asm/pci_x86.h 2010-03-07 12:23:35.921647784 -0500
7484 @@ -89,16 +89,16 @@ extern int (*pcibios_enable_irq)(struct
7485  extern void (*pcibios_disable_irq)(struct pci_dev *dev);
7486
7487  struct pci_raw_ops {
7488 -       int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
7489 +       int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
7490                                                 int reg, int len, u32 *val);
7491 -       int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
7492 +       int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
7493                                                 int reg, int len, u32 val);
7494  };
7495
7496 -extern struct pci_raw_ops *raw_pci_ops;
7497 -extern struct pci_raw_ops *raw_pci_ext_ops;
7498 +extern const struct pci_raw_ops *raw_pci_ops;
7499 +extern const struct pci_raw_ops *raw_pci_ext_ops;
7500
7501 -extern struct pci_raw_ops pci_direct_conf1;
7502 +extern const struct pci_raw_ops pci_direct_conf1;
7503  extern bool port_cf9_safe;
7504
7505  /* arch_initcall level */
7506 diff -urNp linux-2.6.33/arch/x86/include/asm/pgalloc.h linux-2.6.33/arch/x86/include/asm/pgalloc.h
7507 --- linux-2.6.33/arch/x86/include/asm/pgalloc.h 2010-02-24 13:52:17.000000000 -0500
7508 +++ linux-2.6.33/arch/x86/include/asm/pgalloc.h 2010-03-07 12:23:35.921647784 -0500
7509 @@ -58,6 +58,13 @@ static inline void pmd_populate_kernel(s
7510                                        pmd_t *pmd, pte_t *pte)
7511  {
7512         paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
7513 +       set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
7514 +}
7515 +
7516 +static inline void pmd_populate_user(struct mm_struct *mm,
7517 +                                      pmd_t *pmd, pte_t *pte)
7518 +{
7519 +       paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
7520         set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
7521  }
7522
7523 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable-2level.h linux-2.6.33/arch/x86/include/asm/pgtable-2level.h
7524 --- linux-2.6.33/arch/x86/include/asm/pgtable-2level.h  2010-02-24 13:52:17.000000000 -0500
7525 +++ linux-2.6.33/arch/x86/include/asm/pgtable-2level.h  2010-03-07 12:23:35.921647784 -0500
7526 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t
7527
7528  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
7529  {
7530 +       pax_open_kernel();
7531         *pmdp = pmd;
7532 +       pax_close_kernel();
7533  }
7534
7535  static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
7536 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable_32.h linux-2.6.33/arch/x86/include/asm/pgtable_32.h
7537 --- linux-2.6.33/arch/x86/include/asm/pgtable_32.h      2010-02-24 13:52:17.000000000 -0500
7538 +++ linux-2.6.33/arch/x86/include/asm/pgtable_32.h      2010-03-07 12:23:35.921647784 -0500
7539 @@ -26,8 +26,6 @@
7540  struct mm_struct;
7541  struct vm_area_struct;
7542
7543 -extern pgd_t swapper_pg_dir[1024];
7544 -
7545  static inline void pgtable_cache_init(void) { }
7546  static inline void check_pgt_cache(void) { }
7547  void paging_init(void);
7548 @@ -48,6 +46,11 @@ extern void set_pmd_pfn(unsigned long, u
7549  # include <asm/pgtable-2level.h>
7550  #endif
7551
7552 +extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
7553 +#ifdef CONFIG_X86_PAE
7554 +extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
7555 +#endif
7556 +
7557  #if defined(CONFIG_HIGHPTE)
7558  #define __KM_PTE                       \
7559         (in_nmi() ? KM_NMI_PTE :        \
7560 @@ -72,7 +75,9 @@ extern void set_pmd_pfn(unsigned long, u
7561  /* Clear a kernel PTE and flush it from the TLB */
7562  #define kpte_clear_flush(ptep, vaddr)          \
7563  do {                                           \
7564 +       pax_open_kernel();                      \
7565         pte_clear(&init_mm, (vaddr), (ptep));   \
7566 +       pax_close_kernel();                     \
7567         __flush_tlb_one((vaddr));               \
7568  } while (0)
7569
7570 @@ -84,6 +89,9 @@ do {                                          \
7571
7572  #endif /* !__ASSEMBLY__ */
7573
7574 +#define HAVE_ARCH_UNMAPPED_AREA
7575 +#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
7576 +
7577  /*
7578   * kern_addr_valid() is (1) for FLATMEM and (0) for
7579   * SPARSEMEM and DISCONTIGMEM
7580 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable_32_types.h linux-2.6.33/arch/x86/include/asm/pgtable_32_types.h
7581 --- linux-2.6.33/arch/x86/include/asm/pgtable_32_types.h        2010-02-24 13:52:17.000000000 -0500
7582 +++ linux-2.6.33/arch/x86/include/asm/pgtable_32_types.h        2010-03-07 12:23:35.921647784 -0500
7583 @@ -8,7 +8,7 @@
7584   */
7585  #ifdef CONFIG_X86_PAE
7586  # include <asm/pgtable-3level_types.h>
7587 -# define PMD_SIZE      (1UL << PMD_SHIFT)
7588 +# define PMD_SIZE      (_AC(1, UL) << PMD_SHIFT)
7589  # define PMD_MASK      (~(PMD_SIZE - 1))
7590  #else
7591  # include <asm/pgtable-2level_types.h>
7592 @@ -46,6 +46,19 @@ extern bool __vmalloc_start_set; /* set
7593  # define VMALLOC_END   (FIXADDR_START - 2 * PAGE_SIZE)
7594  #endif
7595
7596 +#ifdef CONFIG_PAX_KERNEXEC
7597 +#ifndef __ASSEMBLY__
7598 +extern unsigned char MODULES_EXEC_VADDR[];
7599 +extern unsigned char MODULES_EXEC_END[];
7600 +#endif
7601 +#include <asm/boot.h>
7602 +#define ktla_ktva(addr)                (addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
7603 +#define ktva_ktla(addr)                (addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
7604 +#else
7605 +#define ktla_ktva(addr)                (addr)
7606 +#define ktva_ktla(addr)                (addr)
7607 +#endif
7608 +
7609  #define MODULES_VADDR  VMALLOC_START
7610  #define MODULES_END    VMALLOC_END
7611  #define MODULES_LEN    (MODULES_VADDR - MODULES_END)
7612 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable-3level.h linux-2.6.33/arch/x86/include/asm/pgtable-3level.h
7613 --- linux-2.6.33/arch/x86/include/asm/pgtable-3level.h  2010-02-24 13:52:17.000000000 -0500
7614 +++ linux-2.6.33/arch/x86/include/asm/pgtable-3level.h  2010-03-07 12:23:35.921647784 -0500
7615 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
7616
7617  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
7618  {
7619 +       pax_open_kernel();
7620         set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
7621 +       pax_close_kernel();
7622  }
7623
7624  static inline void native_set_pud(pud_t *pudp, pud_t pud)
7625  {
7626 +       pax_open_kernel();
7627         set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
7628 +       pax_close_kernel();
7629  }
7630
7631  /*
7632 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable_64.h linux-2.6.33/arch/x86/include/asm/pgtable_64.h
7633 --- linux-2.6.33/arch/x86/include/asm/pgtable_64.h      2010-02-24 13:52:17.000000000 -0500
7634 +++ linux-2.6.33/arch/x86/include/asm/pgtable_64.h      2010-03-07 12:23:35.921647784 -0500
7635 @@ -16,9 +16,12 @@
7636
7637  extern pud_t level3_kernel_pgt[512];
7638  extern pud_t level3_ident_pgt[512];
7639 +extern pud_t level3_vmalloc_pgt[512];
7640 +extern pud_t level3_vmemmap_pgt[512];
7641 +extern pud_t level2_vmemmap_pgt[512];
7642  extern pmd_t level2_kernel_pgt[512];
7643  extern pmd_t level2_fixmap_pgt[512];
7644 -extern pmd_t level2_ident_pgt[512];
7645 +extern pmd_t level2_ident_pgt[512*2];
7646  extern pgd_t init_level4_pgt[];
7647
7648  #define swapper_pg_dir init_level4_pgt
7649 @@ -74,7 +77,9 @@ static inline pte_t native_ptep_get_and_
7650
7651  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
7652  {
7653 +       pax_open_kernel();
7654         *pmdp = pmd;
7655 +       pax_close_kernel();
7656  }
7657
7658  static inline void native_pmd_clear(pmd_t *pmd)
7659 @@ -94,7 +99,9 @@ static inline void native_pud_clear(pud_
7660
7661  static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
7662  {
7663 +       pax_open_kernel();
7664         *pgdp = pgd;
7665 +       pax_close_kernel();
7666  }
7667
7668  static inline void native_pgd_clear(pgd_t *pgd)
7669 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable.h linux-2.6.33/arch/x86/include/asm/pgtable.h
7670 --- linux-2.6.33/arch/x86/include/asm/pgtable.h 2010-02-24 13:52:17.000000000 -0500
7671 +++ linux-2.6.33/arch/x86/include/asm/pgtable.h 2010-03-07 12:23:35.921647784 -0500
7672 @@ -76,12 +76,51 @@ extern struct list_head pgd_list;
7673
7674  #define arch_end_context_switch(prev)  do {} while(0)
7675
7676 +#define pax_open_kernel()      native_pax_open_kernel()
7677 +#define pax_close_kernel()     native_pax_close_kernel()
7678  #endif /* CONFIG_PARAVIRT */
7679
7680 +#define  __HAVE_ARCH_PAX_OPEN_KERNEL
7681 +#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
7682 +
7683 +#ifdef CONFIG_PAX_KERNEXEC
7684 +static inline unsigned long native_pax_open_kernel(void)
7685 +{
7686 +       unsigned long cr0;
7687 +
7688 +       preempt_disable();
7689 +       barrier();
7690 +       cr0 = read_cr0() ^ X86_CR0_WP;
7691 +       BUG_ON(unlikely(cr0 & X86_CR0_WP));
7692 +       write_cr0(cr0);
7693 +       return cr0 ^ X86_CR0_WP;
7694 +}
7695 +
7696 +static inline unsigned long native_pax_close_kernel(void)
7697 +{
7698 +       unsigned long cr0;
7699 +
7700 +       cr0 = read_cr0() ^ X86_CR0_WP;
7701 +       BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
7702 +       write_cr0(cr0);
7703 +       barrier();
7704 +       preempt_enable_no_resched();
7705 +       return cr0 ^ X86_CR0_WP;
7706 +}
7707 +#else
7708 +static inline unsigned long native_pax_open_kernel(void) { return 0; }
7709 +static inline unsigned long native_pax_close_kernel(void) { return 0; }
7710 +#endif
7711 +
7712  /*
7713   * The following only work if pte_present() is true.
7714   * Undefined behaviour if not..
7715   */
7716 +static inline int pte_user(pte_t pte)
7717 +{
7718 +       return pte_val(pte) & _PAGE_USER;
7719 +}
7720 +
7721  static inline int pte_dirty(pte_t pte)
7722  {
7723         return pte_flags(pte) & _PAGE_DIRTY;
7724 @@ -169,9 +208,29 @@ static inline pte_t pte_wrprotect(pte_t
7725         return pte_clear_flags(pte, _PAGE_RW);
7726  }
7727
7728 +static inline pte_t pte_mkread(pte_t pte)
7729 +{
7730 +       return __pte(pte_val(pte) | _PAGE_USER);
7731 +}
7732 +
7733  static inline pte_t pte_mkexec(pte_t pte)
7734  {
7735 -       return pte_clear_flags(pte, _PAGE_NX);
7736 +#ifdef CONFIG_X86_PAE
7737 +       if (__supported_pte_mask & _PAGE_NX)
7738 +               return pte_clear_flags(pte, _PAGE_NX);
7739 +       else
7740 +#endif
7741 +               return pte_set_flags(pte, _PAGE_USER);
7742 +}
7743 +
7744 +static inline pte_t pte_exprotect(pte_t pte)
7745 +{
7746 +#ifdef CONFIG_X86_PAE
7747 +       if (__supported_pte_mask & _PAGE_NX)
7748 +               return pte_set_flags(pte, _PAGE_NX);
7749 +       else
7750 +#endif
7751 +               return pte_clear_flags(pte, _PAGE_USER);
7752  }
7753
7754  static inline pte_t pte_mkdirty(pte_t pte)
7755 @@ -474,7 +533,7 @@ static inline pud_t *pud_offset(pgd_t *p
7756
7757  static inline int pgd_bad(pgd_t pgd)
7758  {
7759 -       return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
7760 +       return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
7761  }
7762
7763  static inline int pgd_none(pgd_t pgd)
7764 @@ -613,9 +672,12 @@ static inline void ptep_set_wrprotect(st
7765   * dst and src can be on the same page, but the range must not overlap,
7766   * and must not cross a page boundary.
7767   */
7768 -static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
7769 +static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
7770  {
7771 -       memcpy(dst, src, count * sizeof(pgd_t));
7772 +       pax_open_kernel();
7773 +       while (count--)
7774 +               *dst++ = *src++;
7775 +       pax_close_kernel();
7776  }
7777
7778
7779 diff -urNp linux-2.6.33/arch/x86/include/asm/pgtable_types.h linux-2.6.33/arch/x86/include/asm/pgtable_types.h
7780 --- linux-2.6.33/arch/x86/include/asm/pgtable_types.h   2010-02-24 13:52:17.000000000 -0500
7781 +++ linux-2.6.33/arch/x86/include/asm/pgtable_types.h   2010-03-07 12:23:35.921647784 -0500
7782 @@ -16,12 +16,11 @@
7783  #define _PAGE_BIT_PSE          7       /* 4 MB (or 2MB) page */
7784  #define _PAGE_BIT_PAT          7       /* on 4KB pages */
7785  #define _PAGE_BIT_GLOBAL       8       /* Global TLB entry PPro+ */
7786 -#define _PAGE_BIT_UNUSED1      9       /* available for programmer */
7787 +#define _PAGE_BIT_SPECIAL      9       /* special mappings, no associated struct page */
7788  #define _PAGE_BIT_IOMAP                10      /* flag used to indicate IO mapping */
7789  #define _PAGE_BIT_HIDDEN       11      /* hidden by kmemcheck */
7790  #define _PAGE_BIT_PAT_LARGE    12      /* On 2MB or 1GB pages */
7791 -#define _PAGE_BIT_SPECIAL      _PAGE_BIT_UNUSED1
7792 -#define _PAGE_BIT_CPA_TEST     _PAGE_BIT_UNUSED1
7793 +#define _PAGE_BIT_CPA_TEST     _PAGE_BIT_SPECIAL
7794  #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
7795
7796  /* If _PAGE_BIT_PRESENT is clear, we use these: */
7797 @@ -39,7 +38,6 @@
7798  #define _PAGE_DIRTY    (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
7799  #define _PAGE_PSE      (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
7800  #define _PAGE_GLOBAL   (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
7801 -#define _PAGE_UNUSED1  (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
7802  #define _PAGE_IOMAP    (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
7803  #define _PAGE_PAT      (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
7804  #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
7805 @@ -55,8 +53,10 @@
7806
7807  #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
7808  #define _PAGE_NX       (_AT(pteval_t, 1) << _PAGE_BIT_NX)
7809 -#else
7810 +#elif defined(CONFIG_KMEMCHECK)
7811  #define _PAGE_NX       (_AT(pteval_t, 0))
7812 +#else
7813 +#define _PAGE_NX       (_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
7814  #endif
7815
7816  #define _PAGE_FILE     (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
7817 @@ -93,6 +93,9 @@
7818  #define PAGE_READONLY_EXEC     __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
7819                                          _PAGE_ACCESSED)
7820
7821 +#define PAGE_READONLY_NOEXEC PAGE_READONLY
7822 +#define PAGE_SHARED_NOEXEC PAGE_SHARED
7823 +
7824  #define __PAGE_KERNEL_EXEC                                             \
7825         (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
7826  #define __PAGE_KERNEL          (__PAGE_KERNEL_EXEC | _PAGE_NX)
7827 @@ -103,8 +106,8 @@
7828  #define __PAGE_KERNEL_WC               (__PAGE_KERNEL | _PAGE_CACHE_WC)
7829  #define __PAGE_KERNEL_NOCACHE          (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
7830  #define __PAGE_KERNEL_UC_MINUS         (__PAGE_KERNEL | _PAGE_PCD)
7831 -#define __PAGE_KERNEL_VSYSCALL         (__PAGE_KERNEL_RX | _PAGE_USER)
7832 -#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
7833 +#define __PAGE_KERNEL_VSYSCALL         (__PAGE_KERNEL_RO | _PAGE_USER)
7834 +#define __PAGE_KERNEL_VSYSCALL_NOCACHE (__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
7835  #define __PAGE_KERNEL_LARGE            (__PAGE_KERNEL | _PAGE_PSE)
7836  #define __PAGE_KERNEL_LARGE_NOCACHE    (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
7837  #define __PAGE_KERNEL_LARGE_EXEC       (__PAGE_KERNEL_EXEC | _PAGE_PSE)
7838 @@ -163,8 +166,8 @@
7839   * bits are combined, this will alow user to access the high address mapped
7840   * VDSO in the presence of CONFIG_COMPAT_VDSO
7841   */
7842 -#define PTE_IDENT_ATTR  0x003          /* PRESENT+RW */
7843 -#define PDE_IDENT_ATTR  0x067          /* PRESENT+RW+USER+DIRTY+ACCESSED */
7844 +#define PTE_IDENT_ATTR  0x063          /* PRESENT+RW+DIRTY+ACCESSED */
7845 +#define PDE_IDENT_ATTR  0x063          /* PRESENT+RW+DIRTY+ACCESSED */
7846  #define PGD_IDENT_ATTR  0x001          /* PRESENT (no other attributes) */
7847  #endif
7848
7849 @@ -278,7 +281,6 @@ typedef struct page *pgtable_t;
7850
7851  extern pteval_t __supported_pte_mask;
7852  extern void set_nx(void);
7853 -extern int nx_enabled;
7854
7855  #define pgprot_writecombine    pgprot_writecombine
7856  extern pgprot_t pgprot_writecombine(pgprot_t prot);
7857 diff -urNp linux-2.6.33/arch/x86/include/asm/processor.h linux-2.6.33/arch/x86/include/asm/processor.h
7858 --- linux-2.6.33/arch/x86/include/asm/processor.h       2010-02-24 13:52:17.000000000 -0500
7859 +++ linux-2.6.33/arch/x86/include/asm/processor.h       2010-03-07 12:23:35.921647784 -0500
7860 @@ -273,7 +273,7 @@ struct tss_struct {
7861
7862  } ____cacheline_aligned;
7863
7864 -DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
7865 +extern struct tss_struct init_tss[NR_CPUS];
7866
7867  /*
7868   * Save the original ist values for checking stack pointers during debugging
7869 @@ -913,8 +913,15 @@ static inline void spin_lock_prefetch(co
7870   */
7871  #define TASK_SIZE              PAGE_OFFSET
7872  #define TASK_SIZE_MAX          TASK_SIZE
7873 +
7874 +#ifdef CONFIG_PAX_SEGMEXEC
7875 +#define SEGMEXEC_TASK_SIZE     (TASK_SIZE / 2)
7876 +#define STACK_TOP              ((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
7877 +#else
7878  #define STACK_TOP              TASK_SIZE
7879 -#define STACK_TOP_MAX          STACK_TOP
7880 +#endif
7881 +
7882 +#define STACK_TOP_MAX          TASK_SIZE
7883
7884  #define INIT_THREAD  {                                                   \
7885         .sp0                    = sizeof(init_stack) + (long)&init_stack, \
7886 @@ -931,7 +938,7 @@ static inline void spin_lock_prefetch(co
7887   */
7888  #define INIT_TSS  {                                                      \
7889         .x86_tss = {                                                      \
7890 -               .sp0            = sizeof(init_stack) + (long)&init_stack, \
7891 +               .sp0            = sizeof(init_stack) + (long)&init_stack - 8, \
7892                 .ss0            = __KERNEL_DS,                            \
7893                 .ss1            = __KERNEL_CS,                            \
7894                 .io_bitmap_base = INVALID_IO_BITMAP_OFFSET,               \
7895 @@ -942,11 +949,7 @@ static inline void spin_lock_prefetch(co
7896  extern unsigned long thread_saved_pc(struct task_struct *tsk);
7897
7898  #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
7899 -#define KSTK_TOP(info)                                                 \
7900 -({                                                                     \
7901 -       unsigned long *__ptr = (unsigned long *)(info);                 \
7902 -       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
7903 -})
7904 +#define KSTK_TOP(info)         ((info)->task.thread.sp0)
7905
7906  /*
7907   * The below -8 is to reserve 8 bytes on top of the ring0 stack.
7908 @@ -961,7 +964,7 @@ extern unsigned long thread_saved_pc(str
7909  #define task_pt_regs(task)                                             \
7910  ({                                                                     \
7911         struct pt_regs *__regs__;                                       \
7912 -       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
7913 +       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
7914         __regs__ - 1;                                                   \
7915  })
7916
7917 @@ -977,7 +980,7 @@ extern unsigned long thread_saved_pc(str
7918   * space during mmap's.
7919   */
7920  #define IA32_PAGE_OFFSET       ((current->personality & ADDR_LIMIT_3GB) ? \
7921 -                                       0xc0000000 : 0xFFFFe000)
7922 +                                       0xc0000000 : 0xFFFFf000)
7923
7924  #define TASK_SIZE              (test_thread_flag(TIF_IA32) ? \
7925                                         IA32_PAGE_OFFSET : TASK_SIZE_MAX)
7926 @@ -1014,6 +1017,10 @@ extern void start_thread(struct pt_regs
7927   */
7928  #define TASK_UNMAPPED_BASE     (PAGE_ALIGN(TASK_SIZE / 3))
7929
7930 +#ifdef CONFIG_PAX_SEGMEXEC
7931 +#define SEGMEXEC_TASK_UNMAPPED_BASE    (PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
7932 +#endif
7933 +
7934  #define KSTK_EIP(task)         (task_pt_regs(task)->ip)
7935
7936  /* Get/set a process' ability to use the timestamp counter instruction */
7937 diff -urNp linux-2.6.33/arch/x86/include/asm/ptrace.h linux-2.6.33/arch/x86/include/asm/ptrace.h
7938 --- linux-2.6.33/arch/x86/include/asm/ptrace.h  2010-02-24 13:52:17.000000000 -0500
7939 +++ linux-2.6.33/arch/x86/include/asm/ptrace.h  2010-03-07 12:23:35.921647784 -0500
7940 @@ -152,28 +152,29 @@ static inline unsigned long regs_return_
7941  }
7942
7943  /*
7944 - * user_mode_vm(regs) determines whether a register set came from user mode.
7945 + * user_mode(regs) determines whether a register set came from user mode.
7946   * This is true if V8086 mode was enabled OR if the register set was from
7947   * protected mode with RPL-3 CS value.  This tricky test checks that with
7948   * one comparison.  Many places in the kernel can bypass this full check
7949 - * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
7950 + * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
7951 + * be used.
7952   */
7953 -static inline int user_mode(struct pt_regs *regs)
7954 +static inline int user_mode_novm(struct pt_regs *regs)
7955  {
7956  #ifdef CONFIG_X86_32
7957         return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
7958  #else
7959 -       return !!(regs->cs & 3);
7960 +       return !!(regs->cs & SEGMENT_RPL_MASK);
7961  #endif
7962  }
7963
7964 -static inline int user_mode_vm(struct pt_regs *regs)
7965 +static inline int user_mode(struct pt_regs *regs)
7966  {
7967  #ifdef CONFIG_X86_32
7968         return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
7969                 USER_RPL;
7970  #else
7971 -       return user_mode(regs);
7972 +       return user_mode_novm(regs);
7973  #endif
7974  }
7975
7976 diff -urNp linux-2.6.33/arch/x86/include/asm/reboot.h linux-2.6.33/arch/x86/include/asm/reboot.h
7977 --- linux-2.6.33/arch/x86/include/asm/reboot.h  2010-02-24 13:52:17.000000000 -0500
7978 +++ linux-2.6.33/arch/x86/include/asm/reboot.h  2010-03-07 12:23:35.921647784 -0500
7979 @@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
7980
7981  void native_machine_crash_shutdown(struct pt_regs *regs);
7982  void native_machine_shutdown(void);
7983 -void machine_real_restart(const unsigned char *code, int length);
7984 +void machine_real_restart(const unsigned char *code, unsigned int length);
7985
7986  typedef void (*nmi_shootdown_cb)(int, struct die_args*);
7987  void nmi_shootdown_cpus(nmi_shootdown_cb callback);
7988 diff -urNp linux-2.6.33/arch/x86/include/asm/rwsem.h linux-2.6.33/arch/x86/include/asm/rwsem.h
7989 --- linux-2.6.33/arch/x86/include/asm/rwsem.h   2010-02-24 13:52:17.000000000 -0500
7990 +++ linux-2.6.33/arch/x86/include/asm/rwsem.h   2010-03-07 12:23:35.925702533 -0500
7991 @@ -106,10 +106,26 @@ static inline void __down_read(struct rw
7992  {
7993         asm volatile("# beginning down_read\n\t"
7994                      LOCK_PREFIX "  incl      (%%eax)\n\t"
7995 +
7996 +#ifdef CONFIG_PAX_REFCOUNT
7997 +#ifdef CONFIG_X86_32
7998 +                    "into\n0:\n"
7999 +#else
8000 +                    "jno 0f\n"
8001 +                    "int $4\n0:\n"
8002 +#endif
8003 +                    ".pushsection .fixup,\"ax\"\n"
8004 +                    "1:\n"
8005 +                    LOCK_PREFIX "decl (%%eax)\n"
8006 +                    "jmp 0b\n"
8007 +                    ".popsection\n"
8008 +                    _ASM_EXTABLE(0b, 1b)
8009 +#endif
8010 +
8011                      /* adds 0x00000001, returns the old value */
8012 -                    "  jns        1f\n"
8013 +                    "  jns        2f\n"
8014                      "  call call_rwsem_down_read_failed\n"
8015 -                    "1:\n\t"
8016 +                    "2:\n\t"
8017                      "# ending down_read\n\t"
8018                      : "+m" (sem->count)
8019                      : "a" (sem)
8020 @@ -124,13 +140,29 @@ static inline int __down_read_trylock(st
8021         __s32 result, tmp;
8022         asm volatile("# beginning __down_read_trylock\n\t"
8023                      "  movl      %0,%1\n\t"
8024 -                    "1:\n\t"
8025 +                    "2:\n\t"
8026                      "  movl         %1,%2\n\t"
8027                      "  addl      %3,%2\n\t"
8028 -                    "  jle          2f\n\t"
8029 +
8030 +#ifdef CONFIG_PAX_REFCOUNT
8031 +#ifdef CONFIG_X86_32
8032 +                    "into\n0:\n"
8033 +#else
8034 +                    "jno 0f\n"
8035 +                    "int $4\n0:\n"
8036 +#endif
8037 +                    ".pushsection .fixup,\"ax\"\n"
8038 +                    "1:\n"
8039 +                    "subl %3,%2\n"
8040 +                    "jmp 0b\n"
8041 +                    ".popsection\n"
8042 +                    _ASM_EXTABLE(0b, 1b)
8043 +#endif
8044 +
8045 +                    "  jle          3f\n\t"
8046                      LOCK_PREFIX "  cmpxchgl  %2,%0\n\t"
8047 -                    "  jnz          1b\n\t"
8048 -                    "2:\n\t"
8049 +                    "  jnz          2b\n\t"
8050 +                    "3:\n\t"
8051                      "# ending __down_read_trylock\n\t"
8052                      : "+m" (sem->count), "=&a" (result), "=&r" (tmp)
8053                      : "i" (RWSEM_ACTIVE_READ_BIAS)
8054 @@ -148,12 +180,28 @@ static inline void __down_write_nested(s
8055         tmp = RWSEM_ACTIVE_WRITE_BIAS;
8056         asm volatile("# beginning down_write\n\t"
8057                      LOCK_PREFIX "  xadd      %%edx,(%%eax)\n\t"
8058 +
8059 +#ifdef CONFIG_PAX_REFCOUNT
8060 +#ifdef CONFIG_X86_32
8061 +                    "into\n0:\n"
8062 +#else
8063 +                    "jno 0f\n"
8064 +                    "int $4\n0:\n"
8065 +#endif
8066 +                    ".pushsection .fixup,\"ax\"\n"
8067 +                    "1:\n"
8068 +                    "movl %%edx,(%%eax)\n"
8069 +                    "jmp 0b\n"
8070 +                    ".popsection\n"
8071 +                    _ASM_EXTABLE(0b, 1b)
8072 +#endif
8073 +
8074                      /* subtract 0x0000ffff, returns the old value */
8075                      "  testl     %%edx,%%edx\n\t"
8076                      /* was the count 0 before? */
8077 -                    "  jz        1f\n"
8078 +                    "  jz        2f\n"
8079                      "  call call_rwsem_down_write_failed\n"
8080 -                    "1:\n"
8081 +                    "2:\n"
8082                      "# ending down_write"
8083                      : "+m" (sem->count), "=d" (tmp)
8084                      : "a" (sem), "1" (tmp)
8085 @@ -186,10 +234,26 @@ static inline void __up_read(struct rw_s
8086         __s32 tmp = -RWSEM_ACTIVE_READ_BIAS;
8087         asm volatile("# beginning __up_read\n\t"
8088                      LOCK_PREFIX "  xadd      %%edx,(%%eax)\n\t"
8089 +
8090 +#ifdef CONFIG_PAX_REFCOUNT
8091 +#ifdef CONFIG_X86_32
8092 +                    "into\n0:\n"
8093 +#else
8094 +                    "jno 0f\n"
8095 +                    "int $4\n0:\n"
8096 +#endif
8097 +                    ".pushsection .fixup,\"ax\"\n"
8098 +                    "1:\n"
8099 +                    "movl %%edx,(%%eax)\n"
8100 +                    "jmp 0b\n"
8101 +                    ".popsection\n"
8102 +                    _ASM_EXTABLE(0b, 1b)
8103 +#endif
8104 +
8105                      /* subtracts 1, returns the old value */
8106 -                    "  jns        1f\n\t"
8107 +                    "  jns        2f\n\t"
8108                      "  call call_rwsem_wake\n"
8109 -                    "1:\n"
8110 +                    "2:\n"
8111                      "# ending __up_read\n"
8112                      : "+m" (sem->count), "=d" (tmp)
8113                      : "a" (sem), "1" (tmp)
8114 @@ -204,11 +268,27 @@ static inline void __up_write(struct rw_
8115         asm volatile("# beginning __up_write\n\t"
8116                      "  movl      %2,%%edx\n\t"
8117                      LOCK_PREFIX "  xaddl     %%edx,(%%eax)\n\t"
8118 +
8119 +#ifdef CONFIG_PAX_REFCOUNT
8120 +#ifdef CONFIG_X86_32
8121 +                    "into\n0:\n"
8122 +#else
8123 +                    "jno 0f\n"
8124 +                    "int $4\n0:\n"
8125 +#endif
8126 +                    ".pushsection .fixup,\"ax\"\n"
8127 +                    "1:\n"
8128 +                    "movl %%edx,(%%eax)\n"
8129 +                    "jmp 0b\n"
8130 +                    ".popsection\n"
8131 +                    _ASM_EXTABLE(0b, 1b)
8132 +#endif
8133 +
8134                      /* tries to transition
8135                         0xffff0001 -> 0x00000000 */
8136 -                    "  jz       1f\n"
8137 +                    "  jz       2f\n"
8138                      "  call call_rwsem_wake\n"
8139 -                    "1:\n\t"
8140 +                    "2:\n\t"
8141                      "# ending __up_write\n"
8142                      : "+m" (sem->count)
8143                      : "a" (sem), "i" (-RWSEM_ACTIVE_WRITE_BIAS)
8144 @@ -222,10 +302,26 @@ static inline void __downgrade_write(str
8145  {
8146         asm volatile("# beginning __downgrade_write\n\t"
8147                      LOCK_PREFIX "  addl      %2,(%%eax)\n\t"
8148 +
8149 +#ifdef CONFIG_PAX_REFCOUNT
8150 +#ifdef CONFIG_X86_32
8151 +                    "into\n0:\n"
8152 +#else
8153 +                    "jno 0f\n"
8154 +                    "int $4\n0:\n"
8155 +#endif
8156 +                    ".pushsection .fixup,\"ax\"\n"
8157 +                    "1:\n"
8158 +                    LOCK_PREFIX "subl %2,(%%eax)\n"
8159 +                    "jmp 0b\n"
8160 +                    ".popsection\n"
8161 +                    _ASM_EXTABLE(0b, 1b)
8162 +#endif
8163 +
8164                      /* transitions 0xZZZZ0001 -> 0xYYYY0001 */
8165 -                    "  jns       1f\n\t"
8166 +                    "  jns       2f\n\t"
8167                      "  call call_rwsem_downgrade_wake\n"
8168 -                    "1:\n\t"
8169 +                    "2:\n\t"
8170                      "# ending __downgrade_write\n"
8171                      : "+m" (sem->count)
8172                      : "a" (sem), "i" (-RWSEM_WAITING_BIAS)
8173 @@ -237,7 +333,23 @@ static inline void __downgrade_write(str
8174   */
8175  static inline void rwsem_atomic_add(int delta, struct rw_semaphore *sem)
8176  {
8177 -       asm volatile(LOCK_PREFIX "addl %1,%0"
8178 +       asm volatile(LOCK_PREFIX "addl %1,%0\n"
8179 +
8180 +#ifdef CONFIG_PAX_REFCOUNT
8181 +#ifdef CONFIG_X86_32
8182 +                    "into\n0:\n"
8183 +#else
8184 +                    "jno 0f\n"
8185 +                    "int $4\n0:\n"
8186 +#endif
8187 +                    ".pushsection .fixup,\"ax\"\n"
8188 +                    "1:\n"
8189 +                    LOCK_PREFIX "subl %1,%0\n"
8190 +                    "jmp 0b\n"
8191 +                    ".popsection\n"
8192 +                    _ASM_EXTABLE(0b, 1b)
8193 +#endif
8194 +
8195                      : "+m" (sem->count)
8196                      : "ir" (delta));
8197  }
8198 @@ -249,7 +361,23 @@ static inline int rwsem_atomic_update(in
8199  {
8200         int tmp = delta;
8201
8202 -       asm volatile(LOCK_PREFIX "xadd %0,%1"
8203 +       asm volatile(LOCK_PREFIX "xadd %0,%1\n"
8204 +
8205 +#ifdef CONFIG_PAX_REFCOUNT
8206 +#ifdef CONFIG_X86_32
8207 +                    "into\n0:\n"
8208 +#else
8209 +                    "jno 0f\n"
8210 +                    "int $4\n0:\n"
8211 +#endif
8212 +                    ".pushsection .fixup,\"ax\"\n"
8213 +                    "1:\n"
8214 +                    "movl %0,%1\n"
8215 +                    "jmp 0b\n"
8216 +                    ".popsection\n"
8217 +                    _ASM_EXTABLE(0b, 1b)
8218 +#endif
8219 +
8220                      : "+r" (tmp), "+m" (sem->count)
8221                      : : "memory");
8222
8223 diff -urNp linux-2.6.33/arch/x86/include/asm/segment.h linux-2.6.33/arch/x86/include/asm/segment.h
8224 --- linux-2.6.33/arch/x86/include/asm/segment.h 2010-02-24 13:52:17.000000000 -0500
8225 +++ linux-2.6.33/arch/x86/include/asm/segment.h 2010-03-07 12:23:35.925702533 -0500
8226 @@ -62,8 +62,8 @@
8227   *  26 - ESPFIX small SS
8228   *  27 - per-cpu                       [ offset to per-cpu data area ]
8229   *  28 - stack_canary-20               [ for stack protector ]
8230 - *  29 - unused
8231 - *  30 - unused
8232 + *  29 - PCI BIOS CS
8233 + *  30 - PCI BIOS DS
8234   *  31 - TSS for double fault handler
8235   */
8236  #define GDT_ENTRY_TLS_MIN      6
8237 @@ -77,6 +77,8 @@
8238
8239  #define GDT_ENTRY_KERNEL_CS            (GDT_ENTRY_KERNEL_BASE + 0)
8240
8241 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS   (4)
8242 +
8243  #define GDT_ENTRY_KERNEL_DS            (GDT_ENTRY_KERNEL_BASE + 1)
8244
8245  #define GDT_ENTRY_TSS                  (GDT_ENTRY_KERNEL_BASE + 4)
8246 @@ -88,7 +90,7 @@
8247  #define GDT_ENTRY_ESPFIX_SS            (GDT_ENTRY_KERNEL_BASE + 14)
8248  #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
8249
8250 -#define GDT_ENTRY_PERCPU                       (GDT_ENTRY_KERNEL_BASE + 15)
8251 +#define GDT_ENTRY_PERCPU               (GDT_ENTRY_KERNEL_BASE + 15)
8252  #ifdef CONFIG_SMP
8253  #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
8254  #else
8255 @@ -102,6 +104,12 @@
8256  #define __KERNEL_STACK_CANARY          0
8257  #endif
8258
8259 +#define GDT_ENTRY_PCIBIOS_CS           (GDT_ENTRY_KERNEL_BASE + 17)
8260 +#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
8261 +
8262 +#define GDT_ENTRY_PCIBIOS_DS           (GDT_ENTRY_KERNEL_BASE + 18)
8263 +#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
8264 +
8265  #define GDT_ENTRY_DOUBLEFAULT_TSS      31
8266
8267  /*
8268 @@ -139,7 +147,7 @@
8269   */
8270
8271  /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
8272 -#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
8273 +#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
8274
8275
8276  #else
8277 @@ -163,6 +171,8 @@
8278  #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
8279  #define __USER32_DS    __USER_DS
8280
8281 +#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
8282 +
8283  #define GDT_ENTRY_TSS 8        /* needs two entries */
8284  #define GDT_ENTRY_LDT 10 /* needs two entries */
8285  #define GDT_ENTRY_TLS_MIN 12
8286 @@ -183,6 +193,7 @@
8287  #endif
8288
8289  #define __KERNEL_CS    (GDT_ENTRY_KERNEL_CS * 8)
8290 +#define __KERNEXEC_KERNEL_CS   (GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
8291  #define __KERNEL_DS    (GDT_ENTRY_KERNEL_DS * 8)
8292  #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
8293  #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
8294 diff -urNp linux-2.6.33/arch/x86/include/asm/spinlock.h linux-2.6.33/arch/x86/include/asm/spinlock.h
8295 --- linux-2.6.33/arch/x86/include/asm/spinlock.h        2010-02-24 13:52:17.000000000 -0500
8296 +++ linux-2.6.33/arch/x86/include/asm/spinlock.h        2010-03-07 12:23:35.925702533 -0500
8297 @@ -249,18 +249,50 @@ static inline int arch_write_can_lock(ar
8298  static inline void arch_read_lock(arch_rwlock_t *rw)
8299  {
8300         asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
8301 -                    "jns 1f\n"
8302 -                    "call __read_lock_failed\n\t"
8303 +
8304 +#ifdef CONFIG_PAX_REFCOUNT
8305 +#ifdef CONFIG_X86_32
8306 +                    "into\n0:\n"
8307 +#else
8308 +                    "jno 0f\n"
8309 +                    "int $4\n0:\n"
8310 +#endif
8311 +                    ".pushsection .fixup,\"ax\"\n"
8312                      "1:\n"
8313 +                    LOCK_PREFIX " addl $1,(%0)\n"
8314 +                    "jmp 0b\n"
8315 +                    ".popsection\n"
8316 +                    _ASM_EXTABLE(0b, 1b)
8317 +#endif
8318 +
8319 +                    "jns 2f\n"
8320 +                    "call __read_lock_failed\n\t"
8321 +                    "2:\n"
8322                      ::LOCK_PTR_REG (rw) : "memory");
8323  }
8324
8325  static inline void arch_write_lock(arch_rwlock_t *rw)
8326  {
8327         asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
8328 -                    "jz 1f\n"
8329 -                    "call __write_lock_failed\n\t"
8330 +
8331 +#ifdef CONFIG_PAX_REFCOUNT
8332 +#ifdef CONFIG_X86_32
8333 +                    "into\n0:\n"
8334 +#else
8335 +                    "jno 0f\n"
8336 +                    "int $4\n0:\n"
8337 +#endif
8338 +                    ".pushsection .fixup,\"ax\"\n"
8339                      "1:\n"
8340 +                    LOCK_PREFIX " addl %1,(%0)\n"
8341 +                    "jmp 0b\n"
8342 +                    ".popsection\n"
8343 +                    _ASM_EXTABLE(0b, 1b)
8344 +#endif
8345 +
8346 +                    "jz 2f\n"
8347 +                    "call __write_lock_failed\n\t"
8348 +                    "2:\n"
8349                      ::LOCK_PTR_REG (rw), "i" (RW_LOCK_BIAS) : "memory");
8350  }
8351
8352 @@ -286,12 +318,45 @@ static inline int arch_write_trylock(arc
8353
8354  static inline void arch_read_unlock(arch_rwlock_t *rw)
8355  {
8356 -       asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
8357 +       asm volatile(LOCK_PREFIX "incl %0\n"
8358 +
8359 +#ifdef CONFIG_PAX_REFCOUNT
8360 +#ifdef CONFIG_X86_32
8361 +                    "into\n0:\n"
8362 +#else
8363 +                    "jno 0f\n"
8364 +                    "int $4\n0:\n"
8365 +#endif
8366 +                    ".pushsection .fixup,\"ax\"\n"
8367 +                    "1:\n"
8368 +                    LOCK_PREFIX "decl %0\n"
8369 +                    "jmp 0b\n"
8370 +                    ".popsection\n"
8371 +                    _ASM_EXTABLE(0b, 1b)
8372 +#endif
8373 +
8374 +                    :"+m" (rw->lock) : : "memory");
8375  }
8376
8377  static inline void arch_write_unlock(arch_rwlock_t *rw)
8378  {
8379 -       asm volatile(LOCK_PREFIX "addl %1, %0"
8380 +       asm volatile(LOCK_PREFIX "addl %1, %0\n"
8381 +
8382 +#ifdef CONFIG_PAX_REFCOUNT
8383 +#ifdef CONFIG_X86_32
8384 +                    "into\n0:\n"
8385 +#else
8386 +                    "jno 0f\n"
8387 +                    "int $4\n0:\n"
8388 +#endif
8389 +                    ".pushsection .fixup,\"ax\"\n"
8390 +                    "1:\n"
8391 +                    LOCK_PREFIX "subl %1,%0\n"
8392 +                    "jmp 0b\n"
8393 +                    ".popsection\n"
8394 +                    _ASM_EXTABLE(0b, 1b)
8395 +#endif
8396 +
8397                      : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
8398  }
8399
8400 diff -urNp linux-2.6.33/arch/x86/include/asm/system.h linux-2.6.33/arch/x86/include/asm/system.h
8401 --- linux-2.6.33/arch/x86/include/asm/system.h  2010-02-24 13:52:17.000000000 -0500
8402 +++ linux-2.6.33/arch/x86/include/asm/system.h  2010-03-07 12:23:35.925702533 -0500
8403 @@ -202,7 +202,7 @@ static inline unsigned long get_limit(un
8404  {
8405         unsigned long __limit;
8406         asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
8407 -       return __limit + 1;
8408 +       return __limit;
8409  }
8410
8411  static inline void native_clts(void)
8412 @@ -342,7 +342,7 @@ void enable_hlt(void);
8413
8414  void cpu_idle_wait(void);
8415
8416 -extern unsigned long arch_align_stack(unsigned long sp);
8417 +#define arch_align_stack(x) ((x) & ~0xfUL)
8418  extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
8419
8420  void default_idle(void);
8421 diff -urNp linux-2.6.33/arch/x86/include/asm/uaccess_32.h linux-2.6.33/arch/x86/include/asm/uaccess_32.h
8422 --- linux-2.6.33/arch/x86/include/asm/uaccess_32.h      2010-02-24 13:52:17.000000000 -0500
8423 +++ linux-2.6.33/arch/x86/include/asm/uaccess_32.h      2010-03-07 12:23:35.925702533 -0500
8424 @@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
8425  static __always_inline unsigned long __must_check
8426  __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
8427  {
8428 +       if ((long)n < 0)
8429 +               return n;
8430 +
8431         if (__builtin_constant_p(n)) {
8432                 unsigned long ret;
8433
8434 @@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
8435                         return ret;
8436                 }
8437         }
8438 +       if (!__builtin_constant_p(n))
8439 +               check_object_size(from, n, true);
8440         return __copy_to_user_ll(to, from, n);
8441  }
8442
8443 @@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
8444  static __always_inline unsigned long
8445  __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
8446  {
8447 +       if ((long)n < 0)
8448 +               return n;
8449 +
8450         /* Avoid zeroing the tail if the copy fails..
8451          * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
8452          * but as the zeroing behaviour is only significant when n is not
8453 @@ -138,6 +146,10 @@ static __always_inline unsigned long
8454  __copy_from_user(void *to, const void __user *from, unsigned long n)
8455  {
8456         might_fault();
8457 +
8458 +       if ((long)n < 0)
8459 +               return n;
8460 +
8461         if (__builtin_constant_p(n)) {
8462                 unsigned long ret;
8463
8464 @@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
8465                         return ret;
8466                 }
8467         }
8468 +       if (!__builtin_constant_p(n))
8469 +               check_object_size(to, n, false);
8470         return __copy_from_user_ll(to, from, n);
8471  }
8472
8473 @@ -160,6 +174,10 @@ static __always_inline unsigned long __c
8474                                 const void __user *from, unsigned long n)
8475  {
8476         might_fault();
8477 +
8478 +       if ((long)n < 0)
8479 +               return n;
8480 +
8481         if (__builtin_constant_p(n)) {
8482                 unsigned long ret;
8483
8484 @@ -182,15 +200,19 @@ static __always_inline unsigned long
8485  __copy_from_user_inatomic_nocache(void *to, const void __user *from,
8486                                   unsigned long n)
8487  {
8488 -       return __copy_from_user_ll_nocache_nozero(to, from, n);
8489 -}
8490 +       if ((long)n < 0)
8491 +               return n;
8492
8493 -unsigned long __must_check copy_to_user(void __user *to,
8494 -                                       const void *from, unsigned long n);
8495 -unsigned long __must_check _copy_from_user(void *to,
8496 -                                         const void __user *from,
8497 -                                         unsigned long n);
8498 +       return __copy_from_user_ll_nocache_nozero(to, from, n);
8499 +}
8500
8501 +extern void copy_to_user_overflow(void)
8502 +#ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
8503 +       __compiletime_error("copy_to_user() buffer size is not provably correct")
8504 +#else
8505 +       __compiletime_warning("copy_to_user() buffer size is not provably correct")
8506 +#endif
8507 +;
8508
8509  extern void copy_from_user_overflow(void)
8510  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
8511 @@ -200,17 +222,61 @@ extern void copy_from_user_overflow(void
8512  #endif
8513  ;
8514
8515 -static inline unsigned long __must_check copy_from_user(void *to,
8516 -                                         const void __user *from,
8517 -                                         unsigned long n)
8518 +/**
8519 + * copy_to_user: - Copy a block of data into user space.
8520 + * @to:   Destination address, in user space.
8521 + * @from: Source address, in kernel space.
8522 + * @n:    Number of bytes to copy.
8523 + *
8524 + * Context: User context only.  This function may sleep.
8525 + *
8526 + * Copy data from kernel space to user space.
8527 + *
8528 + * Returns number of bytes that could not be copied.
8529 + * On success, this will be zero.
8530 + */
8531 +static inline unsigned long __must_check
8532 +copy_to_user(void __user *to, const void *from, unsigned long n)
8533 +{
8534 +       int sz = __compiletime_object_size(from);
8535 +
8536 +       if (unlikely(sz != -1 && sz < n))
8537 +               copy_to_user_overflow();
8538 +       else if (access_ok(VERIFY_WRITE, to, n))
8539 +               n = __copy_to_user(to, from, n);
8540 +       return n;
8541 +}
8542 +
8543 +/**
8544 + * copy_from_user: - Copy a block of data from user space.
8545 + * @to:   Destination address, in kernel space.
8546 + * @from: Source address, in user space.
8547 + * @n:    Number of bytes to copy.
8548 + *
8549 + * Context: User context only.  This function may sleep.
8550 + *
8551 + * Copy data from user space to kernel space.
8552 + *
8553 + * Returns number of bytes that could not be copied.
8554 + * On success, this will be zero.
8555 + *
8556 + * If some data could not be copied, this function will pad the copied
8557 + * data to the requested size using zero bytes.
8558 + */
8559 +static inline unsigned long __must_check
8560 +copy_from_user(void *to, const void __user *from, unsigned long n)
8561  {
8562         int sz = __compiletime_object_size(to);
8563
8564 -       if (likely(sz == -1 || sz >= n))
8565 -               n = _copy_from_user(to, from, n);
8566 -       else
8567 +       if (unlikely(sz != -1 && sz < n))
8568                 copy_from_user_overflow();
8569 -
8570 +       else if (access_ok(VERIFY_READ, from, n))
8571 +               n = __copy_from_user(to, from, n);
8572 +       else if ((long)n > 0) {
8573 +               if (!__builtin_constant_p(n))
8574 +                       check_object_size(to, n, false);
8575 +               memset(to, 0, n);
8576 +       }
8577         return n;
8578  }
8579
8580 diff -urNp linux-2.6.33/arch/x86/include/asm/uaccess_64.h linux-2.6.33/arch/x86/include/asm/uaccess_64.h
8581 --- linux-2.6.33/arch/x86/include/asm/uaccess_64.h      2010-02-24 13:52:17.000000000 -0500
8582 +++ linux-2.6.33/arch/x86/include/asm/uaccess_64.h      2010-03-07 12:23:35.925702533 -0500
8583 @@ -10,6 +10,8 @@
8584  #include <linux/lockdep.h>
8585  #include <asm/page.h>
8586
8587 +#define set_fs(x)      (current_thread_info()->addr_limit = (x))
8588 +
8589  /*
8590   * Copy To/From Userspace
8591   */
8592 @@ -17,27 +19,26 @@
8593  /* Handles exceptions in both to and from, but doesn't do access_ok */
8594  __must_check unsigned long
8595  copy_user_generic(void *to, const void *from, unsigned len);
8596 -
8597 -__must_check unsigned long
8598 -_copy_to_user(void __user *to, const void *from, unsigned len);
8599 -__must_check unsigned long
8600 -_copy_from_user(void *to, const void __user *from, unsigned len);
8601 +static __always_inline __must_check unsigned long
8602 +__copy_to_user(void __user *to, const void *from, unsigned len);
8603 +static __always_inline __must_check unsigned long
8604 +__copy_from_user(void *to, const void __user *from, unsigned len);
8605  __must_check unsigned long
8606  copy_in_user(void __user *to, const void __user *from, unsigned len);
8607
8608  static inline unsigned long __must_check copy_from_user(void *to,
8609                                           const void __user *from,
8610 -                                         unsigned long n)
8611 +                                         unsigned n)
8612  {
8613 -       int sz = __compiletime_object_size(to);
8614 -
8615         might_fault();
8616 -       if (likely(sz == -1 || sz >= n))
8617 -               n = _copy_from_user(to, from, n);
8618 -#ifdef CONFIG_DEBUG_VM
8619 -       else
8620 -               WARN(1, "Buffer overflow detected!\n");
8621 -#endif
8622 +
8623 +       if (access_ok(VERIFY_READ, from, n))
8624 +               n = __copy_from_user(to, from, n);
8625 +       else if ((int)n > 0) {
8626 +               if (!__builtin_constant_p(n))
8627 +                       check_object_size(to, n, false);
8628 +               memset(to, 0, n);
8629 +       }
8630         return n;
8631  }
8632
8633 @@ -46,17 +47,33 @@ int copy_to_user(void __user *dst, const
8634  {
8635         might_fault();
8636
8637 -       return _copy_to_user(dst, src, size);
8638 +       if (access_ok(VERIFY_WRITE, dst, size))
8639 +               size = __copy_to_user(dst, src, size);
8640 +       return size;
8641  }
8642
8643  static __always_inline __must_check
8644 -int __copy_from_user(void *dst, const void __user *src, unsigned size)
8645 +unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
8646  {
8647 -       int ret = 0;
8648 +       int sz = __compiletime_object_size(dst);
8649 +       unsigned ret = 0;
8650
8651         might_fault();
8652 -       if (!__builtin_constant_p(size))
8653 +
8654 +       if ((int)size < 0)
8655 +               return size;
8656 +
8657 +       if (unlikely(sz != -1 && sz < size)) {
8658 +#ifdef CONFIG_DEBUG_VM
8659 +               WARN(1, "Buffer overflow detected!\n");
8660 +#endif
8661 +               return size;
8662 +       }
8663 +
8664 +       if (!__builtin_constant_p(size)) {
8665 +               check_object_size(dst, size, false);
8666                 return copy_user_generic(dst, (__force void *)src, size);
8667 +       }
8668         switch (size) {
8669         case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
8670                               ret, "b", "b", "=q", 1);
8671 @@ -94,13 +111,27 @@ int __copy_from_user(void *dst, const vo
8672  }
8673
8674  static __always_inline __must_check
8675 -int __copy_to_user(void __user *dst, const void *src, unsigned size)
8676 +unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
8677  {
8678 -       int ret = 0;
8679 +       int sz = __compiletime_object_size(src);
8680 +       unsigned ret = 0;
8681
8682         might_fault();
8683 -       if (!__builtin_constant_p(size))
8684 +
8685 +       if ((int)size < 0)
8686 +               return size;
8687 +
8688 +       if (unlikely(sz != -1 && sz < size)) {
8689 +#ifdef CONFIG_DEBUG_VM
8690 +               WARN(1, "Buffer overflow detected!\n");
8691 +#endif
8692 +               return size;
8693 +       }
8694 +
8695 +       if (!__builtin_constant_p(size)) {
8696 +               check_object_size(src, size, true);
8697                 return copy_user_generic((__force void *)dst, src, size);
8698 +       }
8699         switch (size) {
8700         case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
8701                               ret, "b", "b", "iq", 1);
8702 @@ -138,11 +169,15 @@ int __copy_to_user(void __user *dst, con
8703  }
8704
8705  static __always_inline __must_check
8706 -int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
8707 +unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
8708  {
8709 -       int ret = 0;
8710 +       unsigned ret = 0;
8711
8712         might_fault();
8713 +
8714 +       if ((int)size < 0)
8715 +               return size;
8716 +
8717         if (!__builtin_constant_p(size))
8718                 return copy_user_generic((__force void *)dst,
8719                                          (__force void *)src, size);
8720 @@ -206,30 +241,38 @@ __copy_from_user_inatomic(void *dst, con
8721         return copy_user_generic(dst, (__force const void *)src, size);
8722  }
8723
8724 -static __must_check __always_inline int
8725 +static __must_check __always_inline unsigned long
8726  __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
8727  {
8728 +       if ((int)size < 0)
8729 +               return size;
8730 +
8731         return copy_user_generic((__force void *)dst, src, size);
8732  }
8733
8734 -extern long __copy_user_nocache(void *dst, const void __user *src,
8735 +extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
8736                                 unsigned size, int zerorest);
8737
8738 -static inline int
8739 -__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
8740 +static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
8741  {
8742         might_sleep();
8743 +
8744 +       if ((int)size < 0)
8745 +               return size;
8746 +
8747         return __copy_user_nocache(dst, src, size, 1);
8748  }
8749
8750 -static inline int
8751 -__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
8752 +static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
8753                                   unsigned size)
8754  {
8755 +       if ((int)size < 0)
8756 +               return size;
8757 +
8758         return __copy_user_nocache(dst, src, size, 0);
8759  }
8760
8761 -unsigned long
8762 +extern unsigned long
8763  copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
8764
8765  #endif /* _ASM_X86_UACCESS_64_H */
8766 diff -urNp linux-2.6.33/arch/x86/include/asm/uaccess.h linux-2.6.33/arch/x86/include/asm/uaccess.h
8767 --- linux-2.6.33/arch/x86/include/asm/uaccess.h 2010-02-24 13:52:17.000000000 -0500
8768 +++ linux-2.6.33/arch/x86/include/asm/uaccess.h 2010-03-07 12:23:35.925702533 -0500
8769 @@ -8,8 +8,11 @@
8770  #include <linux/thread_info.h>
8771  #include <linux/prefetch.h>
8772  #include <linux/string.h>
8773 +#include <linux/sched.h>
8774 +#include <linux/slab.h>
8775  #include <asm/asm.h>
8776  #include <asm/page.h>
8777 +#include <asm/segment.h>
8778
8779  #define VERIFY_READ 0
8780  #define VERIFY_WRITE 1
8781 @@ -29,7 +32,12 @@
8782
8783  #define get_ds()       (KERNEL_DS)
8784  #define get_fs()       (current_thread_info()->addr_limit)
8785 +#ifdef CONFIG_X86_32
8786 +void __set_fs(mm_segment_t x, int cpu);
8787 +void set_fs(mm_segment_t x);
8788 +#else
8789  #define set_fs(x)      (current_thread_info()->addr_limit = (x))
8790 +#endif
8791
8792  #define segment_eq(a, b)       ((a).seg == (b).seg)
8793
8794 @@ -77,7 +85,29 @@
8795   * checks that the pointer is in the user space range - after calling
8796   * this function, memory access functions may still return -EFAULT.
8797   */
8798 -#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
8799 +#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
8800 +#define access_ok(type, addr, size)                                    \
8801 +({                                                                     \
8802 +       long __size = size;                                             \
8803 +       unsigned long __addr = (unsigned long)addr;                     \
8804 +       unsigned long __addr_ao = __addr & PAGE_MASK;                   \
8805 +       unsigned long __end_ao = __addr + __size - 1;                   \
8806 +       bool __ret_ao = __range_not_ok(__addr, __size) == 0;            \
8807 +       if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) { \
8808 +               for (; __addr_ao <= __end_ao; __addr_ao += PAGE_SIZE) { \
8809 +                       char __c_ao;                                    \
8810 +                       if (__size > PAGE_SIZE)                         \
8811 +                               cond_resched();                         \
8812 +                       if (__get_user(__c_ao, (char __user *)__addr_ao))\
8813 +                               break;                                  \
8814 +                       if (type != VERIFY_WRITE)                       \
8815 +                               continue;                               \
8816 +                       if (__put_user(__c_ao, (char __user *)__addr_ao))\
8817 +                               break;                                  \
8818 +               }                                                       \
8819 +       }                                                               \
8820 +       __ret_ao;                                                       \
8821 +})
8822
8823  /*
8824   * The exception table consists of pairs of addresses: the first is the
8825 @@ -183,13 +213,21 @@ extern int __get_user_bad(void);
8826         asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
8827                      : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
8828
8829 -
8830 +#ifdef CONFIG_X86_32
8831 +#define _ASM_LOAD_USER_DS(ds) "movw %w" #ds ",%%ds\n"
8832 +#define _ASM_LOAD_KERNEL_DS "pushl %%ss; popl %%ds\n"
8833 +#else
8834 +#define _ASM_LOAD_USER_DS(ds)
8835 +#define _ASM_LOAD_KERNEL_DS
8836 +#endif
8837
8838  #ifdef CONFIG_X86_32
8839  #define __put_user_asm_u64(x, addr, err, errret)                       \
8840 -       asm volatile("1:        movl %%eax,0(%2)\n"                     \
8841 -                    "2:        movl %%edx,4(%2)\n"                     \
8842 +       asm volatile(_ASM_LOAD_USER_DS(5)                               \
8843 +                    "1:        movl %%eax,%%ds:0(%2)\n"                \
8844 +                    "2:        movl %%edx,%%ds:4(%2)\n"                \
8845                      "3:\n"                                             \
8846 +                    _ASM_LOAD_KERNEL_DS                                \
8847                      ".section .fixup,\"ax\"\n"                         \
8848                      "4:        movl %3,%0\n"                           \
8849                      "  jmp 3b\n"                                       \
8850 @@ -197,15 +235,18 @@ extern int __get_user_bad(void);
8851                      _ASM_EXTABLE(1b, 4b)                               \
8852                      _ASM_EXTABLE(2b, 4b)                               \
8853                      : "=r" (err)                                       \
8854 -                    : "A" (x), "r" (addr), "i" (errret), "0" (err))
8855 +                    : "A" (x), "r" (addr), "i" (errret), "0" (err),    \
8856 +                      "r"(__USER_DS))
8857
8858  #define __put_user_asm_ex_u64(x, addr)                                 \
8859 -       asm volatile("1:        movl %%eax,0(%1)\n"                     \
8860 -                    "2:        movl %%edx,4(%1)\n"                     \
8861 +       asm volatile(_ASM_LOAD_USER_DS(2)                               \
8862 +                    "1:        movl %%eax,%%ds:0(%1)\n"                \
8863 +                    "2:        movl %%edx,%%ds:4(%1)\n"                \
8864                      "3:\n"                                             \
8865 +                    _ASM_LOAD_KERNEL_DS                                \
8866                      _ASM_EXTABLE(1b, 2b - 1b)                          \
8867                      _ASM_EXTABLE(2b, 3b - 2b)                          \
8868 -                    : : "A" (x), "r" (addr))
8869 +                    : : "A" (x), "r" (addr), "r"(__USER_DS))
8870
8871  #define __put_user_x8(x, ptr, __ret_pu)                                \
8872         asm volatile("call __put_user_8" : "=a" (__ret_pu)      \
8873 @@ -374,16 +415,18 @@ do {                                                                      \
8874  } while (0)
8875
8876  #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)      \
8877 -       asm volatile("1:        mov"itype" %2,%"rtype"1\n"              \
8878 +       asm volatile(_ASM_LOAD_USER_DS(5)                               \
8879 +                    "1:        mov"itype" %%ds:%2,%"rtype"1\n"         \
8880                      "2:\n"                                             \
8881 +                    _ASM_LOAD_KERNEL_DS                                \
8882                      ".section .fixup,\"ax\"\n"                         \
8883                      "3:        mov %3,%0\n"                            \
8884                      "  xor"itype" %"rtype"1,%"rtype"1\n"               \
8885                      "  jmp 2b\n"                                       \
8886                      ".previous\n"                                      \
8887                      _ASM_EXTABLE(1b, 3b)                               \
8888 -                    : "=r" (err), ltype(x)                             \
8889 -                    : "m" (__m(addr)), "i" (errret), "0" (err))
8890 +                    : "=r" (err), ltype (x)                            \
8891 +                    : "m" (__m(addr)), "i" (errret), "0" (err), "r"(__USER_DS))
8892
8893  #define __get_user_size_ex(x, ptr, size)                               \
8894  do {                                                                   \
8895 @@ -407,10 +450,12 @@ do {                                                                      \
8896  } while (0)
8897
8898  #define __get_user_asm_ex(x, addr, itype, rtype, ltype)                        \
8899 -       asm volatile("1:        mov"itype" %1,%"rtype"0\n"              \
8900 +       asm volatile(_ASM_LOAD_USER_DS(2)                               \
8901 +                    "1:        mov"itype" %%ds:%1,%"rtype"0\n"         \
8902                      "2:\n"                                             \
8903 +                    _ASM_LOAD_KERNEL_DS                                \
8904                      _ASM_EXTABLE(1b, 2b - 1b)                          \
8905 -                    : ltype(x) : "m" (__m(addr)))
8906 +                    : ltype(x) : "m" (__m(addr)), "r"(__USER_DS))
8907
8908  #define __put_user_nocheck(x, ptr, size)                       \
8909  ({                                                             \
8910 @@ -424,7 +469,7 @@ do {                                                                        \
8911         int __gu_err;                                                   \
8912         unsigned long __gu_val;                                         \
8913         __get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);    \
8914 -       (x) = (__force __typeof__(*(ptr)))__gu_val;                     \
8915 +       (x) = (__typeof__(*(ptr)))__gu_val;                             \
8916         __gu_err;                                                       \
8917  })
8918
8919 @@ -438,21 +483,26 @@ struct __large_struct { unsigned long bu
8920   * aliasing issues.
8921   */
8922  #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)      \
8923 -       asm volatile("1:        mov"itype" %"rtype"1,%2\n"              \
8924 +       asm volatile(_ASM_LOAD_USER_DS(5)                               \
8925 +                    "1:        mov"itype" %"rtype"1,%%ds:%2\n"         \
8926                      "2:\n"                                             \
8927 +                    _ASM_LOAD_KERNEL_DS                                \
8928                      ".section .fixup,\"ax\"\n"                         \
8929                      "3:        mov %3,%0\n"                            \
8930                      "  jmp 2b\n"                                       \
8931                      ".previous\n"                                      \
8932                      _ASM_EXTABLE(1b, 3b)                               \
8933                      : "=r"(err)                                        \
8934 -                    : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
8935 +                    : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err),\
8936 +                      "r"(__USER_DS))
8937
8938  #define __put_user_asm_ex(x, addr, itype, rtype, ltype)                        \
8939 -       asm volatile("1:        mov"itype" %"rtype"0,%1\n"              \
8940 +       asm volatile(_ASM_LOAD_USER_DS(2)                               \
8941 +                    "1:        mov"itype" %"rtype"0,%%ds:%1\n"         \
8942                      "2:\n"                                             \
8943 +                    _ASM_LOAD_KERNEL_DS                                \
8944                      _ASM_EXTABLE(1b, 2b - 1b)                          \
8945 -                    : : ltype(x), "m" (__m(addr)))
8946 +                    : : ltype(x), "m" (__m(addr)), "r"(__USER_DS))
8947
8948  /*
8949   * uaccess_try and catch
8950 @@ -530,7 +580,7 @@ struct __large_struct { unsigned long bu
8951  #define get_user_ex(x, ptr)    do {                                    \
8952         unsigned long __gue_val;                                        \
8953         __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));       \
8954 -       (x) = (__force __typeof__(*(ptr)))__gue_val;                    \
8955 +       (x) = (__typeof__(*(ptr)))__gue_val;                            \
8956  } while (0)
8957
8958  #ifdef CONFIG_X86_WP_WORKS_OK
8959 @@ -567,6 +617,7 @@ extern struct movsl_mask {
8960
8961  #define ARCH_HAS_NOCACHE_UACCESS 1
8962
8963 +#define ARCH_HAS_SORT_EXTABLE
8964  #ifdef CONFIG_X86_32
8965  # include "uaccess_32.h"
8966  #else
8967 diff -urNp linux-2.6.33/arch/x86/include/asm/vgtod.h linux-2.6.33/arch/x86/include/asm/vgtod.h
8968 --- linux-2.6.33/arch/x86/include/asm/vgtod.h   2010-02-24 13:52:17.000000000 -0500
8969 +++ linux-2.6.33/arch/x86/include/asm/vgtod.h   2010-03-07 12:23:35.925702533 -0500
8970 @@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
8971         int             sysctl_enabled;
8972         struct timezone sys_tz;
8973         struct { /* extract of a clocksource struct */
8974 +               char    name[8];
8975                 cycle_t (*vread)(void);
8976                 cycle_t cycle_last;
8977                 cycle_t mask;
8978 diff -urNp linux-2.6.33/arch/x86/include/asm/vmi.h linux-2.6.33/arch/x86/include/asm/vmi.h
8979 --- linux-2.6.33/arch/x86/include/asm/vmi.h     2010-02-24 13:52:17.000000000 -0500
8980 +++ linux-2.6.33/arch/x86/include/asm/vmi.h     2010-03-07 12:23:35.925702533 -0500
8981 @@ -191,6 +191,7 @@ struct vrom_header {
8982         u8      reserved[96];   /* Reserved for headers */
8983         char    vmi_init[8];    /* VMI_Init jump point */
8984         char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
8985 +       char    rom_data[8048]; /* rest of the option ROM */
8986  } __attribute__((packed));
8987
8988  struct pnp_header {
8989 diff -urNp linux-2.6.33/arch/x86/include/asm/vsyscall.h linux-2.6.33/arch/x86/include/asm/vsyscall.h
8990 --- linux-2.6.33/arch/x86/include/asm/vsyscall.h        2010-02-24 13:52:17.000000000 -0500
8991 +++ linux-2.6.33/arch/x86/include/asm/vsyscall.h        2010-03-07 12:23:35.925702533 -0500
8992 @@ -15,9 +15,10 @@ enum vsyscall_num {
8993
8994  #ifdef __KERNEL__
8995  #include <linux/seqlock.h>
8996 +#include <linux/getcpu.h>
8997 +#include <linux/time.h>
8998
8999  #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
9000 -#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
9001
9002  /* Definitions for CONFIG_GENERIC_TIME definitions */
9003  #define __section_vsyscall_gtod_data __attribute__ \
9004 @@ -31,7 +32,6 @@ enum vsyscall_num {
9005  #define VGETCPU_LSL    2
9006
9007  extern int __vgetcpu_mode;
9008 -extern volatile unsigned long __jiffies;
9009
9010  /* kernel space (writeable) */
9011  extern int vgetcpu_mode;
9012 @@ -39,6 +39,9 @@ extern struct timezone sys_tz;
9013
9014  extern void map_vsyscall(void);
9015
9016 +extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
9017 +extern time_t vtime(time_t *t);
9018 +extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
9019  #endif /* __KERNEL__ */
9020
9021  #endif /* _ASM_X86_VSYSCALL_H */
9022 diff -urNp linux-2.6.33/arch/x86/Kconfig linux-2.6.33/arch/x86/Kconfig
9023 --- linux-2.6.33/arch/x86/Kconfig       2010-02-24 13:52:17.000000000 -0500
9024 +++ linux-2.6.33/arch/x86/Kconfig       2010-03-07 12:23:35.925702533 -0500
9025 @@ -1088,7 +1088,7 @@ config PAGE_OFFSET
9026         hex
9027         default 0xB0000000 if VMSPLIT_3G_OPT
9028         default 0x80000000 if VMSPLIT_2G
9029 -       default 0x78000000 if VMSPLIT_2G_OPT
9030 +       default 0x70000000 if VMSPLIT_2G_OPT
9031         default 0x40000000 if VMSPLIT_1G
9032         default 0xC0000000
9033         depends on X86_32
9034 @@ -1422,7 +1422,7 @@ config ARCH_USES_PG_UNCACHED
9035
9036  config EFI
9037         bool "EFI runtime service support"
9038 -       depends on ACPI
9039 +       depends on ACPI && !PAX_KERNEXEC
9040         ---help---
9041           This enables the kernel to use EFI runtime services that are
9042           available (such as the EFI variable services).
9043 @@ -1509,6 +1509,7 @@ config KEXEC_JUMP
9044  config PHYSICAL_START
9045         hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
9046         default "0x1000000"
9047 +       range 0x400000 0x40000000
9048         ---help---
9049           This gives the physical address where the kernel is loaded.
9050
9051 @@ -1573,6 +1574,7 @@ config PHYSICAL_ALIGN
9052         hex
9053         prompt "Alignment value to which kernel should be aligned" if X86_32
9054         default "0x1000000"
9055 +       range 0x400000 0x1000000 if PAX_KERNEXEC
9056         range 0x2000 0x1000000
9057         ---help---
9058           This value puts the alignment restrictions on physical address
9059 @@ -1604,9 +1606,10 @@ config HOTPLUG_CPU
9060           Say N if you want to disable CPU hotplug.
9061
9062  config COMPAT_VDSO
9063 -       def_bool y
9064 +       def_bool n
9065         prompt "Compat VDSO support"
9066         depends on X86_32 || IA32_EMULATION
9067 +       depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
9068         ---help---
9069           Map the 32-bit VDSO to the predictable old-style address too.
9070
9071 diff -urNp linux-2.6.33/arch/x86/Kconfig.cpu linux-2.6.33/arch/x86/Kconfig.cpu
9072 --- linux-2.6.33/arch/x86/Kconfig.cpu   2010-02-24 13:52:17.000000000 -0500
9073 +++ linux-2.6.33/arch/x86/Kconfig.cpu   2010-03-07 12:23:35.925702533 -0500
9074 @@ -336,7 +336,7 @@ config X86_PPRO_FENCE
9075
9076  config X86_F00F_BUG
9077         def_bool y
9078 -       depends on M586MMX || M586TSC || M586 || M486 || M386
9079 +       depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
9080
9081  config X86_WP_WORKS_OK
9082         def_bool y
9083 @@ -356,7 +356,7 @@ config X86_POPAD_OK
9084
9085  config X86_ALIGNMENT_16
9086         def_bool y
9087 -       depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
9088 +       depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
9089
9090  config X86_INTEL_USERCOPY
9091         def_bool y
9092 @@ -402,7 +402,7 @@ config X86_CMPXCHG64
9093  # generates cmov.
9094  config X86_CMOV
9095         def_bool y
9096 -       depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
9097 +       depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM || MGEODE_LX)
9098
9099  config X86_MINIMUM_CPU_FAMILY
9100         int
9101 diff -urNp linux-2.6.33/arch/x86/Kconfig.debug linux-2.6.33/arch/x86/Kconfig.debug
9102 --- linux-2.6.33/arch/x86/Kconfig.debug 2010-02-24 13:52:17.000000000 -0500
9103 +++ linux-2.6.33/arch/x86/Kconfig.debug 2010-03-07 12:23:35.925702533 -0500
9104 @@ -99,7 +99,7 @@ config X86_PTDUMP
9105  config DEBUG_RODATA
9106         bool "Write protect kernel read-only data structures"
9107         default y
9108 -       depends on DEBUG_KERNEL
9109 +       depends on DEBUG_KERNEL && BROKEN
9110         ---help---
9111           Mark the kernel read-only data as write-protected in the pagetables,
9112           in order to catch accidental (and incorrect) writes to such const
9113 diff -urNp linux-2.6.33/arch/x86/kernel/acpi/boot.c linux-2.6.33/arch/x86/kernel/acpi/boot.c
9114 --- linux-2.6.33/arch/x86/kernel/acpi/boot.c    2010-02-24 13:52:17.000000000 -0500
9115 +++ linux-2.6.33/arch/x86/kernel/acpi/boot.c    2010-03-07 12:23:35.925702533 -0500
9116 @@ -1496,7 +1496,7 @@ static struct dmi_system_id __initdata a
9117                      DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
9118                      },
9119          },
9120 -       {}
9121 +       { NULL, NULL, {{0, {0}}}, NULL}
9122  };
9123
9124  /*
9125 diff -urNp linux-2.6.33/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.33/arch/x86/kernel/acpi/realmode/wakeup.S
9126 --- linux-2.6.33/arch/x86/kernel/acpi/realmode/wakeup.S 2010-02-24 13:52:17.000000000 -0500
9127 +++ linux-2.6.33/arch/x86/kernel/acpi/realmode/wakeup.S 2010-03-07 12:23:35.925702533 -0500
9128 @@ -104,7 +104,7 @@ _start:
9129         movl    %eax, %ecx
9130         orl     %edx, %ecx
9131         jz      1f
9132 -       movl    $0xc0000080, %ecx
9133 +       mov     $MSR_EFER, %ecx
9134         wrmsr
9135  1:
9136
9137 diff -urNp linux-2.6.33/arch/x86/kernel/acpi/sleep.c linux-2.6.33/arch/x86/kernel/acpi/sleep.c
9138 --- linux-2.6.33/arch/x86/kernel/acpi/sleep.c   2010-02-24 13:52:17.000000000 -0500
9139 +++ linux-2.6.33/arch/x86/kernel/acpi/sleep.c   2010-03-07 12:23:35.925702533 -0500
9140 @@ -11,11 +11,12 @@
9141  #include <linux/cpumask.h>
9142  #include <asm/segment.h>
9143  #include <asm/desc.h>
9144 +#include <asm/e820.h>
9145
9146  #include "realmode/wakeup.h"
9147  #include "sleep.h"
9148
9149 -unsigned long acpi_wakeup_address;
9150 +unsigned long acpi_wakeup_address = 0x2000;
9151  unsigned long acpi_realmode_flags;
9152
9153  /* address in low memory of the wakeup routine. */
9154 @@ -96,8 +97,12 @@ int acpi_save_state_mem(void)
9155         header->trampoline_segment = setup_trampoline() >> 4;
9156  #ifdef CONFIG_SMP
9157         stack_start.sp = temp_stack + sizeof(temp_stack);
9158 +
9159 +       pax_open_kernel();
9160         early_gdt_descr.address =
9161                         (unsigned long)get_cpu_gdt_table(smp_processor_id());
9162 +       pax_close_kernel();
9163 +
9164         initial_gs = per_cpu_offset(smp_processor_id());
9165  #endif
9166         initial_code = (unsigned long)wakeup_long64;
9167 diff -urNp linux-2.6.33/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.33/arch/x86/kernel/acpi/wakeup_32.S
9168 --- linux-2.6.33/arch/x86/kernel/acpi/wakeup_32.S       2010-02-24 13:52:17.000000000 -0500
9169 +++ linux-2.6.33/arch/x86/kernel/acpi/wakeup_32.S       2010-03-07 12:23:35.925702533 -0500
9170 @@ -30,13 +30,11 @@ wakeup_pmode_return:
9171         # and restore the stack ... but you need gdt for this to work
9172         movl    saved_context_esp, %esp
9173
9174 -       movl    %cs:saved_magic, %eax
9175 -       cmpl    $0x12345678, %eax
9176 +       cmpl    $0x12345678, saved_magic
9177         jne     bogus_magic
9178
9179         # jump to place where we left off
9180 -       movl    saved_eip, %eax
9181 -       jmp     *%eax
9182 +       jmp     *(saved_eip)
9183
9184  bogus_magic:
9185         jmp     bogus_magic
9186 diff -urNp linux-2.6.33/arch/x86/kernel/alternative.c linux-2.6.33/arch/x86/kernel/alternative.c
9187 --- linux-2.6.33/arch/x86/kernel/alternative.c  2010-02-24 13:52:17.000000000 -0500
9188 +++ linux-2.6.33/arch/x86/kernel/alternative.c  2010-03-07 12:23:35.929609343 -0500
9189 @@ -407,7 +407,7 @@ void __init_or_module apply_paravirt(str
9190
9191                 BUG_ON(p->len > MAX_PATCH_LEN);
9192                 /* prep the buffer with the original instructions */
9193 -               memcpy(insnbuf, p->instr, p->len);
9194 +               memcpy(insnbuf, ktla_ktva(p->instr), p->len);
9195                 used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
9196                                          (unsigned long)p->instr, p->len);
9197
9198 @@ -492,12 +492,16 @@ void __init alternative_instructions(voi
9199   * instructions. And on the local CPU you need to be protected again NMI or MCE
9200   * handlers seeing an inconsistent instruction while you patch.
9201   */
9202 -static void *__init_or_module text_poke_early(void *addr, const void *opcode,
9203 +static void *__kprobes text_poke_early(void *addr, const void *opcode,
9204                                               size_t len)
9205  {
9206         unsigned long flags;
9207         local_irq_save(flags);
9208 -       memcpy(addr, opcode, len);
9209 +
9210 +       pax_open_kernel();
9211 +       memcpy(ktla_ktva(addr), opcode, len);
9212 +       pax_close_kernel();
9213 +
9214         sync_core();
9215         local_irq_restore(flags);
9216         /* Could also do a CLFLUSH here to speed up CPU recovery; but
9217 @@ -520,35 +524,21 @@ static void *__init_or_module text_poke_
9218   */
9219  void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
9220  {
9221 -       unsigned long flags;
9222 -       char *vaddr;
9223 +       unsigned char *vaddr = ktla_ktva(addr);
9224         struct page *pages[2];
9225 -       int i;
9226 +       size_t i;
9227
9228         if (!core_kernel_text((unsigned long)addr)) {
9229 -               pages[0] = vmalloc_to_page(addr);
9230 -               pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
9231 +               pages[0] = vmalloc_to_page(vaddr);
9232 +               pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
9233         } else {
9234 -               pages[0] = virt_to_page(addr);
9235 +               pages[0] = virt_to_page(vaddr);
9236                 WARN_ON(!PageReserved(pages[0]));
9237 -               pages[1] = virt_to_page(addr + PAGE_SIZE);
9238 +               pages[1] = virt_to_page(vaddr + PAGE_SIZE);
9239         }
9240         BUG_ON(!pages[0]);
9241 -       local_irq_save(flags);
9242 -       set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
9243 -       if (pages[1])
9244 -               set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
9245 -       vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
9246 -       memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
9247 -       clear_fixmap(FIX_TEXT_POKE0);
9248 -       if (pages[1])
9249 -               clear_fixmap(FIX_TEXT_POKE1);
9250 -       local_flush_tlb();
9251 -       sync_core();
9252 -       /* Could also do a CLFLUSH here to speed up CPU recovery; but
9253 -          that causes hangs on some VIA CPUs. */
9254 +       text_poke_early(addr, opcode, len);
9255         for (i = 0; i < len; i++)
9256 -               BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
9257 -       local_irq_restore(flags);
9258 +               BUG_ON(((char *)vaddr)[i] != ((char *)opcode)[i]);
9259         return addr;
9260  }
9261 diff -urNp linux-2.6.33/arch/x86/kernel/amd_iommu.c linux-2.6.33/arch/x86/kernel/amd_iommu.c
9262 --- linux-2.6.33/arch/x86/kernel/amd_iommu.c    2010-02-24 13:52:17.000000000 -0500
9263 +++ linux-2.6.33/arch/x86/kernel/amd_iommu.c    2010-03-07 12:23:35.929609343 -0500
9264 @@ -2210,7 +2210,7 @@ static void prealloc_protection_domains(
9265         }
9266  }
9267
9268 -static struct dma_map_ops amd_iommu_dma_ops = {
9269 +static const struct dma_map_ops amd_iommu_dma_ops = {
9270         .alloc_coherent = alloc_coherent,
9271         .free_coherent = free_coherent,
9272         .map_page = map_page,
9273 diff -urNp linux-2.6.33/arch/x86/kernel/apic/io_apic.c linux-2.6.33/arch/x86/kernel/apic/io_apic.c
9274 --- linux-2.6.33/arch/x86/kernel/apic/io_apic.c 2010-02-24 13:52:17.000000000 -0500
9275 +++ linux-2.6.33/arch/x86/kernel/apic/io_apic.c 2010-03-07 12:23:35.929609343 -0500
9276 @@ -701,7 +701,7 @@ struct IO_APIC_route_entry **alloc_ioapi
9277         ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
9278                                 GFP_ATOMIC);
9279         if (!ioapic_entries)
9280 -               return 0;
9281 +               return NULL;
9282
9283         for (apic = 0; apic < nr_ioapics; apic++) {
9284                 ioapic_entries[apic] =
9285 @@ -718,7 +718,7 @@ nomem:
9286                 kfree(ioapic_entries[apic]);
9287         kfree(ioapic_entries);
9288
9289 -       return 0;
9290 +       return NULL;
9291  }
9292
9293  /*
9294 @@ -1135,7 +1135,7 @@ int IO_APIC_get_PCI_irq_vector(int bus,
9295  }
9296  EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
9297
9298 -void lock_vector_lock(void)
9299 +void lock_vector_lock(void) __acquires(vector_lock)
9300  {
9301         /* Used to the online set of cpus does not change
9302          * during assign_irq_vector.
9303 @@ -1143,7 +1143,7 @@ void lock_vector_lock(void)
9304         spin_lock(&vector_lock);
9305  }
9306
9307 -void unlock_vector_lock(void)
9308 +void unlock_vector_lock(void) __releases(vector_lock)
9309  {
9310         spin_unlock(&vector_lock);
9311  }
9312 diff -urNp linux-2.6.33/arch/x86/kernel/apm_32.c linux-2.6.33/arch/x86/kernel/apm_32.c
9313 --- linux-2.6.33/arch/x86/kernel/apm_32.c       2010-02-24 13:52:17.000000000 -0500
9314 +++ linux-2.6.33/arch/x86/kernel/apm_32.c       2010-03-07 12:23:35.929609343 -0500
9315 @@ -410,7 +410,7 @@ static DEFINE_MUTEX(apm_mutex);
9316   * This is for buggy BIOS's that refer to (real mode) segment 0x40
9317   * even though they are called in protected mode.
9318   */
9319 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
9320 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
9321                         (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
9322
9323  static const char driver_version[] = "1.16ac"; /* no spaces */
9324 @@ -588,7 +588,10 @@ static long __apm_bios_call(void *_call)
9325         BUG_ON(cpu != 0);
9326         gdt = get_cpu_gdt_table(cpu);
9327         save_desc_40 = gdt[0x40 / 8];
9328 +
9329 +       pax_open_kernel();
9330         gdt[0x40 / 8] = bad_bios_desc;
9331 +       pax_close_kernel();
9332
9333         apm_irq_save(flags);
9334         APM_DO_SAVE_SEGS;
9335 @@ -597,7 +600,11 @@ static long __apm_bios_call(void *_call)
9336                           &call->esi);
9337         APM_DO_RESTORE_SEGS;
9338         apm_irq_restore(flags);
9339 +
9340 +       pax_open_kernel();
9341         gdt[0x40 / 8] = save_desc_40;
9342 +       pax_close_kernel();
9343 +
9344         put_cpu();
9345
9346         return call->eax & 0xff;
9347 @@ -664,7 +671,10 @@ static long __apm_bios_call_simple(void
9348         BUG_ON(cpu != 0);
9349         gdt = get_cpu_gdt_table(cpu);
9350         save_desc_40 = gdt[0x40 / 8];
9351 +
9352 +       pax_open_kernel();
9353         gdt[0x40 / 8] = bad_bios_desc;
9354 +       pax_close_kernel();
9355
9356         apm_irq_save(flags);
9357         APM_DO_SAVE_SEGS;
9358 @@ -672,7 +682,11 @@ static long __apm_bios_call_simple(void
9359                                          &call->eax);
9360         APM_DO_RESTORE_SEGS;
9361         apm_irq_restore(flags);
9362 +
9363 +       pax_open_kernel();
9364         gdt[0x40 / 8] = save_desc_40;
9365 +       pax_close_kernel();
9366 +
9367         put_cpu();
9368         return error;
9369  }
9370 @@ -975,7 +989,7 @@ recalc:
9371
9372  static void apm_power_off(void)
9373  {
9374 -       unsigned char po_bios_call[] = {
9375 +       const unsigned char po_bios_call[] = {
9376                 0xb8, 0x00, 0x10,       /* movw  $0x1000,ax  */
9377                 0x8e, 0xd0,             /* movw  ax,ss       */
9378                 0xbc, 0x00, 0xf0,       /* movw  $0xf000,sp  */
9379 @@ -1931,7 +1945,10 @@ static const struct file_operations apm_
9380  static struct miscdevice apm_device = {
9381         APM_MINOR_DEV,
9382         "apm_bios",
9383 -       &apm_bios_fops
9384 +       &apm_bios_fops,
9385 +       {NULL, NULL},
9386 +       NULL,
9387 +       NULL
9388  };
9389
9390
9391 @@ -2252,7 +2269,7 @@ static struct dmi_system_id __initdata a
9392                 {       DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
9393         },
9394
9395 -       { }
9396 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
9397  };
9398
9399  /*
9400 @@ -2355,12 +2372,15 @@ static int __init apm_init(void)
9401          * code to that CPU.
9402          */
9403         gdt = get_cpu_gdt_table(0);
9404 +
9405 +       pax_open_kernel();
9406         set_desc_base(&gdt[APM_CS >> 3],
9407                  (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
9408         set_desc_base(&gdt[APM_CS_16 >> 3],
9409                  (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
9410         set_desc_base(&gdt[APM_DS >> 3],
9411                  (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
9412 +       pax_close_kernel();
9413
9414         proc_create("apm", 0, NULL, &apm_file_ops);
9415
9416 diff -urNp linux-2.6.33/arch/x86/kernel/asm-offsets_32.c linux-2.6.33/arch/x86/kernel/asm-offsets_32.c
9417 --- linux-2.6.33/arch/x86/kernel/asm-offsets_32.c       2010-02-24 13:52:17.000000000 -0500
9418 +++ linux-2.6.33/arch/x86/kernel/asm-offsets_32.c       2010-03-07 12:23:35.929609343 -0500
9419 @@ -115,6 +115,11 @@ void foo(void)
9420         OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
9421         OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
9422         OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
9423 +
9424 +#ifdef CONFIG_PAX_KERNEXEC
9425 +       OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
9426 +#endif
9427 +
9428  #endif
9429
9430  #ifdef CONFIG_XEN
9431 diff -urNp linux-2.6.33/arch/x86/kernel/asm-offsets_64.c linux-2.6.33/arch/x86/kernel/asm-offsets_64.c
9432 --- linux-2.6.33/arch/x86/kernel/asm-offsets_64.c       2010-02-24 13:52:17.000000000 -0500
9433 +++ linux-2.6.33/arch/x86/kernel/asm-offsets_64.c       2010-03-07 12:23:55.597717555 -0500
9434 @@ -63,6 +63,12 @@ int main(void)
9435         OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
9436         OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
9437         OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
9438 +
9439 +#ifdef CONFIG_PAX_KERNEXEC
9440 +       OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
9441 +       OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
9442 +#endif
9443 +
9444  #endif
9445
9446
9447 @@ -115,6 +121,7 @@ int main(void)
9448         ENTRY(cr8);
9449         BLANK();
9450  #undef ENTRY
9451 +       DEFINE(TSS_size, sizeof(struct tss_struct));
9452         DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
9453         BLANK();
9454         DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
9455 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/common.c linux-2.6.33/arch/x86/kernel/cpu/common.c
9456 --- linux-2.6.33/arch/x86/kernel/cpu/common.c   2010-02-24 13:52:17.000000000 -0500
9457 +++ linux-2.6.33/arch/x86/kernel/cpu/common.c   2010-03-07 12:23:35.929609343 -0500
9458 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
9459
9460  static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
9461
9462 -DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
9463 -#ifdef CONFIG_X86_64
9464 -       /*
9465 -        * We need valid kernel segments for data and code in long mode too
9466 -        * IRET will check the segment types  kkeil 2000/10/28
9467 -        * Also sysret mandates a special GDT layout
9468 -        *
9469 -        * TLS descriptors are currently at a different place compared to i386.
9470 -        * Hopefully nobody expects them at a fixed place (Wine?)
9471 -        */
9472 -       [GDT_ENTRY_KERNEL32_CS]         = GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
9473 -       [GDT_ENTRY_KERNEL_CS]           = GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
9474 -       [GDT_ENTRY_KERNEL_DS]           = GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
9475 -       [GDT_ENTRY_DEFAULT_USER32_CS]   = GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
9476 -       [GDT_ENTRY_DEFAULT_USER_DS]     = GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
9477 -       [GDT_ENTRY_DEFAULT_USER_CS]     = GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
9478 -#else
9479 -       [GDT_ENTRY_KERNEL_CS]           = GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
9480 -       [GDT_ENTRY_KERNEL_DS]           = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
9481 -       [GDT_ENTRY_DEFAULT_USER_CS]     = GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
9482 -       [GDT_ENTRY_DEFAULT_USER_DS]     = GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
9483 -       /*
9484 -        * Segments used for calling PnP BIOS have byte granularity.
9485 -        * They code segments and data segments have fixed 64k limits,
9486 -        * the transfer segment sizes are set at run time.
9487 -        */
9488 -       /* 32-bit code */
9489 -       [GDT_ENTRY_PNPBIOS_CS32]        = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
9490 -       /* 16-bit code */
9491 -       [GDT_ENTRY_PNPBIOS_CS16]        = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
9492 -       /* 16-bit data */
9493 -       [GDT_ENTRY_PNPBIOS_DS]          = GDT_ENTRY_INIT(0x0092, 0, 0xffff),
9494 -       /* 16-bit data */
9495 -       [GDT_ENTRY_PNPBIOS_TS1]         = GDT_ENTRY_INIT(0x0092, 0, 0),
9496 -       /* 16-bit data */
9497 -       [GDT_ENTRY_PNPBIOS_TS2]         = GDT_ENTRY_INIT(0x0092, 0, 0),
9498 -       /*
9499 -        * The APM segments have byte granularity and their bases
9500 -        * are set at run time.  All have 64k limits.
9501 -        */
9502 -       /* 32-bit code */
9503 -       [GDT_ENTRY_APMBIOS_BASE]        = GDT_ENTRY_INIT(0x409a, 0, 0xffff),
9504 -       /* 16-bit code */
9505 -       [GDT_ENTRY_APMBIOS_BASE+1]      = GDT_ENTRY_INIT(0x009a, 0, 0xffff),
9506 -       /* data */
9507 -       [GDT_ENTRY_APMBIOS_BASE+2]      = GDT_ENTRY_INIT(0x4092, 0, 0xffff),
9508 -
9509 -       [GDT_ENTRY_ESPFIX_SS]           = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
9510 -       [GDT_ENTRY_PERCPU]              = GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
9511 -       GDT_STACK_CANARY_INIT
9512 -#endif
9513 -} };
9514 -EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
9515 -
9516  static int __init x86_xsave_setup(char *s)
9517  {
9518         setup_clear_cpu_cap(X86_FEATURE_XSAVE);
9519 @@ -344,7 +290,7 @@ void switch_to_new_gdt(int cpu)
9520  {
9521         struct desc_ptr gdt_descr;
9522
9523 -       gdt_descr.address = (long)get_cpu_gdt_table(cpu);
9524 +       gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
9525         gdt_descr.size = GDT_SIZE - 1;
9526         load_gdt(&gdt_descr);
9527         /* Reload the per-cpu base */
9528 @@ -802,6 +748,10 @@ static void __cpuinit identify_cpu(struc
9529         /* Filter out anything that depends on CPUID levels we don't have */
9530         filter_cpuid_features(c, true);
9531
9532 +#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
9533 +       setup_clear_cpu_cap(X86_FEATURE_SEP);
9534 +#endif
9535 +
9536         /* If the model name is still unset, do table lookup. */
9537         if (!c->x86_model_id[0]) {
9538                 const char *p;
9539 @@ -1103,7 +1053,7 @@ void __cpuinit cpu_init(void)
9540         int i;
9541
9542         cpu = stack_smp_processor_id();
9543 -       t = &per_cpu(init_tss, cpu);
9544 +       t = init_tss + cpu;
9545         oist = &per_cpu(orig_ist, cpu);
9546
9547  #ifdef CONFIG_NUMA
9548 @@ -1201,7 +1151,7 @@ void __cpuinit cpu_init(void)
9549  {
9550         int cpu = smp_processor_id();
9551         struct task_struct *curr = current;
9552 -       struct tss_struct *t = &per_cpu(init_tss, cpu);
9553 +       struct tss_struct *t = init_tss + cpu;
9554         struct thread_struct *thread = &curr->thread;
9555
9556         if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
9557 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.33/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
9558 --- linux-2.6.33/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c     2010-02-24 13:52:17.000000000 -0500
9559 +++ linux-2.6.33/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c     2010-03-07 12:23:35.929609343 -0500
9560 @@ -523,7 +523,7 @@ static const struct dmi_system_id sw_any
9561                         DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
9562                 },
9563         },
9564 -       { }
9565 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
9566  };
9567
9568  static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
9569 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.33/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
9570 --- linux-2.6.33/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c       2010-02-24 13:52:17.000000000 -0500
9571 +++ linux-2.6.33/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c       2010-03-07 12:23:35.929609343 -0500
9572 @@ -225,7 +225,7 @@ static struct cpu_model models[] =
9573         { &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
9574         { &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
9575
9576 -       { NULL, }
9577 +       { NULL, NULL, 0, NULL}
9578  };
9579  #undef _BANIAS
9580  #undef BANIAS
9581 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/intel.c linux-2.6.33/arch/x86/kernel/cpu/intel.c
9582 --- linux-2.6.33/arch/x86/kernel/cpu/intel.c    2010-02-24 13:52:17.000000000 -0500
9583 +++ linux-2.6.33/arch/x86/kernel/cpu/intel.c    2010-03-07 12:23:35.929609343 -0500
9584 @@ -139,7 +139,7 @@ static void __cpuinit trap_init_f00f_bug
9585          * Update the IDT descriptor and reload the IDT so that
9586          * it uses the read-only mapped virtual address.
9587          */
9588 -       idt_descr.address = fix_to_virt(FIX_F00F_IDT);
9589 +       idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
9590         load_idt(&idt_descr);
9591  }
9592  #endif
9593 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.33/arch/x86/kernel/cpu/intel_cacheinfo.c
9594 --- linux-2.6.33/arch/x86/kernel/cpu/intel_cacheinfo.c  2010-02-24 13:52:17.000000000 -0500
9595 +++ linux-2.6.33/arch/x86/kernel/cpu/intel_cacheinfo.c  2010-03-07 12:23:35.929609343 -0500
9596 @@ -848,7 +848,7 @@ static ssize_t store(struct kobject *kob
9597         return ret;
9598  }
9599
9600 -static struct sysfs_ops sysfs_ops = {
9601 +static const struct sysfs_ops sysfs_ops = {
9602         .show   = show,
9603         .store  = store,
9604  };
9605 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/Makefile linux-2.6.33/arch/x86/kernel/cpu/Makefile
9606 --- linux-2.6.33/arch/x86/kernel/cpu/Makefile   2010-02-24 13:52:17.000000000 -0500
9607 +++ linux-2.6.33/arch/x86/kernel/cpu/Makefile   2010-03-07 12:23:35.929609343 -0500
9608 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
9609  CFLAGS_REMOVE_perf_event.o = -pg
9610  endif
9611
9612 -# Make sure load_percpu_segment has no stackprotector
9613 -nostackp := $(call cc-option, -fno-stack-protector)
9614 -CFLAGS_common.o                := $(nostackp)
9615 -
9616  obj-y                  := intel_cacheinfo.o addon_cpuid_features.o
9617  obj-y                  += proc.o capflags.o powerflags.o common.o
9618  obj-y                  += vmware.o hypervisor.o sched.o
9619 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce_amd.c
9620 --- linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce_amd.c   2010-02-24 13:52:17.000000000 -0500
9621 +++ linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce_amd.c   2010-03-07 12:23:35.929609343 -0500
9622 @@ -388,7 +388,7 @@ static ssize_t store(struct kobject *kob
9623         return ret;
9624  }
9625
9626 -static struct sysfs_ops threshold_ops = {
9627 +static const struct sysfs_ops threshold_ops = {
9628         .show                   = show,
9629         .store                  = store,
9630  };
9631 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce.c
9632 --- linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce.c       2010-02-24 13:52:17.000000000 -0500
9633 +++ linux-2.6.33/arch/x86/kernel/cpu/mcheck/mce.c       2010-03-07 12:23:35.933601961 -0500
9634 @@ -201,7 +201,7 @@ static void print_mce(struct mce *m)
9635                         !(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
9636                                 m->cs, m->ip);
9637
9638 -               if (m->cs == __KERNEL_CS)
9639 +               if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
9640                         print_symbol("{%s}", m->ip);
9641                 pr_cont("\n");
9642         }
9643 @@ -1444,14 +1444,14 @@ void __cpuinit mcheck_cpu_init(struct cp
9644   */
9645
9646  static DEFINE_SPINLOCK(mce_state_lock);
9647 -static int             open_count;             /* #times opened */
9648 +static atomic_t                open_count;             /* #times opened */
9649  static int             open_exclu;             /* already open exclusive? */
9650
9651  static int mce_open(struct inode *inode, struct file *file)
9652  {
9653         spin_lock(&mce_state_lock);
9654
9655 -       if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
9656 +       if (open_exclu || (atomic_read(&open_count) && (file->f_flags & O_EXCL))) {
9657                 spin_unlock(&mce_state_lock);
9658
9659                 return -EBUSY;
9660 @@ -1459,7 +1459,7 @@ static int mce_open(struct inode *inode,
9661
9662         if (file->f_flags & O_EXCL)
9663                 open_exclu = 1;
9664 -       open_count++;
9665 +       atomic_inc(&open_count);
9666
9667         spin_unlock(&mce_state_lock);
9668
9669 @@ -1470,7 +1470,7 @@ static int mce_release(struct inode *ino
9670  {
9671         spin_lock(&mce_state_lock);
9672
9673 -       open_count--;
9674 +       atomic_dec(&open_count);
9675         open_exclu = 0;
9676
9677         spin_unlock(&mce_state_lock);
9678 @@ -1610,6 +1610,7 @@ static struct miscdevice mce_log_device
9679         MISC_MCELOG_MINOR,
9680         "mcelog",
9681         &mce_chrdev_ops,
9682 +       {NULL, NULL}, NULL, NULL
9683  };
9684
9685  /*
9686 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.33/arch/x86/kernel/cpu/mtrr/amd.c
9687 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/amd.c 2010-02-24 13:52:17.000000000 -0500
9688 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/amd.c 2010-03-07 12:23:35.933601961 -0500
9689 @@ -108,7 +108,7 @@ amd_validate_add_page(unsigned long base
9690         return 0;
9691  }
9692
9693 -static struct mtrr_ops amd_mtrr_ops = {
9694 +static const struct mtrr_ops amd_mtrr_ops = {
9695         .vendor            = X86_VENDOR_AMD,
9696         .set               = amd_set_mtrr,
9697         .get               = amd_get_mtrr,
9698 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.33/arch/x86/kernel/cpu/mtrr/centaur.c
9699 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/centaur.c     2010-02-24 13:52:17.000000000 -0500
9700 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/centaur.c     2010-03-07 12:23:35.933601961 -0500
9701 @@ -110,7 +110,7 @@ centaur_validate_add_page(unsigned long
9702         return 0;
9703  }
9704
9705 -static struct mtrr_ops centaur_mtrr_ops = {
9706 +static const struct mtrr_ops centaur_mtrr_ops = {
9707         .vendor            = X86_VENDOR_CENTAUR,
9708         .set               = centaur_set_mcr,
9709         .get               = centaur_get_mcr,
9710 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.33/arch/x86/kernel/cpu/mtrr/cyrix.c
9711 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/cyrix.c       2010-02-24 13:52:17.000000000 -0500
9712 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/cyrix.c       2010-03-07 12:23:35.933601961 -0500
9713 @@ -265,7 +265,7 @@ static void cyrix_set_all(void)
9714         post_set();
9715  }
9716
9717 -static struct mtrr_ops cyrix_mtrr_ops = {
9718 +static const struct mtrr_ops cyrix_mtrr_ops = {
9719         .vendor            = X86_VENDOR_CYRIX,
9720         .set_all           = cyrix_set_all,
9721         .set               = cyrix_set_arr,
9722 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.33/arch/x86/kernel/cpu/mtrr/generic.c
9723 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/generic.c     2010-02-24 13:52:17.000000000 -0500
9724 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/generic.c     2010-03-07 12:23:35.933601961 -0500
9725 @@ -29,7 +29,7 @@ static struct fixed_range_block fixed_ra
9726         { MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
9727         { MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
9728         { MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
9729 -       {}
9730 +       { 0, 0 }
9731  };
9732
9733  static unsigned long smp_changes_mask;
9734 @@ -752,7 +752,7 @@ int positive_have_wrcomb(void)
9735  /*
9736   * Generic structure...
9737   */
9738 -struct mtrr_ops generic_mtrr_ops = {
9739 +const struct mtrr_ops generic_mtrr_ops = {
9740         .use_intel_if           = 1,
9741         .set_all                = generic_set_all,
9742         .get                    = generic_get_mtrr,
9743 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.33/arch/x86/kernel/cpu/mtrr/main.c
9744 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/main.c        2010-02-24 13:52:17.000000000 -0500
9745 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/main.c        2010-03-07 12:23:35.933601961 -0500
9746 @@ -60,14 +60,14 @@ static DEFINE_MUTEX(mtrr_mutex);
9747  u64 size_or_mask, size_and_mask;
9748  static bool mtrr_aps_delayed_init;
9749
9750 -static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
9751 +static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
9752
9753 -struct mtrr_ops *mtrr_if;
9754 +const struct mtrr_ops *mtrr_if;
9755
9756  static void set_mtrr(unsigned int reg, unsigned long base,
9757                      unsigned long size, mtrr_type type);
9758
9759 -void set_mtrr_ops(struct mtrr_ops *ops)
9760 +void set_mtrr_ops(const struct mtrr_ops *ops)
9761  {
9762         if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
9763                 mtrr_ops[ops->vendor] = ops;
9764 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.33/arch/x86/kernel/cpu/mtrr/mtrr.h
9765 --- linux-2.6.33/arch/x86/kernel/cpu/mtrr/mtrr.h        2010-02-24 13:52:17.000000000 -0500
9766 +++ linux-2.6.33/arch/x86/kernel/cpu/mtrr/mtrr.h        2010-03-07 12:23:35.933601961 -0500
9767 @@ -12,19 +12,19 @@
9768  extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
9769
9770  struct mtrr_ops {
9771 -       u32     vendor;
9772 -       u32     use_intel_if;
9773 -       void    (*set)(unsigned int reg, unsigned long base,
9774 +       const u32       vendor;
9775 +       const u32       use_intel_if;
9776 +       void    (* const set)(unsigned int reg, unsigned long base,
9777                        unsigned long size, mtrr_type type);
9778 -       void    (*set_all)(void);
9779 +       void    (* const set_all)(void);
9780
9781 -       void    (*get)(unsigned int reg, unsigned long *base,
9782 +       void    (* const get)(unsigned int reg, unsigned long *base,
9783                        unsigned long *size, mtrr_type *type);
9784 -       int     (*get_free_region)(unsigned long base, unsigned long size,
9785 +       int     (* const get_free_region)(unsigned long base, unsigned long size,
9786                                    int replace_reg);
9787 -       int     (*validate_add_page)(unsigned long base, unsigned long size,
9788 +       int     (* const validate_add_page)(unsigned long base, unsigned long size,
9789                                      unsigned int type);
9790 -       int     (*have_wrcomb)(void);
9791 +       int     (* const have_wrcomb)(void);
9792  };
9793
9794  extern int generic_get_free_region(unsigned long base, unsigned long size,
9795 @@ -32,7 +32,7 @@ extern int generic_get_free_region(unsig
9796  extern int generic_validate_add_page(unsigned long base, unsigned long size,
9797                                      unsigned int type);
9798
9799 -extern struct mtrr_ops generic_mtrr_ops;
9800 +extern const struct mtrr_ops generic_mtrr_ops;
9801
9802  extern int positive_have_wrcomb(void);
9803
9804 @@ -53,10 +53,10 @@ void fill_mtrr_var_range(unsigned int in
9805                 u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
9806  void get_mtrr_state(void);
9807
9808 -extern void set_mtrr_ops(struct mtrr_ops *ops);
9809 +extern void set_mtrr_ops(const struct mtrr_ops *ops);
9810
9811  extern u64 size_or_mask, size_and_mask;
9812 -extern struct mtrr_ops *mtrr_if;
9813 +extern const struct mtrr_ops *mtrr_if;
9814
9815  #define is_cpu(vnd)    (mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
9816  #define use_intel()    (mtrr_if && mtrr_if->use_intel_if == 1)
9817 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.33/arch/x86/kernel/cpu/perfctr-watchdog.c
9818 --- linux-2.6.33/arch/x86/kernel/cpu/perfctr-watchdog.c 2010-02-24 13:52:17.000000000 -0500
9819 +++ linux-2.6.33/arch/x86/kernel/cpu/perfctr-watchdog.c 2010-03-07 12:23:35.933601961 -0500
9820 @@ -30,11 +30,11 @@ struct nmi_watchdog_ctlblk {
9821
9822  /* Interface defining a CPU specific perfctr watchdog */
9823  struct wd_ops {
9824 -       int (*reserve)(void);
9825 -       void (*unreserve)(void);
9826 -       int (*setup)(unsigned nmi_hz);
9827 -       void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
9828 -       void (*stop)(void);
9829 +       int (* const reserve)(void);
9830 +       void (* const unreserve)(void);
9831 +       int (* const setup)(unsigned nmi_hz);
9832 +       void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
9833 +       void (* const stop)(void);
9834         unsigned perfctr;
9835         unsigned evntsel;
9836         u64 checkbit;
9837 @@ -645,6 +645,7 @@ static const struct wd_ops p4_wd_ops = {
9838  #define ARCH_PERFMON_NMI_EVENT_SEL     ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
9839  #define ARCH_PERFMON_NMI_EVENT_UMASK   ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
9840
9841 +/* cannot be const */
9842  static struct wd_ops intel_arch_wd_ops;
9843
9844  static int setup_intel_arch_watchdog(unsigned nmi_hz)
9845 @@ -697,6 +698,7 @@ static int setup_intel_arch_watchdog(uns
9846         return 1;
9847  }
9848
9849 +/* cannot be const */
9850  static struct wd_ops intel_arch_wd_ops __read_mostly = {
9851         .reserve        = single_msr_reserve,
9852         .unreserve      = single_msr_unreserve,
9853 diff -urNp linux-2.6.33/arch/x86/kernel/cpu/perf_event.c linux-2.6.33/arch/x86/kernel/cpu/perf_event.c
9854 --- linux-2.6.33/arch/x86/kernel/cpu/perf_event.c       2010-02-24 13:52:17.000000000 -0500
9855 +++ linux-2.6.33/arch/x86/kernel/cpu/perf_event.c       2010-03-07 12:23:35.933601961 -0500
9856 @@ -2426,7 +2426,7 @@ perf_callchain_user(struct pt_regs *regs
9857                         break;
9858
9859                 callchain_store(entry, frame.return_address);
9860 -               fp = frame.next_frame;
9861 +               fp = (__force const void __user *)frame.next_frame;
9862         }
9863  }
9864
9865 diff -urNp linux-2.6.33/arch/x86/kernel/crash.c linux-2.6.33/arch/x86/kernel/crash.c
9866 --- linux-2.6.33/arch/x86/kernel/crash.c        2010-02-24 13:52:17.000000000 -0500
9867 +++ linux-2.6.33/arch/x86/kernel/crash.c        2010-03-07 12:23:35.933601961 -0500
9868 @@ -41,7 +41,7 @@ static void kdump_nmi_callback(int cpu,
9869         regs = args->regs;
9870
9871  #ifdef CONFIG_X86_32
9872 -       if (!user_mode_vm(regs)) {
9873 +       if (!user_mode(regs)) {
9874                 crash_fixup_ss_esp(&fixed_regs, regs);
9875                 regs = &fixed_regs;
9876         }
9877 diff -urNp linux-2.6.33/arch/x86/kernel/doublefault_32.c linux-2.6.33/arch/x86/kernel/doublefault_32.c
9878 --- linux-2.6.33/arch/x86/kernel/doublefault_32.c       2010-02-24 13:52:17.000000000 -0500
9879 +++ linux-2.6.33/arch/x86/kernel/doublefault_32.c       2010-03-07 12:23:35.933601961 -0500
9880 @@ -11,7 +11,7 @@
9881
9882  #define DOUBLEFAULT_STACKSIZE (1024)
9883  static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
9884 -#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
9885 +#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
9886
9887  #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
9888
9889 @@ -21,7 +21,7 @@ static void doublefault_fn(void)
9890         unsigned long gdt, tss;
9891
9892         store_gdt(&gdt_desc);
9893 -       gdt = gdt_desc.address;
9894 +       gdt = (unsigned long)gdt_desc.address;
9895
9896         printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
9897
9898 @@ -58,10 +58,10 @@ struct tss_struct doublefault_tss __cach
9899                 /* 0x2 bit is always set */
9900                 .flags          = X86_EFLAGS_SF | 0x2,
9901                 .sp             = STACK_START,
9902 -               .es             = __USER_DS,
9903 +               .es             = __KERNEL_DS,
9904                 .cs             = __KERNEL_CS,
9905                 .ss             = __KERNEL_DS,
9906 -               .ds             = __USER_DS,
9907 +               .ds             = __KERNEL_DS,
9908                 .fs             = __KERNEL_PERCPU,
9909
9910                 .__cr3          = __pa_nodebug(swapper_pg_dir),
9911 diff -urNp linux-2.6.33/arch/x86/kernel/dumpstack_32.c linux-2.6.33/arch/x86/kernel/dumpstack_32.c
9912 --- linux-2.6.33/arch/x86/kernel/dumpstack_32.c 2010-02-24 13:52:17.000000000 -0500
9913 +++ linux-2.6.33/arch/x86/kernel/dumpstack_32.c 2010-03-07 12:23:35.933601961 -0500
9914 @@ -112,11 +112,12 @@ void show_registers(struct pt_regs *regs
9915          * When in-kernel, we also print out the stack and code at the
9916          * time of the fault..
9917          */
9918 -       if (!user_mode_vm(regs)) {
9919 +       if (!user_mode(regs)) {
9920                 unsigned int code_prologue = code_bytes * 43 / 64;
9921                 unsigned int code_len = code_bytes;
9922                 unsigned char c;
9923                 u8 *ip;
9924 +               unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
9925
9926                 printk(KERN_EMERG "Stack:\n");
9927                 show_stack_log_lvl(NULL, regs, &regs->sp,
9928 @@ -124,10 +125,10 @@ void show_registers(struct pt_regs *regs
9929
9930                 printk(KERN_EMERG "Code: ");
9931
9932 -               ip = (u8 *)regs->ip - code_prologue;
9933 +               ip = (u8 *)regs->ip - code_prologue + cs_base;
9934                 if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
9935                         /* try starting at IP */
9936 -                       ip = (u8 *)regs->ip;
9937 +                       ip = (u8 *)regs->ip + cs_base;
9938                         code_len = code_len - code_prologue + 1;
9939                 }
9940                 for (i = 0; i < code_len; i++, ip++) {
9941 @@ -136,7 +137,7 @@ void show_registers(struct pt_regs *regs
9942                                 printk(" Bad EIP value.");
9943                                 break;
9944                         }
9945 -                       if (ip == (u8 *)regs->ip)
9946 +                       if (ip == (u8 *)regs->ip + cs_base)
9947                                 printk("<%02x> ", c);
9948                         else
9949                                 printk("%02x ", c);
9950 @@ -149,6 +150,7 @@ int is_valid_bugaddr(unsigned long ip)
9951  {
9952         unsigned short ud2;
9953
9954 +       ip = ktla_ktva(ip);
9955         if (ip < PAGE_OFFSET)
9956                 return 0;
9957         if (probe_kernel_address((unsigned short *)ip, ud2))
9958 diff -urNp linux-2.6.33/arch/x86/kernel/dumpstack.c linux-2.6.33/arch/x86/kernel/dumpstack.c
9959 --- linux-2.6.33/arch/x86/kernel/dumpstack.c    2010-02-24 13:52:17.000000000 -0500
9960 +++ linux-2.6.33/arch/x86/kernel/dumpstack.c    2010-03-07 12:23:35.933601961 -0500
9961 @@ -207,7 +207,7 @@ void dump_stack(void)
9962  #endif
9963
9964         printk("Pid: %d, comm: %.20s xid: #%u %s %s %.*s\n",
9965 -               current->pid, current->comm, current->xid, print_tainted(),
9966 +               task_pid_nr(current), current->comm, current->xid, print_tainted(),
9967                 init_utsname()->release,
9968                 (int)strcspn(init_utsname()->version, " "),
9969                 init_utsname()->version);
9970 @@ -268,7 +268,7 @@ void __kprobes oops_end(unsigned long fl
9971                 panic("Fatal exception in interrupt");
9972         if (panic_on_oops)
9973                 panic("Fatal exception");
9974 -       do_exit(signr);
9975 +       do_group_exit(signr);
9976  }
9977
9978  int __kprobes __die(const char *str, struct pt_regs *regs, long err)
9979 @@ -295,7 +295,7 @@ int __kprobes __die(const char *str, str
9980
9981         show_registers(regs);
9982  #ifdef CONFIG_X86_32
9983 -       if (user_mode_vm(regs)) {
9984 +       if (user_mode(regs)) {
9985                 sp = regs->sp;
9986                 ss = regs->ss & 0xffff;
9987         } else {
9988 @@ -323,7 +323,7 @@ void die(const char *str, struct pt_regs
9989         unsigned long flags = oops_begin();
9990         int sig = SIGSEGV;
9991
9992 -       if (!user_mode_vm(regs))
9993 +       if (!user_mode(regs))
9994                 report_bug(regs->ip, regs);
9995
9996         if (__die(str, regs, err))
9997 diff -urNp linux-2.6.33/arch/x86/kernel/e820.c linux-2.6.33/arch/x86/kernel/e820.c
9998 --- linux-2.6.33/arch/x86/kernel/e820.c 2010-02-24 13:52:17.000000000 -0500
9999 +++ linux-2.6.33/arch/x86/kernel/e820.c 2010-03-07 12:23:35.933601961 -0500
10000 @@ -28,6 +28,8 @@
10001  #include <asm/setup.h>
10002  #include <asm/trampoline.h>
10003
10004 +#include "acpi/realmode/wakeup.h"
10005 +
10006  /*
10007   * The e820 map is the map that gets modified e.g. with command line parameters
10008   * and that is also registered with modifications in the kernel resource tree
10009 @@ -741,8 +743,19 @@ static struct early_res early_res[MAX_EA
10010          */
10011         { PAGE_SIZE, PAGE_SIZE + PAGE_SIZE, "EX TRAMPOLINE", 1 },
10012  #endif
10013 -
10014 -       {}
10015 +#ifdef CONFIG_VM86
10016 +#ifdef CONFIG_ACPI_SLEEP
10017 +#define ACPI_EXTRA WAKEUP_SIZE
10018 +#else
10019 +#define ACPI_EXTRA 0
10020 +#endif
10021 +#if defined(CONFIG_X86_32) && defined(CONFIG_X86_TRAMPOLINE)
10022 +       { 3*PAGE_SIZE + ACPI_EXTRA, ISA_START_ADDRESS, "V86 mode memory", 1 },
10023 +#else
10024 +       { 2*PAGE_SIZE + ACPI_EXTRA, ISA_START_ADDRESS, "V86 mode memory", 1 },
10025 +#endif
10026 +#endif
10027 +       { 0, 0, {0}, 0 }
10028  };
10029
10030  static int __init find_overlapped_early(u64 start, u64 end)
10031 diff -urNp linux-2.6.33/arch/x86/kernel/efi_32.c linux-2.6.33/arch/x86/kernel/efi_32.c
10032 --- linux-2.6.33/arch/x86/kernel/efi_32.c       2010-02-24 13:52:17.000000000 -0500
10033 +++ linux-2.6.33/arch/x86/kernel/efi_32.c       2010-03-07 12:23:35.933601961 -0500
10034 @@ -38,70 +38,38 @@
10035   */
10036
10037  static unsigned long efi_rt_eflags;
10038 -static pgd_t efi_bak_pg_dir_pointer[2];
10039 +static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
10040
10041 -void efi_call_phys_prelog(void)
10042 +void __init efi_call_phys_prelog(void)
10043  {
10044 -       unsigned long cr4;
10045 -       unsigned long temp;
10046         struct desc_ptr gdt_descr;
10047
10048         local_irq_save(efi_rt_eflags);
10049
10050 -       /*
10051 -        * If I don't have PAE, I should just duplicate two entries in page
10052 -        * directory. If I have PAE, I just need to duplicate one entry in
10053 -        * page directory.
10054 -        */
10055 -       cr4 = read_cr4_safe();
10056
10057 -       if (cr4 & X86_CR4_PAE) {
10058 -               efi_bak_pg_dir_pointer[0].pgd =
10059 -                   swapper_pg_dir[pgd_index(0)].pgd;
10060 -               swapper_pg_dir[0].pgd =
10061 -                   swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
10062 -       } else {
10063 -               efi_bak_pg_dir_pointer[0].pgd =
10064 -                   swapper_pg_dir[pgd_index(0)].pgd;
10065 -               efi_bak_pg_dir_pointer[1].pgd =
10066 -                   swapper_pg_dir[pgd_index(0x400000)].pgd;
10067 -               swapper_pg_dir[pgd_index(0)].pgd =
10068 -                   swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
10069 -               temp = PAGE_OFFSET + 0x400000;
10070 -               swapper_pg_dir[pgd_index(0x400000)].pgd =
10071 -                   swapper_pg_dir[pgd_index(temp)].pgd;
10072 -       }
10073 +       clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
10074 +       clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
10075 +                       min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
10076
10077         /*
10078          * After the lock is released, the original page table is restored.
10079          */
10080         __flush_tlb_all();
10081
10082 -       gdt_descr.address = __pa(get_cpu_gdt_table(0));
10083 +       gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
10084         gdt_descr.size = GDT_SIZE - 1;
10085         load_gdt(&gdt_descr);
10086  }
10087
10088 -void efi_call_phys_epilog(void)
10089 +void __init efi_call_phys_epilog(void)
10090  {
10091 -       unsigned long cr4;
10092         struct desc_ptr gdt_descr;
10093
10094 -       gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
10095 +       gdt_descr.address = get_cpu_gdt_table(0);
10096         gdt_descr.size = GDT_SIZE - 1;
10097         load_gdt(&gdt_descr);
10098
10099 -       cr4 = read_cr4_safe();
10100 -
10101 -       if (cr4 & X86_CR4_PAE) {
10102 -               swapper_pg_dir[pgd_index(0)].pgd =
10103 -                   efi_bak_pg_dir_pointer[0].pgd;
10104 -       } else {
10105 -               swapper_pg_dir[pgd_index(0)].pgd =
10106 -                   efi_bak_pg_dir_pointer[0].pgd;
10107 -               swapper_pg_dir[pgd_index(0x400000)].pgd =
10108 -                   efi_bak_pg_dir_pointer[1].pgd;
10109 -       }
10110 +       clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
10111
10112         /*
10113          * After the lock is released, the original page table is restored.
10114 diff -urNp linux-2.6.33/arch/x86/kernel/efi_stub_32.S linux-2.6.33/arch/x86/kernel/efi_stub_32.S
10115 --- linux-2.6.33/arch/x86/kernel/efi_stub_32.S  2010-02-24 13:52:17.000000000 -0500
10116 +++ linux-2.6.33/arch/x86/kernel/efi_stub_32.S  2010-03-07 12:23:35.933601961 -0500
10117 @@ -6,6 +6,7 @@
10118   */
10119
10120  #include <linux/linkage.h>
10121 +#include <linux/init.h>
10122  #include <asm/page_types.h>
10123
10124  /*
10125 @@ -20,7 +21,7 @@
10126   * service functions will comply with gcc calling convention, too.
10127   */
10128
10129 -.text
10130 +__INIT
10131  ENTRY(efi_call_phys)
10132         /*
10133          * 0. The function can only be called in Linux kernel. So CS has been
10134 @@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
10135          * The mapping of lower virtual memory has been created in prelog and
10136          * epilog.
10137          */
10138 -       movl    $1f, %edx
10139 -       subl    $__PAGE_OFFSET, %edx
10140 -       jmp     *%edx
10141 +       jmp     1f-__PAGE_OFFSET
10142  1:
10143
10144         /*
10145 @@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
10146          * parameter 2, ..., param n. To make things easy, we save the return
10147          * address of efi_call_phys in a global variable.
10148          */
10149 -       popl    %edx
10150 -       movl    %edx, saved_return_addr
10151 -       /* get the function pointer into ECX*/
10152 -       popl    %ecx
10153 -       movl    %ecx, efi_rt_function_ptr
10154 -       movl    $2f, %edx
10155 -       subl    $__PAGE_OFFSET, %edx
10156 -       pushl   %edx
10157 +       popl    (saved_return_addr)
10158 +       popl    (efi_rt_function_ptr)
10159
10160         /*
10161          * 3. Clear PG bit in %CR0.
10162 @@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
10163         /*
10164          * 5. Call the physical function.
10165          */
10166 -       jmp     *%ecx
10167 +       call    *(efi_rt_function_ptr-__PAGE_OFFSET)
10168
10169 -2:
10170         /*
10171          * 6. After EFI runtime service returns, control will return to
10172          * following instruction. We'd better readjust stack pointer first.
10173 @@ -88,35 +80,28 @@ ENTRY(efi_call_phys)
10174         movl    %cr0, %edx
10175         orl     $0x80000000, %edx
10176         movl    %edx, %cr0
10177 -       jmp     1f
10178 -1:
10179 +
10180         /*
10181          * 8. Now restore the virtual mode from flat mode by
10182          * adding EIP with PAGE_OFFSET.
10183          */
10184 -       movl    $1f, %edx
10185 -       jmp     *%edx
10186 +       jmp     1f+__PAGE_OFFSET
10187  1:
10188
10189         /*
10190          * 9. Balance the stack. And because EAX contain the return value,
10191          * we'd better not clobber it.
10192          */
10193 -       leal    efi_rt_function_ptr, %edx
10194 -       movl    (%edx), %ecx
10195 -       pushl   %ecx
10196 +       pushl   (efi_rt_function_ptr)
10197
10198         /*
10199 -        * 10. Push the saved return address onto the stack and return.
10200 +        * 10. Return to the saved return address.
10201          */
10202 -       leal    saved_return_addr, %edx
10203 -       movl    (%edx), %ecx
10204 -       pushl   %ecx
10205 -       ret
10206 +       jmpl    *(saved_return_addr)
10207  ENDPROC(efi_call_phys)
10208  .previous
10209
10210 -.data
10211 +__INITDATA
10212  saved_return_addr:
10213         .long 0
10214  efi_rt_function_ptr:
10215 diff -urNp linux-2.6.33/arch/x86/kernel/entry_32.S linux-2.6.33/arch/x86/kernel/entry_32.S
10216 --- linux-2.6.33/arch/x86/kernel/entry_32.S     2010-02-24 13:52:17.000000000 -0500
10217 +++ linux-2.6.33/arch/x86/kernel/entry_32.S     2010-03-07 12:23:35.937701195 -0500
10218 @@ -191,7 +191,7 @@
10219
10220  #endif /* CONFIG_X86_32_LAZY_GS */
10221
10222 -.macro SAVE_ALL
10223 +.macro __SAVE_ALL _DS
10224         cld
10225         PUSH_GS
10226         pushl %fs
10227 @@ -224,7 +224,7 @@
10228         pushl %ebx
10229         CFI_ADJUST_CFA_OFFSET 4
10230         CFI_REL_OFFSET ebx, 0
10231 -       movl $(__USER_DS), %edx
10232 +       movl $\_DS, %edx
10233         movl %edx, %ds
10234         movl %edx, %es
10235         movl $(__KERNEL_PERCPU), %edx
10236 @@ -232,6 +232,15 @@
10237         SET_KERNEL_GS %edx
10238  .endm
10239
10240 +.macro SAVE_ALL
10241 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
10242 +       __SAVE_ALL __KERNEL_DS
10243 +       PAX_ENTER_KERNEL
10244 +#else
10245 +       __SAVE_ALL __USER_DS
10246 +#endif
10247 +.endm
10248 +
10249  .macro RESTORE_INT_REGS
10250         popl %ebx
10251         CFI_ADJUST_CFA_OFFSET -4
10252 @@ -356,7 +365,15 @@ check_userspace:
10253         movb PT_CS(%esp), %al
10254         andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
10255         cmpl $USER_RPL, %eax
10256 +
10257 +#ifdef CONFIG_PAX_KERNEXEC
10258 +       jae resume_userspace
10259 +
10260 +       PAX_EXIT_KERNEL
10261 +       jmp resume_kernel
10262 +#else
10263         jb resume_kernel                # not returning to v8086 or userspace
10264 +#endif
10265
10266  ENTRY(resume_userspace)
10267         LOCKDEP_SYS_EXIT
10268 @@ -422,10 +439,9 @@ sysenter_past_esp:
10269         /*CFI_REL_OFFSET cs, 0*/
10270         /*
10271          * Push current_thread_info()->sysenter_return to the stack.
10272 -        * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
10273 -        * pushed above; +8 corresponds to copy_thread's esp0 setting.
10274          */
10275 -       pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
10276 +       GET_THREAD_INFO(%ebp)
10277 +       pushl TI_sysenter_return(%ebp)
10278         CFI_ADJUST_CFA_OFFSET 4
10279         CFI_REL_OFFSET eip, 0
10280
10281 @@ -438,9 +454,19 @@ sysenter_past_esp:
10282   * Load the potential sixth argument from user stack.
10283   * Careful about security.
10284   */
10285 +       movl PT_OLDESP(%esp),%ebp
10286 +
10287 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10288 +       mov PT_OLDSS(%esp),%ds
10289 +1:     movl %ds:(%ebp),%ebp
10290 +       push %ss
10291 +       pop %ds
10292 +#else
10293         cmpl $__PAGE_OFFSET-3,%ebp
10294         jae syscall_fault
10295  1:     movl (%ebp),%ebp
10296 +#endif
10297 +
10298         movl %ebp,PT_EBP(%esp)
10299  .section __ex_table,"a"
10300         .align 4
10301 @@ -463,12 +489,23 @@ sysenter_do_call:
10302         testl $_TIF_ALLWORK_MASK, %ecx
10303         jne sysexit_audit
10304  sysenter_exit:
10305 +
10306 +#ifdef CONFIG_PAX_RANDKSTACK
10307 +       pushl %eax
10308 +       CFI_ADJUST_CFA_OFFSET 4
10309 +       call pax_randomize_kstack
10310 +       popl %eax
10311 +       CFI_ADJUST_CFA_OFFSET -4
10312 +#endif
10313 +
10314  /* if something modifies registers it must also disable sysexit */
10315         movl PT_EIP(%esp), %edx
10316         movl PT_OLDESP(%esp), %ecx
10317         xorl %ebp,%ebp
10318         TRACE_IRQS_ON
10319  1:     mov  PT_FS(%esp), %fs
10320 +2:     mov  PT_DS(%esp), %ds
10321 +3:     mov  PT_ES(%esp), %es
10322         PTGS_TO_GS
10323         ENABLE_INTERRUPTS_SYSEXIT
10324
10325 @@ -512,11 +549,17 @@ sysexit_audit:
10326
10327         CFI_ENDPROC
10328  .pushsection .fixup,"ax"
10329 -2:     movl $0,PT_FS(%esp)
10330 +4:     movl $0,PT_FS(%esp)
10331 +       jmp 1b
10332 +5:     movl $0,PT_DS(%esp)
10333 +       jmp 1b
10334 +6:     movl $0,PT_ES(%esp)
10335         jmp 1b
10336  .section __ex_table,"a"
10337         .align 4
10338 -       .long 1b,2b
10339 +       .long 1b,4b
10340 +       .long 2b,5b
10341 +       .long 3b,6b
10342  .popsection
10343         PTGS_TO_GS_EX
10344  ENDPROC(ia32_sysenter_target)
10345 @@ -550,6 +593,10 @@ syscall_exit:
10346         testl $_TIF_ALLWORK_MASK, %ecx  # current->work
10347         jne syscall_exit_work
10348
10349 +#ifdef CONFIG_PAX_RANDKSTACK
10350 +       call pax_randomize_kstack
10351 +#endif
10352 +
10353  restore_all:
10354         TRACE_IRQS_IRET
10355  restore_all_notrace:
10356 @@ -614,7 +661,13 @@ ldt_ss:
10357         mov PT_OLDESP(%esp), %eax       /* load userspace esp */
10358         mov %dx, %ax                    /* eax: new kernel esp */
10359         sub %eax, %edx                  /* offset (low word is 0) */
10360 -       PER_CPU(gdt_page, %ebx)
10361 +#ifdef CONFIG_SMP
10362 +       movl PER_CPU_VAR(cpu_number), %ebx
10363 +       shll $PAGE_SHIFT_asm, %ebx
10364 +       addl $cpu_gdt_table, %ebx
10365 +#else
10366 +       movl $cpu_gdt_table, %ebx
10367 +#endif
10368         shr $16, %edx
10369         mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
10370         mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
10371 @@ -654,25 +707,19 @@ work_resched:
10372
10373  work_notifysig:                                # deal with pending signals and
10374                                         # notify-resume requests
10375 +       movl %esp, %eax
10376  #ifdef CONFIG_VM86
10377         testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
10378 -       movl %esp, %eax
10379 -       jne work_notifysig_v86          # returning to kernel-space or
10380 +       jz 1f                           # returning to kernel-space or
10381                                         # vm86-space
10382 -       xorl %edx, %edx
10383 -       call do_notify_resume
10384 -       jmp resume_userspace_sig
10385
10386 -       ALIGN
10387 -work_notifysig_v86:
10388         pushl %ecx                      # save ti_flags for do_notify_resume
10389         CFI_ADJUST_CFA_OFFSET 4
10390         call save_v86_state             # %eax contains pt_regs pointer
10391         popl %ecx
10392         CFI_ADJUST_CFA_OFFSET -4
10393         movl %eax, %esp
10394 -#else
10395 -       movl %esp, %eax
10396 +1:
10397  #endif
10398         xorl %edx, %edx
10399         call do_notify_resume
10400 @@ -707,6 +754,10 @@ END(syscall_exit_work)
10401
10402         RING0_INT_FRAME                 # can't unwind into user space anyway
10403  syscall_fault:
10404 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10405 +       push %ss
10406 +       pop %ds
10407 +#endif
10408         GET_THREAD_INFO(%ebp)
10409         movl $-EFAULT,PT_EAX(%esp)
10410         jmp resume_userspace
10411 @@ -790,7 +841,13 @@ ptregs_clone:
10412   * normal stack and adjusts ESP with the matching offset.
10413   */
10414         /* fixup the stack */
10415 -       PER_CPU(gdt_page, %ebx)
10416 +#ifdef CONFIG_SMP
10417 +       movl PER_CPU_VAR(cpu_number), %ebx
10418 +       shll $PAGE_SHIFT_asm, %ebx
10419 +       addl $cpu_gdt_table, %ebx
10420 +#else
10421 +       movl $cpu_gdt_table, %ebx
10422 +#endif
10423         mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
10424         mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
10425         shl $16, %eax
10426 @@ -1254,7 +1311,6 @@ return_to_handler:
10427         jmp *%ecx
10428  #endif
10429
10430 -.section .rodata,"a"
10431  #include "syscall_table_32.S"
10432
10433  syscall_table_size=(.-sys_call_table)
10434 @@ -1306,12 +1362,15 @@ error_code:
10435         movl %ecx, %fs
10436         UNWIND_ESPFIX_STACK
10437         GS_TO_REG %ecx
10438 +
10439 +       PAX_ENTER_KERNEL
10440 +
10441         movl PT_GS(%esp), %edi          # get the function address
10442         movl PT_ORIG_EAX(%esp), %edx    # get the error code
10443         movl $-1, PT_ORIG_EAX(%esp)     # no syscall to restart
10444         REG_TO_PTGS %ecx
10445         SET_KERNEL_GS %ecx
10446 -       movl $(__USER_DS), %ecx
10447 +       movl $(__KERNEL_DS), %ecx
10448         movl %ecx, %ds
10449         movl %ecx, %es
10450         TRACE_IRQS_OFF
10451 @@ -1407,6 +1466,9 @@ nmi_stack_correct:
10452         xorl %edx,%edx          # zero error code
10453         movl %esp,%eax          # pt_regs pointer
10454         call do_nmi
10455 +
10456 +       PAX_EXIT_KERNEL
10457 +
10458         jmp restore_all_notrace
10459         CFI_ENDPROC
10460
10461 @@ -1447,6 +1509,9 @@ nmi_espfix_stack:
10462         FIXUP_ESPFIX_STACK              # %eax == %esp
10463         xorl %edx,%edx                  # zero error code
10464         call do_nmi
10465 +
10466 +       PAX_EXIT_KERNEL
10467 +
10468         RESTORE_REGS
10469         lss 12+4(%esp), %esp            # back to espfix stack
10470         CFI_ADJUST_CFA_OFFSET -24
10471 diff -urNp linux-2.6.33/arch/x86/kernel/entry_64.S linux-2.6.33/arch/x86/kernel/entry_64.S
10472 --- linux-2.6.33/arch/x86/kernel/entry_64.S     2010-02-24 13:52:17.000000000 -0500
10473 +++ linux-2.6.33/arch/x86/kernel/entry_64.S     2010-03-07 12:23:35.937701195 -0500
10474 @@ -53,6 +53,7 @@
10475  #include <asm/paravirt.h>
10476  #include <asm/ftrace.h>
10477  #include <asm/percpu.h>
10478 +#include <asm/pgtable.h>
10479
10480  /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
10481  #include <linux/elf-em.h>
10482 @@ -800,6 +801,7 @@ END(interrupt)
10483         CFI_ADJUST_CFA_OFFSET 10*8
10484         call save_args
10485         PARTIAL_FRAME 0
10486 +       PAX_ENTER_KERNEL
10487         call \func
10488         .endm
10489
10490 @@ -825,6 +827,7 @@ ret_from_intr:
10491         CFI_DEF_CFA_REGISTER    rsp
10492         CFI_ADJUST_CFA_OFFSET   -8
10493  exit_intr:
10494 +       PAX_EXIT_KERNEL
10495         GET_THREAD_INFO(%rcx)
10496         testl $3,CS-ARGOFFSET(%rsp)
10497         je retint_kernel
10498 @@ -1040,6 +1043,7 @@ ENTRY(\sym)
10499         CFI_ADJUST_CFA_OFFSET 15*8
10500         call error_entry
10501         DEFAULT_FRAME 0
10502 +       PAX_ENTER_KERNEL
10503         movq %rsp,%rdi          /* pt_regs pointer */
10504         xorl %esi,%esi          /* no error code */
10505         call \do_sym
10506 @@ -1057,6 +1061,7 @@ ENTRY(\sym)
10507         subq $15*8, %rsp
10508         call save_paranoid
10509         TRACE_IRQS_OFF
10510 +       PAX_ENTER_KERNEL
10511         movq %rsp,%rdi          /* pt_regs pointer */
10512         xorl %esi,%esi          /* no error code */
10513         call \do_sym
10514 @@ -1074,9 +1079,15 @@ ENTRY(\sym)
10515         subq $15*8, %rsp
10516         call save_paranoid
10517         TRACE_IRQS_OFF
10518 +       PAX_ENTER_KERNEL
10519         movq %rsp,%rdi          /* pt_regs pointer */
10520         xorl %esi,%esi          /* no error code */
10521 -       PER_CPU(init_tss, %r12)
10522 +#ifdef CONFIG_SMP
10523 +       imul $TSS_size, PER_CPU_VAR(cpu_number), %r12d
10524 +       lea init_tss(%r12), %r12
10525 +#else
10526 +       lea init_tss(%rip), %r12
10527 +#endif
10528         subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%r12)
10529         call \do_sym
10530         addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%r12)
10531 @@ -1093,6 +1104,7 @@ ENTRY(\sym)
10532         CFI_ADJUST_CFA_OFFSET 15*8
10533         call error_entry
10534         DEFAULT_FRAME 0
10535 +       PAX_ENTER_KERNEL
10536         movq %rsp,%rdi                  /* pt_regs pointer */
10537         movq ORIG_RAX(%rsp),%rsi        /* get error code */
10538         movq $-1,ORIG_RAX(%rsp)         /* no syscall to restart */
10539 @@ -1112,6 +1124,7 @@ ENTRY(\sym)
10540         call save_paranoid
10541         DEFAULT_FRAME 0
10542         TRACE_IRQS_OFF
10543 +       PAX_ENTER_KERNEL
10544         movq %rsp,%rdi                  /* pt_regs pointer */
10545         movq ORIG_RAX(%rsp),%rsi        /* get error code */
10546         movq $-1,ORIG_RAX(%rsp)         /* no syscall to restart */
10547 @@ -1373,11 +1386,13 @@ ENTRY(paranoid_exit)
10548         testl $3,CS(%rsp)
10549         jnz   paranoid_userspace
10550  paranoid_swapgs:
10551 +       PAX_EXIT_KERNEL
10552         TRACE_IRQS_IRETQ 0
10553         SWAPGS_UNSAFE_STACK
10554         RESTORE_ALL 8
10555         jmp irq_return
10556  paranoid_restore:
10557 +       PAX_EXIT_KERNEL
10558         TRACE_IRQS_IRETQ 0
10559         RESTORE_ALL 8
10560         jmp irq_return
10561 @@ -1499,6 +1514,7 @@ ENTRY(nmi)
10562         CFI_ADJUST_CFA_OFFSET 15*8
10563         call save_paranoid
10564         DEFAULT_FRAME 0
10565 +       PAX_ENTER_KERNEL
10566         /* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
10567         movq %rsp,%rdi
10568         movq $-1,%rsi
10569 @@ -1514,6 +1530,7 @@ ENTRY(nmi)
10570  nmi_swapgs:
10571         SWAPGS_UNSAFE_STACK
10572  nmi_restore:
10573 +       PAX_EXIT_KERNEL
10574         RESTORE_ALL 8
10575         jmp irq_return
10576  nmi_userspace:
10577 diff -urNp linux-2.6.33/arch/x86/kernel/ftrace.c linux-2.6.33/arch/x86/kernel/ftrace.c
10578 --- linux-2.6.33/arch/x86/kernel/ftrace.c       2010-02-24 13:52:17.000000000 -0500
10579 +++ linux-2.6.33/arch/x86/kernel/ftrace.c       2010-03-07 12:23:35.937701195 -0500
10580 @@ -151,7 +151,9 @@ void ftrace_nmi_enter(void)
10581  {
10582         if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
10583                 smp_rmb();
10584 +               pax_open_kernel();
10585                 ftrace_mod_code();
10586 +               pax_close_kernel();
10587                 atomic_inc(&nmi_update_count);
10588         }
10589         /* Must have previous changes seen before executions */
10590 @@ -234,7 +236,7 @@ do_ftrace_mod_code(unsigned long ip, voi
10591
10592
10593
10594 -static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
10595 +static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
10596
10597  static unsigned char *ftrace_nop_replace(void)
10598  {
10599 @@ -247,6 +249,8 @@ ftrace_modify_code(unsigned long ip, uns
10600  {
10601         unsigned char replaced[MCOUNT_INSN_SIZE];
10602
10603 +       ip = ktla_ktva(ip);
10604 +
10605         /*
10606          * Note: Due to modules and __init, code can
10607          *  disappear and change, we need to protect against faulting
10608 @@ -303,7 +307,7 @@ int ftrace_update_ftrace_func(ftrace_fun
10609         unsigned char old[MCOUNT_INSN_SIZE], *new;
10610         int ret;
10611
10612 -       memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
10613 +       memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
10614         new = ftrace_call_replace(ip, (unsigned long)func);
10615         ret = ftrace_modify_code(ip, old, new);
10616
10617 @@ -356,15 +360,15 @@ int __init ftrace_dyn_arch_init(void *da
10618         switch (faulted) {
10619         case 0:
10620                 pr_info("converting mcount calls to 0f 1f 44 00 00\n");
10621 -               memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
10622 +               memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
10623                 break;
10624         case 1:
10625                 pr_info("converting mcount calls to 66 66 66 66 90\n");
10626 -               memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
10627 +               memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
10628                 break;
10629         case 2:
10630                 pr_info("converting mcount calls to jmp . + 5\n");
10631 -               memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
10632 +               memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
10633                 break;
10634         }
10635
10636 @@ -385,6 +389,8 @@ static int ftrace_mod_jmp(unsigned long
10637  {
10638         unsigned char code[MCOUNT_INSN_SIZE];
10639
10640 +       ip = ktla_ktva(ip);
10641 +
10642         if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
10643                 return -EFAULT;
10644
10645 diff -urNp linux-2.6.33/arch/x86/kernel/head32.c linux-2.6.33/arch/x86/kernel/head32.c
10646 --- linux-2.6.33/arch/x86/kernel/head32.c       2010-02-24 13:52:17.000000000 -0500
10647 +++ linux-2.6.33/arch/x86/kernel/head32.c       2010-03-07 12:23:35.937701195 -0500
10648 @@ -16,6 +16,7 @@
10649  #include <asm/apic.h>
10650  #include <asm/io_apic.h>
10651  #include <asm/bios_ebda.h>
10652 +#include <asm/boot.h>
10653
10654  static void __init i386_default_early_setup(void)
10655  {
10656 @@ -29,7 +30,7 @@ static void __init i386_default_early_se
10657
10658  void __init i386_start_kernel(void)
10659  {
10660 -       reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
10661 +       reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
10662
10663  #ifdef CONFIG_BLK_DEV_INITRD
10664         /* Reserve INITRD */
10665 diff -urNp linux-2.6.33/arch/x86/kernel/head_32.S linux-2.6.33/arch/x86/kernel/head_32.S
10666 --- linux-2.6.33/arch/x86/kernel/head_32.S      2010-02-24 13:52:17.000000000 -0500
10667 +++ linux-2.6.33/arch/x86/kernel/head_32.S      2010-03-07 12:23:35.937701195 -0500
10668 @@ -21,10 +21,17 @@
10669  #include <asm/msr-index.h>
10670  #include <asm/cpufeature.h>
10671  #include <asm/percpu.h>
10672 +#include <asm/msr-index.h>
10673
10674  /* Physical address */
10675  #define pa(X) ((X) - __PAGE_OFFSET)
10676
10677 +#ifdef CONFIG_PAX_KERNEXEC
10678 +#define ta(X) (X)
10679 +#else
10680 +#define ta(X) ((X) - __PAGE_OFFSET)
10681 +#endif
10682 +
10683  /*
10684   * References to members of the new_cpu_data structure.
10685   */
10686 @@ -54,11 +61,7 @@
10687   * and small than max_low_pfn, otherwise will waste some page table entries
10688   */
10689
10690 -#if PTRS_PER_PMD > 1
10691 -#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
10692 -#else
10693 -#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
10694 -#endif
10695 +#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
10696
10697  /* Enough space to fit pagetables for the low memory linear map */
10698  MAPPING_BEYOND_END = \
10699 @@ -75,6 +78,12 @@ INIT_MAP_SIZE = PAGE_TABLE_SIZE(KERNEL_P
10700  RESERVE_BRK(pagetables, INIT_MAP_SIZE)
10701
10702  /*
10703 + * Real beginning of normal "text" segment
10704 + */
10705 +ENTRY(stext)
10706 +ENTRY(_stext)
10707 +
10708 +/*
10709   * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
10710   * %esi points to the real-mode code as a 32-bit pointer.
10711   * CS and DS must be 4 GB flat segments, but we don't depend on
10712 @@ -82,6 +91,13 @@ RESERVE_BRK(pagetables, INIT_MAP_SIZE)
10713   * can.
10714   */
10715  __HEAD
10716 +
10717 +#ifdef CONFIG_PAX_KERNEXEC
10718 +       jmp startup_32
10719 +/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
10720 +.fill PAGE_SIZE-5,1,0xcc
10721 +#endif
10722 +
10723  ENTRY(startup_32)
10724         /* test KEEP_SEGMENTS flag to see if the bootloader is asking
10725                 us to not reload segments */
10726 @@ -99,6 +115,55 @@ ENTRY(startup_32)
10727         movl %eax,%gs
10728  2:
10729
10730 +#ifdef CONFIG_SMP
10731 +       movl $pa(cpu_gdt_table),%edi
10732 +       movl $__per_cpu_load,%eax
10733 +       movw %ax,__KERNEL_PERCPU + 2(%edi)
10734 +       rorl $16,%eax
10735 +       movb %al,__KERNEL_PERCPU + 4(%edi)
10736 +       movb %ah,__KERNEL_PERCPU + 7(%edi)
10737 +       movl $__per_cpu_end - 1,%eax
10738 +       subl $__per_cpu_start,%eax
10739 +       movw %ax,__KERNEL_PERCPU + 0(%edi)
10740 +#endif
10741 +
10742 +#ifdef CONFIG_PAX_MEMORY_UDEREF
10743 +       movl $NR_CPUS,%ecx
10744 +       movl $pa(cpu_gdt_table),%edi
10745 +1:
10746 +       movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
10747 +       addl $PAGE_SIZE_asm,%edi
10748 +       loop 1b
10749 +#endif
10750 +
10751 +#ifdef CONFIG_PAX_KERNEXEC
10752 +       movl $pa(boot_gdt),%edi
10753 +       movl $__LOAD_PHYSICAL_ADDR,%eax
10754 +       movw %ax,__BOOT_CS + 2(%edi)
10755 +       rorl $16,%eax
10756 +       movb %al,__BOOT_CS + 4(%edi)
10757 +       movb %ah,__BOOT_CS + 7(%edi)
10758 +       rorl $16,%eax
10759 +
10760 +       ljmp $(__BOOT_CS),$1f
10761 +1:
10762 +
10763 +       movl $NR_CPUS,%ecx
10764 +       movl $pa(cpu_gdt_table),%edi
10765 +       addl $__PAGE_OFFSET,%eax
10766 +1:
10767 +       movw %ax,__KERNEL_CS + 2(%edi)
10768 +       movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
10769 +       rorl $16,%eax
10770 +       movb %al,__KERNEL_CS + 4(%edi)
10771 +       movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
10772 +       movb %ah,__KERNEL_CS + 7(%edi)
10773 +       movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
10774 +       rorl $16,%eax
10775 +       addl $PAGE_SIZE_asm,%edi
10776 +       loop 1b
10777 +#endif
10778 +
10779  /*
10780   * Clear BSS first so that there are no surprises...
10781   */
10782 @@ -142,9 +207,7 @@ ENTRY(startup_32)
10783         cmpl $num_subarch_entries, %eax
10784         jae bad_subarch
10785
10786 -       movl pa(subarch_entries)(,%eax,4), %eax
10787 -       subl $__PAGE_OFFSET, %eax
10788 -       jmp *%eax
10789 +       jmp *pa(subarch_entries)(,%eax,4)
10790
10791  bad_subarch:
10792  WEAK(lguest_entry)
10793 @@ -156,10 +219,10 @@ WEAK(xen_entry)
10794         __INITDATA
10795
10796  subarch_entries:
10797 -       .long default_entry             /* normal x86/PC */
10798 -       .long lguest_entry              /* lguest hypervisor */
10799 -       .long xen_entry                 /* Xen hypervisor */
10800 -       .long default_entry             /* Moorestown MID */
10801 +       .long ta(default_entry)         /* normal x86/PC */
10802 +       .long ta(lguest_entry)          /* lguest hypervisor */
10803 +       .long ta(xen_entry)             /* Xen hypervisor */
10804 +       .long ta(default_entry)         /* Moorestown MID */
10805  num_subarch_entries = (. - subarch_entries) / 4
10806  .previous
10807  #endif /* CONFIG_PARAVIRT */
10808 @@ -220,8 +283,11 @@ default_entry:
10809         movl %eax, pa(max_pfn_mapped)
10810
10811         /* Do early initialization of the fixmap area */
10812 -       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
10813 -       movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
10814 +#ifdef CONFIG_COMPAT_VDSO
10815 +       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
10816 +#else
10817 +       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
10818 +#endif
10819  #else  /* Not PAE */
10820
10821  page_pde_offset = (__PAGE_OFFSET >> 20);
10822 @@ -251,8 +317,11 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
10823         movl %eax, pa(max_pfn_mapped)
10824
10825         /* Do early initialization of the fixmap area */
10826 -       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
10827 -       movl %eax,pa(swapper_pg_dir+0xffc)
10828 +#ifdef CONFIG_COMPAT_VDSO
10829 +       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
10830 +#else
10831 +       movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
10832 +#endif
10833  #endif
10834         jmp 3f
10835  /*
10836 @@ -299,6 +368,7 @@ ENTRY(startup_32_smp)
10837         orl %edx,%eax
10838         movl %eax,%cr4
10839
10840 +#ifdef CONFIG_X86_PAE
10841         testb $X86_CR4_PAE, %al         # check if PAE is enabled
10842         jz 6f
10843
10844 @@ -323,6 +393,9 @@ ENTRY(startup_32_smp)
10845         /* Make changes effective */
10846         wrmsr
10847
10848 +       btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
10849 +#endif
10850 +
10851  6:
10852
10853  /*
10854 @@ -348,9 +421,7 @@ ENTRY(startup_32_smp)
10855
10856  #ifdef CONFIG_SMP
10857         cmpb $0, ready
10858 -       jz  1f                          /* Initial CPU cleans BSS */
10859 -       jmp checkCPUtype
10860 -1:
10861 +       jnz checkCPUtype                /* Initial CPU cleans BSS */
10862  #endif /* CONFIG_SMP */
10863
10864  /*
10865 @@ -428,7 +499,7 @@ is386:      movl $2,%ecx            # set MP
10866  1:     movl $(__KERNEL_DS),%eax        # reload all the segment registers
10867         movl %eax,%ss                   # after changing gdt.
10868
10869 -       movl $(__USER_DS),%eax          # DS/ES contains default USER segment
10870 +#      movl $(__KERNEL_DS),%eax        # DS/ES contains default KERNEL segment
10871         movl %eax,%ds
10872         movl %eax,%es
10873
10874 @@ -442,8 +513,11 @@ is386:     movl $2,%ecx            # set MP
10875          */
10876         cmpb $0,ready
10877         jne 1f
10878 -       movl $per_cpu__gdt_page,%eax
10879 +       movl $cpu_gdt_table,%eax
10880         movl $per_cpu__stack_canary,%ecx
10881 +#ifdef CONFIG_SMP
10882 +       addl $__per_cpu_load,%ecx
10883 +#endif
10884         movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
10885         shrl $16, %ecx
10886         movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
10887 @@ -461,10 +535,6 @@ is386:     movl $2,%ecx            # set MP
10888  #ifdef CONFIG_SMP
10889         movb ready, %cl
10890         movb $1, ready
10891 -       cmpb $0,%cl             # the first CPU calls start_kernel
10892 -       je   1f
10893 -       movl (stack_start), %esp
10894 -1:
10895  #endif /* CONFIG_SMP */
10896         jmp *(initial_code)
10897
10898 @@ -550,22 +620,22 @@ early_page_fault:
10899         jmp early_fault
10900
10901  early_fault:
10902 -       cld
10903  #ifdef CONFIG_PRINTK
10904 +       cmpl $1,%ss:early_recursion_flag
10905 +       je hlt_loop
10906 +       incl %ss:early_recursion_flag
10907 +       cld
10908         pusha
10909         movl $(__KERNEL_DS),%eax
10910         movl %eax,%ds
10911         movl %eax,%es
10912 -       cmpl $2,early_recursion_flag
10913 -       je hlt_loop
10914 -       incl early_recursion_flag
10915         movl %cr2,%eax
10916         pushl %eax
10917         pushl %edx              /* trapno */
10918         pushl $fault_msg
10919         call printk
10920 +;      call dump_stack
10921  #endif
10922 -       call dump_stack
10923  hlt_loop:
10924         hlt
10925         jmp hlt_loop
10926 @@ -573,8 +643,11 @@ hlt_loop:
10927  /* This is the default interrupt "handler" :-) */
10928         ALIGN
10929  ignore_int:
10930 -       cld
10931  #ifdef CONFIG_PRINTK
10932 +       cmpl $2,%ss:early_recursion_flag
10933 +       je hlt_loop
10934 +       incl %ss:early_recursion_flag
10935 +       cld
10936         pushl %eax
10937         pushl %ecx
10938         pushl %edx
10939 @@ -583,9 +656,6 @@ ignore_int:
10940         movl $(__KERNEL_DS),%eax
10941         movl %eax,%ds
10942         movl %eax,%es
10943 -       cmpl $2,early_recursion_flag
10944 -       je hlt_loop
10945 -       incl early_recursion_flag
10946         pushl 16(%esp)
10947         pushl 24(%esp)
10948         pushl 32(%esp)
10949 @@ -612,27 +682,37 @@ ENTRY(initial_code)
10950  /*
10951   * BSS section
10952   */
10953 -__PAGE_ALIGNED_BSS
10954 -       .align PAGE_SIZE_asm
10955  #ifdef CONFIG_X86_PAE
10956 +.section .swapper_pg_pmd,"a",@progbits
10957  swapper_pg_pmd:
10958         .fill 1024*KPMDS,4,0
10959  #else
10960 +.section .swapper_pg_dir,"a",@progbits
10961  ENTRY(swapper_pg_dir)
10962         .fill 1024,4,0
10963  #endif
10964 +
10965  swapper_pg_fixmap:
10966         .fill 1024,4,0
10967 +
10968 +.section .empty_zero_page,"a",@progbits
10969  ENTRY(empty_zero_page)
10970         .fill 4096,1,0
10971
10972  /*
10973 + * The IDT has to be page-aligned to simplify the Pentium
10974 + * F0 0F bug workaround.. We have a special link segment
10975 + * for this.
10976 + */
10977 +.section .idt,"a",@progbits
10978 +ENTRY(idt_table)
10979 +       .fill 256,8,0
10980 +
10981 +/*
10982   * This starts the data section.
10983   */
10984  #ifdef CONFIG_X86_PAE
10985 -__PAGE_ALIGNED_DATA
10986 -       /* Page-aligned for the benefit of paravirt? */
10987 -       .align PAGE_SIZE_asm
10988 +.section .swapper_pg_dir,"a",@progbits
10989  ENTRY(swapper_pg_dir)
10990         .long   pa(swapper_pg_pmd+PGD_IDENT_ATTR),0     /* low identity map */
10991  # if KPMDS == 3
10992 @@ -655,11 +735,12 @@ ENTRY(swapper_pg_dir)
10993
10994  .data
10995  ENTRY(stack_start)
10996 -       .long init_thread_union+THREAD_SIZE
10997 +       .long init_thread_union+THREAD_SIZE-8
10998         .long __BOOT_DS
10999
11000  ready: .byte 0
11001
11002 +.section .rodata,"a",@progbits
11003  early_recursion_flag:
11004         .long 0
11005
11006 @@ -695,7 +776,7 @@ fault_msg:
11007         .word 0                         # 32 bit align gdt_desc.address
11008  boot_gdt_descr:
11009         .word __BOOT_DS+7
11010 -       .long boot_gdt - __PAGE_OFFSET
11011 +       .long pa(boot_gdt)
11012
11013         .word 0                         # 32-bit align idt_desc.address
11014  idt_descr:
11015 @@ -706,7 +787,7 @@ idt_descr:
11016         .word 0                         # 32 bit align gdt_desc.address
11017  ENTRY(early_gdt_descr)
11018         .word GDT_ENTRIES*8-1
11019 -       .long per_cpu__gdt_page         /* Overwritten for secondary CPUs */
11020 +       .long cpu_gdt_table             /* Overwritten for secondary CPUs */
11021
11022  /*
11023   * The boot_gdt must mirror the equivalent in setup.S and is
11024 @@ -715,5 +796,65 @@ ENTRY(early_gdt_descr)
11025         .align L1_CACHE_BYTES
11026  ENTRY(boot_gdt)
11027         .fill GDT_ENTRY_BOOT_CS,8,0
11028 -       .quad 0x00cf9a000000ffff        /* kernel 4GB code at 0x00000000 */
11029 -       .quad 0x00cf92000000ffff        /* kernel 4GB data at 0x00000000 */
11030 +       .quad 0x00cf9b000000ffff        /* kernel 4GB code at 0x00000000 */
11031 +       .quad 0x00cf93000000ffff        /* kernel 4GB data at 0x00000000 */
11032 +
11033 +       .align PAGE_SIZE_asm
11034 +ENTRY(cpu_gdt_table)
11035 +       .rept NR_CPUS
11036 +       .quad 0x0000000000000000        /* NULL descriptor */
11037 +       .quad 0x0000000000000000        /* 0x0b reserved */
11038 +       .quad 0x0000000000000000        /* 0x13 reserved */
11039 +       .quad 0x0000000000000000        /* 0x1b reserved */
11040 +
11041 +#ifdef CONFIG_PAX_KERNEXEC
11042 +       .quad 0x00cf9b000000ffff        /* 0x20 alternate kernel 4GB code at 0x00000000 */
11043 +#else
11044 +       .quad 0x0000000000000000        /* 0x20 unused */
11045 +#endif
11046 +
11047 +       .quad 0x0000000000000000        /* 0x28 unused */
11048 +       .quad 0x0000000000000000        /* 0x33 TLS entry 1 */
11049 +       .quad 0x0000000000000000        /* 0x3b TLS entry 2 */
11050 +       .quad 0x0000000000000000        /* 0x43 TLS entry 3 */
11051 +       .quad 0x0000000000000000        /* 0x4b reserved */
11052 +       .quad 0x0000000000000000        /* 0x53 reserved */
11053 +       .quad 0x0000000000000000        /* 0x5b reserved */
11054 +
11055 +       .quad 0x00cf9b000000ffff        /* 0x60 kernel 4GB code at 0x00000000 */
11056 +       .quad 0x00cf93000000ffff        /* 0x68 kernel 4GB data at 0x00000000 */
11057 +       .quad 0x00cffb000000ffff        /* 0x73 user 4GB code at 0x00000000 */
11058 +       .quad 0x00cff3000000ffff        /* 0x7b user 4GB data at 0x00000000 */
11059 +
11060 +       .quad 0x0000000000000000        /* 0x80 TSS descriptor */
11061 +       .quad 0x0000000000000000        /* 0x88 LDT descriptor */
11062 +
11063 +       /*
11064 +        * Segments used for calling PnP BIOS have byte granularity.
11065 +        * The code segments and data segments have fixed 64k limits,
11066 +        * the transfer segment sizes are set at run time.
11067 +        */
11068 +       .quad 0x00409b000000ffff        /* 0x90 32-bit code */
11069 +       .quad 0x00009b000000ffff        /* 0x98 16-bit code */
11070 +       .quad 0x000093000000ffff        /* 0xa0 16-bit data */
11071 +       .quad 0x0000930000000000        /* 0xa8 16-bit data */
11072 +       .quad 0x0000930000000000        /* 0xb0 16-bit data */
11073 +
11074 +       /*
11075 +        * The APM segments have byte granularity and their bases
11076 +        * are set at run time.  All have 64k limits.
11077 +        */
11078 +       .quad 0x00409b000000ffff        /* 0xb8 APM CS    code */
11079 +       .quad 0x00009b000000ffff        /* 0xc0 APM CS 16 code (16 bit) */
11080 +       .quad 0x004093000000ffff        /* 0xc8 APM DS    data */
11081 +
11082 +       .quad 0x00c0930000000000        /* 0xd0 - ESPFIX SS */
11083 +       .quad 0x0040930000000000        /* 0xd8 - PERCPU */
11084 +       .quad 0x0040930000000018        /* 0xe0 - STACK_CANARY */
11085 +       .quad 0x0000000000000000        /* 0xe8 - PCIBIOS_CS */
11086 +       .quad 0x0000000000000000        /* 0xf0 - PCIBIOS_DS */
11087 +       .quad 0x0000000000000000        /* 0xf8 - GDT entry 31: double-fault TSS */
11088 +
11089 +       /* Be sure this is zeroed to avoid false validations in Xen */
11090 +       .fill PAGE_SIZE_asm - GDT_SIZE,1,0
11091 +       .endr
11092 diff -urNp linux-2.6.33/arch/x86/kernel/head_64.S linux-2.6.33/arch/x86/kernel/head_64.S
11093 --- linux-2.6.33/arch/x86/kernel/head_64.S      2010-02-24 13:52:17.000000000 -0500
11094 +++ linux-2.6.33/arch/x86/kernel/head_64.S      2010-03-07 16:45:32.258187459 -0500
11095 @@ -38,6 +38,10 @@ L4_PAGE_OFFSET = pgd_index(__PAGE_OFFSET
11096  L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
11097  L4_START_KERNEL = pgd_index(__START_KERNEL_map)
11098  L3_START_KERNEL = pud_index(__START_KERNEL_map)
11099 +L4_VMALLOC_START = pgd_index(VMALLOC_START)
11100 +L3_VMALLOC_START = pud_index(VMALLOC_START)
11101 +L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
11102 +L3_VMEMMAP_START = pud_index(VMEMMAP_START)
11103
11104         .text
11105         __HEAD
11106 @@ -85,35 +89,22 @@ startup_64:
11107          */
11108         addq    %rbp, init_level4_pgt + 0(%rip)
11109         addq    %rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
11110 +       addq    %rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
11111 +       addq    %rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
11112         addq    %rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
11113
11114         addq    %rbp, level3_ident_pgt + 0(%rip)
11115 +#ifndef CONFIG_XEN
11116 +       addq    %rbp, level3_ident_pgt + 8(%rip)
11117 +#endif
11118
11119 -       addq    %rbp, level3_kernel_pgt + (510*8)(%rip)
11120 -       addq    %rbp, level3_kernel_pgt + (511*8)(%rip)
11121 +       addq    %rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
11122
11123 -       addq    %rbp, level2_fixmap_pgt + (506*8)(%rip)
11124 +       addq    %rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
11125 +       addq    %rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
11126
11127 -       /* Add an Identity mapping if I am above 1G */
11128 -       leaq    _text(%rip), %rdi
11129 -       andq    $PMD_PAGE_MASK, %rdi
11130 -
11131 -       movq    %rdi, %rax
11132 -       shrq    $PUD_SHIFT, %rax
11133 -       andq    $(PTRS_PER_PUD - 1), %rax
11134 -       jz      ident_complete
11135 -
11136 -       leaq    (level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
11137 -       leaq    level3_ident_pgt(%rip), %rbx
11138 -       movq    %rdx, 0(%rbx, %rax, 8)
11139 -
11140 -       movq    %rdi, %rax
11141 -       shrq    $PMD_SHIFT, %rax
11142 -       andq    $(PTRS_PER_PMD - 1), %rax
11143 -       leaq    __PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
11144 -       leaq    level2_spare_pgt(%rip), %rbx
11145 -       movq    %rdx, 0(%rbx, %rax, 8)
11146 -ident_complete:
11147 +       addq    %rbp, level2_fixmap_pgt + (506*8)(%rip)
11148 +       addq    %rbp, level2_fixmap_pgt + (507*8)(%rip)
11149
11150         /*
11151          * Fixup the kernel text+data virtual addresses. Note that
11152 @@ -187,6 +178,11 @@ ENTRY(secondary_startup_64)
11153         btl     $20,%edi                /* No Execute supported? */
11154         jnc     1f
11155         btsl    $_EFER_NX, %eax
11156 +       leaq    init_level4_pgt(%rip), %rdi
11157 +       btsq    $_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
11158 +       btsq    $_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
11159 +       btsq    $_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
11160 +       btsq    $_PAGE_BIT_NX, (__supported_pte_mask)
11161  1:     wrmsr                           /* Make changes effective */
11162
11163         /* Setup cr0 */
11164 @@ -271,7 +267,7 @@ ENTRY(secondary_startup_64)
11165  bad_address:
11166         jmp bad_address
11167
11168 -       .section ".init.text","ax"
11169 +       __INIT
11170  #ifdef CONFIG_EARLY_PRINTK
11171         .globl early_idt_handlers
11172  early_idt_handlers:
11173 @@ -316,18 +312,23 @@ ENTRY(early_idt_handler)
11174  #endif /* EARLY_PRINTK */
11175  1:     hlt
11176         jmp 1b
11177 +       .previous
11178
11179  #ifdef CONFIG_EARLY_PRINTK
11180 +       __INITDATA
11181  early_recursion_flag:
11182         .long 0
11183 +       .previous
11184
11185 +       .section .rodata,"a",@progbits
11186  early_idt_msg:
11187         .asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
11188  early_idt_ripmsg:
11189         .asciz "RIP %s\n"
11190 -#endif /* CONFIG_EARLY_PRINTK */
11191         .previous
11192 +#endif /* CONFIG_EARLY_PRINTK */
11193
11194 +       .section .rodata,"a",@progbits
11195  #define NEXT_PAGE(name) \
11196         .balign PAGE_SIZE; \
11197  ENTRY(name)
11198 @@ -351,13 +352,29 @@ NEXT_PAGE(init_level4_pgt)
11199         .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
11200         .org    init_level4_pgt + L4_PAGE_OFFSET*8, 0
11201         .quad   level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
11202 +       .org    init_level4_pgt + L4_VMALLOC_START*8, 0
11203 +       .quad   level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
11204 +       .org    init_level4_pgt + L4_VMEMMAP_START*8, 0
11205 +       .quad   level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
11206         .org    init_level4_pgt + L4_START_KERNEL*8, 0
11207         /* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
11208         .quad   level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
11209
11210  NEXT_PAGE(level3_ident_pgt)
11211         .quad   level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
11212 +#ifdef CONFIG_XEN
11213         .fill   511,8,0
11214 +#else
11215 +       .quad   level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
11216 +       .fill   510,8,0
11217 +#endif
11218 +
11219 +NEXT_PAGE(level3_vmalloc_pgt)
11220 +       .fill   512,8,0
11221 +
11222 +NEXT_PAGE(level3_vmemmap_pgt)
11223 +       .fill   L3_VMEMMAP_START,8,0
11224 +       .quad   level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
11225
11226  NEXT_PAGE(level3_kernel_pgt)
11227         .fill   L3_START_KERNEL,8,0
11228 @@ -365,20 +382,23 @@ NEXT_PAGE(level3_kernel_pgt)
11229         .quad   level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
11230         .quad   level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
11231
11232 +NEXT_PAGE(level2_vmemmap_pgt)
11233 +       .fill   512,8,0
11234 +
11235  NEXT_PAGE(level2_fixmap_pgt)
11236 -       .fill   506,8,0
11237 -       .quad   level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
11238 -       /* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
11239 -       .fill   5,8,0
11240 +       .fill   507,8,0
11241 +       .quad   level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
11242 +       /* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
11243 +       .fill   4,8,0
11244
11245 -NEXT_PAGE(level1_fixmap_pgt)
11246 +NEXT_PAGE(level1_vsyscall_pgt)
11247         .fill   512,8,0
11248
11249 -NEXT_PAGE(level2_ident_pgt)
11250 -       /* Since I easily can, map the first 1G.
11251 +       /* Since I easily can, map the first 2G.
11252          * Don't set NX because code runs from these pages.
11253          */
11254 -       PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
11255 +NEXT_PAGE(level2_ident_pgt)
11256 +       PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
11257
11258  NEXT_PAGE(level2_kernel_pgt)
11259         /*
11260 @@ -391,33 +411,55 @@ NEXT_PAGE(level2_kernel_pgt)
11261          *  If you want to increase this then increase MODULES_VADDR
11262          *  too.)
11263          */
11264 -       PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
11265 -               KERNEL_IMAGE_SIZE/PMD_SIZE)
11266 -
11267 -NEXT_PAGE(level2_spare_pgt)
11268 -       .fill   512, 8, 0
11269 +       PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
11270
11271  #undef PMDS
11272  #undef NEXT_PAGE
11273
11274 -       .data
11275 +       .align PAGE_SIZE
11276 +ENTRY(cpu_gdt_table)
11277 +       .rept NR_CPUS
11278 +       .quad   0x0000000000000000      /* NULL descriptor */
11279 +       .quad   0x00cf9b000000ffff      /* __KERNEL32_CS */
11280 +       .quad   0x00af9b000000ffff      /* __KERNEL_CS */
11281 +       .quad   0x00cf93000000ffff      /* __KERNEL_DS */
11282 +       .quad   0x00cffb000000ffff      /* __USER32_CS */
11283 +       .quad   0x00cff3000000ffff      /* __USER_DS, __USER32_DS  */
11284 +       .quad   0x00affb000000ffff      /* __USER_CS */
11285 +
11286 +#ifdef CONFIG_PAX_KERNEXEC
11287 +       .quad   0x00af9b000000ffff      /* __KERNEXEC_KERNEL_CS */
11288 +#else
11289 +       .quad   0x0                     /* unused */
11290 +#endif
11291 +
11292 +       .quad   0,0                     /* TSS */
11293 +       .quad   0,0                     /* LDT */
11294 +       .quad   0,0,0                   /* three TLS descriptors */
11295 +       .quad   0x0000f40000000000      /* node/CPU stored in limit */
11296 +       /* asm/segment.h:GDT_ENTRIES must match this */
11297 +
11298 +       /* zero the remaining page */
11299 +       .fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
11300 +       .endr
11301 +
11302         .align 16
11303         .globl early_gdt_descr
11304  early_gdt_descr:
11305         .word   GDT_ENTRIES*8-1
11306  early_gdt_descr_base:
11307 -       .quad   INIT_PER_CPU_VAR(gdt_page)
11308 +       .quad   cpu_gdt_table
11309
11310  ENTRY(phys_base)
11311         /* This must match the first entry in level2_kernel_pgt */
11312         .quad   0x0000000000000000
11313
11314  #include "../../x86/xen/xen-head.S"
11315 -
11316 -       .section .bss, "aw", @nobits
11317 +
11318 +       .section .rodata,"a",@progbits
11319         .align L1_CACHE_BYTES
11320  ENTRY(idt_table)
11321 -       .skip IDT_ENTRIES * 16
11322 +       .fill 512,8,0
11323
11324         __PAGE_ALIGNED_BSS
11325         .align PAGE_SIZE
11326 diff -urNp linux-2.6.33/arch/x86/kernel/i386_ksyms_32.c linux-2.6.33/arch/x86/kernel/i386_ksyms_32.c
11327 --- linux-2.6.33/arch/x86/kernel/i386_ksyms_32.c        2010-02-24 13:52:17.000000000 -0500
11328 +++ linux-2.6.33/arch/x86/kernel/i386_ksyms_32.c        2010-03-07 12:23:35.937701195 -0500
11329 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
11330  EXPORT_SYMBOL(cmpxchg8b_emu);
11331  #endif
11332
11333 +EXPORT_SYMBOL_GPL(cpu_gdt_table);
11334 +
11335  /* Networking helper routines. */
11336  EXPORT_SYMBOL(csum_partial_copy_generic);
11337 +EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
11338 +EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
11339
11340  EXPORT_SYMBOL(__get_user_1);
11341  EXPORT_SYMBOL(__get_user_2);
11342 @@ -36,3 +40,7 @@ EXPORT_SYMBOL(strstr);
11343
11344  EXPORT_SYMBOL(csum_partial);
11345  EXPORT_SYMBOL(empty_zero_page);
11346 +
11347 +#ifdef CONFIG_PAX_KERNEXEC
11348 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
11349 +#endif
11350 diff -urNp linux-2.6.33/arch/x86/kernel/init_task.c linux-2.6.33/arch/x86/kernel/init_task.c
11351 --- linux-2.6.33/arch/x86/kernel/init_task.c    2010-02-24 13:52:17.000000000 -0500
11352 +++ linux-2.6.33/arch/x86/kernel/init_task.c    2010-03-07 12:23:35.937701195 -0500
11353 @@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
11354   * section. Since TSS's are completely CPU-local, we want them
11355   * on exact cacheline boundaries, to eliminate cacheline ping-pong.
11356   */
11357 -DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
11358 -
11359 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
11360 +EXPORT_SYMBOL(init_tss);
11361 diff -urNp linux-2.6.33/arch/x86/kernel/ioport.c linux-2.6.33/arch/x86/kernel/ioport.c
11362 --- linux-2.6.33/arch/x86/kernel/ioport.c       2010-02-24 13:52:17.000000000 -0500
11363 +++ linux-2.6.33/arch/x86/kernel/ioport.c       2010-03-07 12:23:35.937701195 -0500
11364 @@ -6,6 +6,7 @@
11365  #include <linux/sched.h>
11366  #include <linux/kernel.h>
11367  #include <linux/capability.h>
11368 +#include <linux/security.h>
11369  #include <linux/errno.h>
11370  #include <linux/types.h>
11371  #include <linux/ioport.h>
11372 @@ -41,6 +42,12 @@ asmlinkage long sys_ioperm(unsigned long
11373
11374         if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
11375                 return -EINVAL;
11376 +#ifdef CONFIG_GRKERNSEC_IO
11377 +       if (turn_on) {
11378 +               gr_handle_ioperm();
11379 +               return -EPERM;
11380 +       }
11381 +#endif
11382         if (turn_on && !capable(CAP_SYS_RAWIO))
11383                 return -EPERM;
11384
11385 @@ -67,7 +74,7 @@ asmlinkage long sys_ioperm(unsigned long
11386          * because the ->io_bitmap_max value must match the bitmap
11387          * contents:
11388          */
11389 -       tss = &per_cpu(init_tss, get_cpu());
11390 +       tss = init_tss + get_cpu();
11391
11392         set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
11393
11394 @@ -112,8 +119,13 @@ long sys_iopl(unsigned int level, struct
11395                 return -EINVAL;
11396         /* Trying to gain more privileges? */
11397         if (level > old) {
11398 +#ifdef CONFIG_GRKERNSEC_IO
11399 +               gr_handle_iopl();
11400 +               return -EPERM;
11401 +#else
11402                 if (!capable(CAP_SYS_RAWIO))
11403                         return -EPERM;
11404 +#endif
11405         }
11406         regs->flags = (regs->flags & ~X86_EFLAGS_IOPL) | (level << 12);
11407         t->iopl = level << 12;
11408 diff -urNp linux-2.6.33/arch/x86/kernel/irq_32.c linux-2.6.33/arch/x86/kernel/irq_32.c
11409 --- linux-2.6.33/arch/x86/kernel/irq_32.c       2010-02-24 13:52:17.000000000 -0500
11410 +++ linux-2.6.33/arch/x86/kernel/irq_32.c       2010-03-07 12:23:35.937701195 -0500
11411 @@ -94,7 +94,7 @@ execute_on_irq_stack(int overflow, struc
11412                 return 0;
11413
11414         /* build the stack frame on the IRQ stack */
11415 -       isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
11416 +       isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
11417         irqctx->tinfo.task = curctx->tinfo.task;
11418         irqctx->tinfo.previous_esp = current_stack_pointer;
11419
11420 @@ -175,7 +175,7 @@ asmlinkage void do_softirq(void)
11421                 irqctx->tinfo.previous_esp = current_stack_pointer;
11422
11423                 /* build the stack frame on the softirq stack */
11424 -               isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
11425 +               isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
11426
11427                 call_on_stack(__do_softirq, isp);
11428                 /*
11429 diff -urNp linux-2.6.33/arch/x86/kernel/kgdb.c linux-2.6.33/arch/x86/kernel/kgdb.c
11430 --- linux-2.6.33/arch/x86/kernel/kgdb.c 2010-02-24 13:52:17.000000000 -0500
11431 +++ linux-2.6.33/arch/x86/kernel/kgdb.c 2010-03-07 12:23:35.937701195 -0500
11432 @@ -89,7 +89,7 @@ void pt_regs_to_gdb_regs(unsigned long *
11433         gdb_regs[GDB_CS]        = regs->cs;
11434         gdb_regs[GDB_FS]        = 0xFFFF;
11435         gdb_regs[GDB_GS]        = 0xFFFF;
11436 -       if (user_mode_vm(regs)) {
11437 +       if (user_mode(regs)) {
11438                 gdb_regs[GDB_SS] = regs->ss;
11439                 gdb_regs[GDB_SP] = regs->sp;
11440         } else {
11441 @@ -690,7 +690,7 @@ unsigned long kgdb_arch_pc(int exception
11442         return instruction_pointer(regs);
11443  }
11444
11445 -struct kgdb_arch arch_kgdb_ops = {
11446 +const struct kgdb_arch arch_kgdb_ops = {
11447         /* Breakpoint instruction: */
11448         .gdb_bpt_instr          = { 0xcc },
11449         .flags                  = KGDB_HW_BREAKPOINT,
11450 diff -urNp linux-2.6.33/arch/x86/kernel/kprobes.c linux-2.6.33/arch/x86/kernel/kprobes.c
11451 --- linux-2.6.33/arch/x86/kernel/kprobes.c      2010-02-24 13:52:17.000000000 -0500
11452 +++ linux-2.6.33/arch/x86/kernel/kprobes.c      2010-03-07 12:23:35.937701195 -0500
11453 @@ -113,9 +113,13 @@ static void __kprobes set_jmp_op(void *f
11454                 char op;
11455                 s32 raddr;
11456         } __attribute__((packed)) * jop;
11457 -       jop = (struct __arch_jmp_op *)from;
11458 +
11459 +       jop = (struct __arch_jmp_op *)(ktla_ktva(from));
11460 +
11461 +       pax_open_kernel();
11462         jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
11463         jop->op = RELATIVEJUMP_INSTRUCTION;
11464 +       pax_close_kernel();
11465  }
11466
11467  /*
11468 @@ -323,16 +327,18 @@ static void __kprobes fix_riprel(struct
11469
11470  static void __kprobes arch_copy_kprobe(struct kprobe *p)
11471  {
11472 -       memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
11473 +       pax_open_kernel();
11474 +       memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
11475 +       pax_close_kernel();
11476
11477         fix_riprel(p);
11478
11479 -       if (can_boost(p->addr))
11480 +       if (can_boost(ktla_ktva(p->addr)))
11481                 p->ainsn.boostable = 0;
11482         else
11483                 p->ainsn.boostable = -1;
11484
11485 -       p->opcode = *p->addr;
11486 +       p->opcode = *(ktla_ktva(p->addr));
11487  }
11488
11489  int __kprobes arch_prepare_kprobe(struct kprobe *p)
11490 @@ -412,7 +418,7 @@ static void __kprobes prepare_singlestep
11491         if (p->opcode == BREAKPOINT_INSTRUCTION)
11492                 regs->ip = (unsigned long)p->addr;
11493         else
11494 -               regs->ip = (unsigned long)p->ainsn.insn;
11495 +               regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
11496  }
11497
11498  void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
11499 @@ -433,7 +439,7 @@ static void __kprobes setup_singlestep(s
11500         if (p->ainsn.boostable == 1 && !p->post_handler) {
11501                 /* Boost up -- we can execute copied instructions directly */
11502                 reset_current_kprobe();
11503 -               regs->ip = (unsigned long)p->ainsn.insn;
11504 +               regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
11505                 preempt_enable_no_resched();
11506                 return;
11507         }
11508 @@ -490,7 +496,7 @@ static int __kprobes kprobe_handler(stru
11509         struct kprobe_ctlblk *kcb;
11510
11511         addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
11512 -       if (*addr != BREAKPOINT_INSTRUCTION) {
11513 +       if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
11514                 /*
11515                  * The breakpoint instruction was removed right
11516                  * after we hit it.  Another cpu has removed
11517 @@ -742,7 +748,7 @@ static void __kprobes resume_execution(s
11518                 struct pt_regs *regs, struct kprobe_ctlblk *kcb)
11519  {
11520         unsigned long *tos = stack_addr(regs);
11521 -       unsigned long copy_ip = (unsigned long)p->ainsn.insn;
11522 +       unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
11523         unsigned long orig_ip = (unsigned long)p->addr;
11524         kprobe_opcode_t *insn = p->ainsn.insn;
11525
11526 @@ -925,7 +931,7 @@ int __kprobes kprobe_exceptions_notify(s
11527         struct die_args *args = data;
11528         int ret = NOTIFY_DONE;
11529
11530 -       if (args->regs && user_mode_vm(args->regs))
11531 +       if (args->regs && user_mode(args->regs))
11532                 return ret;
11533
11534         switch (val) {
11535 diff -urNp linux-2.6.33/arch/x86/kernel/ldt.c linux-2.6.33/arch/x86/kernel/ldt.c
11536 --- linux-2.6.33/arch/x86/kernel/ldt.c  2010-02-24 13:52:17.000000000 -0500
11537 +++ linux-2.6.33/arch/x86/kernel/ldt.c  2010-03-07 12:23:35.937701195 -0500
11538 @@ -66,13 +66,13 @@ static int alloc_ldt(mm_context_t *pc, i
11539         if (reload) {
11540  #ifdef CONFIG_SMP
11541                 preempt_disable();
11542 -               load_LDT(pc);
11543 +               load_LDT_nolock(pc);
11544                 if (!cpumask_equal(mm_cpumask(current->mm),
11545                                    cpumask_of(smp_processor_id())))
11546                         smp_call_function(flush_ldt, current->mm, 1);
11547                 preempt_enable();
11548  #else
11549 -               load_LDT(pc);
11550 +               load_LDT_nolock(pc);
11551  #endif
11552         }
11553         if (oldsize) {
11554 @@ -94,7 +94,7 @@ static inline int copy_ldt(mm_context_t
11555                 return err;
11556
11557         for (i = 0; i < old->size; i++)
11558 -               write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
11559 +               write_ldt_entry(new->ldt, i, old->ldt + i);
11560         return 0;
11561  }
11562
11563 @@ -115,6 +115,24 @@ int init_new_context(struct task_struct
11564                 retval = copy_ldt(&mm->context, &old_mm->context);
11565                 mutex_unlock(&old_mm->context.lock);
11566         }
11567 +
11568 +       if (tsk == current) {
11569 +               mm->context.vdso = ~0UL;
11570 +
11571 +#ifdef CONFIG_X86_32
11572 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
11573 +               mm->context.user_cs_base = 0UL;
11574 +               mm->context.user_cs_limit = ~0UL;
11575 +
11576 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
11577 +               cpus_clear(mm->context.cpu_user_cs_mask);
11578 +#endif
11579 +
11580 +#endif
11581 +#endif
11582 +
11583 +       }
11584 +
11585         return retval;
11586  }
11587
11588 @@ -229,6 +247,13 @@ static int write_ldt(void __user *ptr, u
11589                 }
11590         }
11591
11592 +#ifdef CONFIG_PAX_SEGMEXEC
11593 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
11594 +               error = -EINVAL;
11595 +               goto out_unlock;
11596 +       }
11597 +#endif
11598 +
11599         fill_ldt(&ldt, &ldt_info);
11600         if (oldmode)
11601                 ldt.avl = 0;
11602 diff -urNp linux-2.6.33/arch/x86/kernel/machine_kexec_32.c linux-2.6.33/arch/x86/kernel/machine_kexec_32.c
11603 --- linux-2.6.33/arch/x86/kernel/machine_kexec_32.c     2010-02-24 13:52:17.000000000 -0500
11604 +++ linux-2.6.33/arch/x86/kernel/machine_kexec_32.c     2010-03-07 12:23:35.937701195 -0500
11605 @@ -27,7 +27,7 @@
11606  #include <asm/cacheflush.h>
11607  #include <asm/debugreg.h>
11608
11609 -static void set_idt(void *newidt, __u16 limit)
11610 +static void set_idt(struct desc_struct *newidt, __u16 limit)
11611  {
11612         struct desc_ptr curidt;
11613
11614 @@ -39,7 +39,7 @@ static void set_idt(void *newidt, __u16
11615  }
11616
11617
11618 -static void set_gdt(void *newgdt, __u16 limit)
11619 +static void set_gdt(struct desc_struct *newgdt, __u16 limit)
11620  {
11621         struct desc_ptr curgdt;
11622
11623 @@ -217,7 +217,7 @@ void machine_kexec(struct kimage *image)
11624         }
11625
11626         control_page = page_address(image->control_code_page);
11627 -       memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
11628 +       memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
11629
11630         relocate_kernel_ptr = control_page;
11631         page_list[PA_CONTROL_PAGE] = __pa(control_page);
11632 diff -urNp linux-2.6.33/arch/x86/kernel/microcode_amd.c linux-2.6.33/arch/x86/kernel/microcode_amd.c
11633 --- linux-2.6.33/arch/x86/kernel/microcode_amd.c        2010-02-24 13:52:17.000000000 -0500
11634 +++ linux-2.6.33/arch/x86/kernel/microcode_amd.c        2010-03-07 12:23:35.937701195 -0500
11635 @@ -331,7 +331,7 @@ static void microcode_fini_cpu_amd(int c
11636         uci->mc = NULL;
11637  }
11638
11639 -static struct microcode_ops microcode_amd_ops = {
11640 +static const struct microcode_ops microcode_amd_ops = {
11641         .request_microcode_user           = request_microcode_user,
11642         .request_microcode_fw             = request_microcode_fw,
11643         .collect_cpu_info                 = collect_cpu_info_amd,
11644 @@ -339,7 +339,7 @@ static struct microcode_ops microcode_am
11645         .microcode_fini_cpu               = microcode_fini_cpu_amd,
11646  };
11647
11648 -struct microcode_ops * __init init_amd_microcode(void)
11649 +const struct microcode_ops * __init init_amd_microcode(void)
11650  {
11651         return &microcode_amd_ops;
11652  }
11653 diff -urNp linux-2.6.33/arch/x86/kernel/microcode_core.c linux-2.6.33/arch/x86/kernel/microcode_core.c
11654 --- linux-2.6.33/arch/x86/kernel/microcode_core.c       2010-02-24 13:52:17.000000000 -0500
11655 +++ linux-2.6.33/arch/x86/kernel/microcode_core.c       2010-03-07 12:23:35.937701195 -0500
11656 @@ -92,7 +92,7 @@ MODULE_LICENSE("GPL");
11657
11658  #define MICROCODE_VERSION      "2.00"
11659
11660 -static struct microcode_ops    *microcode_ops;
11661 +static const struct microcode_ops      *microcode_ops;
11662
11663  /*
11664   * Synchronization.
11665 diff -urNp linux-2.6.33/arch/x86/kernel/microcode_intel.c linux-2.6.33/arch/x86/kernel/microcode_intel.c
11666 --- linux-2.6.33/arch/x86/kernel/microcode_intel.c      2010-02-24 13:52:17.000000000 -0500
11667 +++ linux-2.6.33/arch/x86/kernel/microcode_intel.c      2010-03-07 12:23:35.937701195 -0500
11668 @@ -436,13 +436,13 @@ static enum ucode_state request_microcod
11669
11670  static int get_ucode_user(void *to, const void *from, size_t n)
11671  {
11672 -       return copy_from_user(to, from, n);
11673 +       return copy_from_user(to, (__force const void __user *)from, n);
11674  }
11675
11676  static enum ucode_state
11677  request_microcode_user(int cpu, const void __user *buf, size_t size)
11678  {
11679 -       return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
11680 +       return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
11681  }
11682
11683  static void microcode_fini_cpu(int cpu)
11684 @@ -453,7 +453,7 @@ static void microcode_fini_cpu(int cpu)
11685         uci->mc = NULL;
11686  }
11687
11688 -static struct microcode_ops microcode_intel_ops = {
11689 +static const struct microcode_ops microcode_intel_ops = {
11690         .request_microcode_user           = request_microcode_user,
11691         .request_microcode_fw             = request_microcode_fw,
11692         .collect_cpu_info                 = collect_cpu_info,
11693 @@ -461,7 +461,7 @@ static struct microcode_ops microcode_in
11694         .microcode_fini_cpu               = microcode_fini_cpu,
11695  };
11696
11697 -struct microcode_ops * __init init_intel_microcode(void)
11698 +const struct microcode_ops * __init init_intel_microcode(void)
11699  {
11700         return &microcode_intel_ops;
11701  }
11702 diff -urNp linux-2.6.33/arch/x86/kernel/module.c linux-2.6.33/arch/x86/kernel/module.c
11703 --- linux-2.6.33/arch/x86/kernel/module.c       2010-02-24 13:52:17.000000000 -0500
11704 +++ linux-2.6.33/arch/x86/kernel/module.c       2010-03-07 12:23:35.941628368 -0500
11705 @@ -34,7 +34,7 @@
11706  #define DEBUGP(fmt...)
11707  #endif
11708
11709 -void *module_alloc(unsigned long size)
11710 +static void *__module_alloc(unsigned long size, pgprot_t prot)
11711  {
11712         struct vm_struct *area;
11713
11714 @@ -48,8 +48,18 @@ void *module_alloc(unsigned long size)
11715         if (!area)
11716                 return NULL;
11717
11718 -       return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
11719 -                                       PAGE_KERNEL_EXEC);
11720 +       return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
11721 +}
11722 +
11723 +void *module_alloc(unsigned long size)
11724 +{
11725 +
11726 +#ifdef CONFIG_PAX_KERNEXEC
11727 +       return __module_alloc(size, PAGE_KERNEL);
11728 +#else
11729 +       return __module_alloc(size, PAGE_KERNEL_EXEC);
11730 +#endif
11731 +
11732  }
11733
11734  /* Free memory returned from module_alloc */
11735 @@ -58,6 +68,40 @@ void module_free(struct module *mod, voi
11736         vfree(module_region);
11737  }
11738
11739 +#ifdef CONFIG_PAX_KERNEXEC
11740 +#ifdef CONFIG_X86_32
11741 +void *module_alloc_exec(unsigned long size)
11742 +{
11743 +       struct vm_struct *area;
11744 +
11745 +       if (size == 0)
11746 +               return NULL;
11747 +
11748 +       area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
11749 +       return area ? area->addr : NULL;
11750 +}
11751 +EXPORT_SYMBOL(module_alloc_exec);
11752 +
11753 +void module_free_exec(struct module *mod, void *module_region)
11754 +{
11755 +       vunmap(module_region);
11756 +}
11757 +EXPORT_SYMBOL(module_free_exec);
11758 +#else
11759 +void module_free_exec(struct module *mod, void *module_region)
11760 +{
11761 +       module_free(mod, module_region);
11762 +}
11763 +EXPORT_SYMBOL(module_free_exec);
11764 +
11765 +void *module_alloc_exec(unsigned long size)
11766 +{
11767 +       return __module_alloc(size, PAGE_KERNEL_RX);
11768 +}
11769 +EXPORT_SYMBOL(module_alloc_exec);
11770 +#endif
11771 +#endif
11772 +
11773  /* We don't need anything special. */
11774  int module_frob_arch_sections(Elf_Ehdr *hdr,
11775                               Elf_Shdr *sechdrs,
11776 @@ -77,14 +121,16 @@ int apply_relocate(Elf32_Shdr *sechdrs,
11777         unsigned int i;
11778         Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
11779         Elf32_Sym *sym;
11780 -       uint32_t *location;
11781 +       uint32_t *plocation, location;
11782
11783         DEBUGP("Applying relocate section %u to %u\n", relsec,
11784                sechdrs[relsec].sh_info);
11785         for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
11786                 /* This is where to make the change */
11787 -               location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
11788 -                       + rel[i].r_offset;
11789 +               plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
11790 +               location = (uint32_t)plocation;
11791 +               if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
11792 +                       plocation = ktla_ktva((void *)plocation);
11793                 /* This is the symbol it is referring to.  Note that all
11794                    undefined symbols have been resolved.  */
11795                 sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
11796 @@ -93,11 +139,15 @@ int apply_relocate(Elf32_Shdr *sechdrs,
11797                 switch (ELF32_R_TYPE(rel[i].r_info)) {
11798                 case R_386_32:
11799                         /* We add the value into the location given */
11800 -                       *location += sym->st_value;
11801 +                       pax_open_kernel();
11802 +                       *plocation += sym->st_value;
11803 +                       pax_close_kernel();
11804                         break;
11805                 case R_386_PC32:
11806                         /* Add the value, subtract its postition */
11807 -                       *location += sym->st_value - (uint32_t)location;
11808 +                       pax_open_kernel();
11809 +                       *plocation += sym->st_value - location;
11810 +                       pax_close_kernel();
11811                         break;
11812                 default:
11813                         printk(KERN_ERR "module %s: Unknown relocation: %u\n",
11814 @@ -153,21 +203,30 @@ int apply_relocate_add(Elf64_Shdr *sechd
11815                 case R_X86_64_NONE:
11816                         break;
11817                 case R_X86_64_64:
11818 +                       pax_open_kernel();
11819                         *(u64 *)loc = val;
11820 +                       pax_close_kernel();
11821                         break;
11822                 case R_X86_64_32:
11823 +                       pax_open_kernel();
11824                         *(u32 *)loc = val;
11825 +                       pax_close_kernel();
11826                         if (val != *(u32 *)loc)
11827                                 goto overflow;
11828                         break;
11829                 case R_X86_64_32S:
11830 +                       pax_open_kernel();
11831                         *(s32 *)loc = val;
11832 +                       pax_close_kernel();
11833                         if ((s64)val != *(s32 *)loc)
11834                                 goto overflow;
11835                         break;
11836                 case R_X86_64_PC32:
11837                         val -= (u64)loc;
11838 +                       pax_open_kernel();
11839                         *(u32 *)loc = val;
11840 +                       pax_close_kernel();
11841 +
11842  #if 0
11843                         if ((s64)val != *(s32 *)loc)
11844                                 goto overflow;
11845 diff -urNp linux-2.6.33/arch/x86/kernel/paravirt.c linux-2.6.33/arch/x86/kernel/paravirt.c
11846 --- linux-2.6.33/arch/x86/kernel/paravirt.c     2010-02-24 13:52:17.000000000 -0500
11847 +++ linux-2.6.33/arch/x86/kernel/paravirt.c     2010-03-07 12:23:35.941628368 -0500
11848 @@ -120,9 +120,9 @@ unsigned paravirt_patch_jmp(void *insnbu
11849
11850  /* Neat trick to map patch type back to the call within the
11851   * corresponding structure. */
11852 -static void *get_call_destination(u8 type)
11853 +static const void *get_call_destination(u8 type)
11854  {
11855 -       struct paravirt_patch_template tmpl = {
11856 +       const struct paravirt_patch_template tmpl = {
11857                 .pv_init_ops = pv_init_ops,
11858                 .pv_time_ops = pv_time_ops,
11859                 .pv_cpu_ops = pv_cpu_ops,
11860 @@ -133,13 +133,13 @@ static void *get_call_destination(u8 typ
11861                 .pv_lock_ops = pv_lock_ops,
11862  #endif
11863         };
11864 -       return *((void **)&tmpl + type);
11865 +       return *((const void **)&tmpl + type);
11866  }
11867
11868  unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
11869                                 unsigned long addr, unsigned len)
11870  {
11871 -       void *opfunc = get_call_destination(type);
11872 +       const void *opfunc = get_call_destination(type);
11873         unsigned ret;
11874
11875         if (opfunc == NULL)
11876 @@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
11877         if (insn_len > len || start == NULL)
11878                 insn_len = len;
11879         else
11880 -               memcpy(insnbuf, start, insn_len);
11881 +               memcpy(insnbuf, ktla_ktva(start), insn_len);
11882
11883         return insn_len;
11884  }
11885 @@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
11886         preempt_enable();
11887  }
11888
11889 -struct pv_info pv_info = {
11890 +struct pv_info pv_info __read_only = {
11891         .name = "bare hardware",
11892         .paravirt_enabled = 0,
11893         .kernel_rpl = 0,
11894         .shared_kernel_pmd = 1, /* Only used when CONFIG_X86_PAE is set */
11895  };
11896
11897 -struct pv_init_ops pv_init_ops = {
11898 +struct pv_init_ops pv_init_ops __read_only = {
11899         .patch = native_patch,
11900  };
11901
11902 -struct pv_time_ops pv_time_ops = {
11903 +struct pv_time_ops pv_time_ops __read_only = {
11904         .sched_clock = native_sched_clock,
11905  };
11906
11907 -struct pv_irq_ops pv_irq_ops = {
11908 +struct pv_irq_ops pv_irq_ops __read_only = {
11909         .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
11910         .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
11911         .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
11912 @@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
11913  #endif
11914  };
11915
11916 -struct pv_cpu_ops pv_cpu_ops = {
11917 +struct pv_cpu_ops pv_cpu_ops __read_only = {
11918         .cpuid = native_cpuid,
11919         .get_debugreg = native_get_debugreg,
11920         .set_debugreg = native_set_debugreg,
11921 @@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
11922         .end_context_switch = paravirt_nop,
11923  };
11924
11925 -struct pv_apic_ops pv_apic_ops = {
11926 +struct pv_apic_ops pv_apic_ops __read_only = {
11927  #ifdef CONFIG_X86_LOCAL_APIC
11928         .startup_ipi_hook = paravirt_nop,
11929  #endif
11930 @@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
11931  #define PTE_IDENT      __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
11932  #endif
11933
11934 -struct pv_mmu_ops pv_mmu_ops = {
11935 +struct pv_mmu_ops pv_mmu_ops __read_only = {
11936
11937         .read_cr2 = native_read_cr2,
11938         .write_cr2 = native_write_cr2,
11939 @@ -467,6 +467,12 @@ struct pv_mmu_ops pv_mmu_ops = {
11940         },
11941
11942         .set_fixmap = native_set_fixmap,
11943 +
11944 +#ifdef CONFIG_PAX_KERNEXEC
11945 +       .pax_open_kernel = native_pax_open_kernel,
11946 +       .pax_close_kernel = native_pax_close_kernel,
11947 +#endif
11948 +
11949  };
11950
11951  EXPORT_SYMBOL_GPL(pv_time_ops);
11952 diff -urNp linux-2.6.33/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.33/arch/x86/kernel/paravirt-spinlocks.c
11953 --- linux-2.6.33/arch/x86/kernel/paravirt-spinlocks.c   2010-02-24 13:52:17.000000000 -0500
11954 +++ linux-2.6.33/arch/x86/kernel/paravirt-spinlocks.c   2010-03-07 12:23:35.941628368 -0500
11955 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t
11956         arch_spin_lock(lock);
11957  }
11958
11959 -struct pv_lock_ops pv_lock_ops = {
11960 +struct pv_lock_ops pv_lock_ops __read_only = {
11961  #ifdef CONFIG_SMP
11962         .spin_is_locked = __ticket_spin_is_locked,
11963         .spin_is_contended = __ticket_spin_is_contended,
11964 diff -urNp linux-2.6.33/arch/x86/kernel/pci-calgary_64.c linux-2.6.33/arch/x86/kernel/pci-calgary_64.c
11965 --- linux-2.6.33/arch/x86/kernel/pci-calgary_64.c       2010-02-24 13:52:17.000000000 -0500
11966 +++ linux-2.6.33/arch/x86/kernel/pci-calgary_64.c       2010-03-07 12:23:35.941628368 -0500
11967 @@ -470,7 +470,7 @@ static void calgary_free_coherent(struct
11968         free_pages((unsigned long)vaddr, get_order(size));
11969  }
11970
11971 -static struct dma_map_ops calgary_dma_ops = {
11972 +static const struct dma_map_ops calgary_dma_ops = {
11973         .alloc_coherent = calgary_alloc_coherent,
11974         .free_coherent = calgary_free_coherent,
11975         .map_sg = calgary_map_sg,
11976 diff -urNp linux-2.6.33/arch/x86/kernel/pci-dma.c linux-2.6.33/arch/x86/kernel/pci-dma.c
11977 --- linux-2.6.33/arch/x86/kernel/pci-dma.c      2010-02-24 13:52:17.000000000 -0500
11978 +++ linux-2.6.33/arch/x86/kernel/pci-dma.c      2010-03-07 12:23:35.941628368 -0500
11979 @@ -15,7 +15,7 @@
11980
11981  static int forbid_dac __read_mostly;
11982
11983 -struct dma_map_ops *dma_ops = &nommu_dma_ops;
11984 +const struct dma_map_ops *dma_ops = &nommu_dma_ops;
11985  EXPORT_SYMBOL(dma_ops);
11986
11987  static int iommu_sac_force __read_mostly;
11988 @@ -240,7 +240,7 @@ early_param("iommu", iommu_setup);
11989
11990  int dma_supported(struct device *dev, u64 mask)
11991  {
11992 -       struct dma_map_ops *ops = get_dma_ops(dev);
11993 +       const struct dma_map_ops *ops = get_dma_ops(dev);
11994
11995  #ifdef CONFIG_PCI
11996         if (mask > 0xffffffff && forbid_dac > 0) {
11997 diff -urNp linux-2.6.33/arch/x86/kernel/pci-gart_64.c linux-2.6.33/arch/x86/kernel/pci-gart_64.c
11998 --- linux-2.6.33/arch/x86/kernel/pci-gart_64.c  2010-02-24 13:52:17.000000000 -0500
11999 +++ linux-2.6.33/arch/x86/kernel/pci-gart_64.c  2010-03-07 12:23:35.941628368 -0500
12000 @@ -695,7 +695,7 @@ static __init int init_k8_gatt(struct ag
12001         return -1;
12002  }
12003
12004 -static struct dma_map_ops gart_dma_ops = {
12005 +static const struct dma_map_ops gart_dma_ops = {
12006         .map_sg                         = gart_map_sg,
12007         .unmap_sg                       = gart_unmap_sg,
12008         .map_page                       = gart_map_page,
12009 diff -urNp linux-2.6.33/arch/x86/kernel/pci-nommu.c linux-2.6.33/arch/x86/kernel/pci-nommu.c
12010 --- linux-2.6.33/arch/x86/kernel/pci-nommu.c    2010-02-24 13:52:17.000000000 -0500
12011 +++ linux-2.6.33/arch/x86/kernel/pci-nommu.c    2010-03-07 12:23:35.941628368 -0500
12012 @@ -94,7 +94,7 @@ static void nommu_sync_sg_for_device(str
12013         flush_write_buffers();
12014  }
12015
12016 -struct dma_map_ops nommu_dma_ops = {
12017 +const struct dma_map_ops nommu_dma_ops = {
12018         .alloc_coherent         = dma_generic_alloc_coherent,
12019         .free_coherent          = nommu_free_coherent,
12020         .map_sg                 = nommu_map_sg,
12021 diff -urNp linux-2.6.33/arch/x86/kernel/pci-swiotlb.c linux-2.6.33/arch/x86/kernel/pci-swiotlb.c
12022 --- linux-2.6.33/arch/x86/kernel/pci-swiotlb.c  2010-02-24 13:52:17.000000000 -0500
12023 +++ linux-2.6.33/arch/x86/kernel/pci-swiotlb.c  2010-03-07 12:23:35.941628368 -0500
12024 @@ -25,7 +25,7 @@ static void *x86_swiotlb_alloc_coherent(
12025         return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
12026  }
12027
12028 -static struct dma_map_ops swiotlb_dma_ops = {
12029 +static const struct dma_map_ops swiotlb_dma_ops = {
12030         .mapping_error = swiotlb_dma_mapping_error,
12031         .alloc_coherent = x86_swiotlb_alloc_coherent,
12032         .free_coherent = swiotlb_free_coherent,
12033 diff -urNp linux-2.6.33/arch/x86/kernel/process_32.c linux-2.6.33/arch/x86/kernel/process_32.c
12034 --- linux-2.6.33/arch/x86/kernel/process_32.c   2010-02-24 13:52:17.000000000 -0500
12035 +++ linux-2.6.33/arch/x86/kernel/process_32.c   2010-03-07 12:23:35.941628368 -0500
12036 @@ -66,6 +66,7 @@ asmlinkage void ret_from_fork(void) __as
12037  unsigned long thread_saved_pc(struct task_struct *tsk)
12038  {
12039         return ((unsigned long *)tsk->thread.sp)[3];
12040 +//XXX  return tsk->thread.eip;
12041  }
12042
12043  #ifndef CONFIG_SMP
12044 @@ -127,7 +128,7 @@ void __show_regs(struct pt_regs *regs, i
12045         unsigned long sp;
12046         unsigned short ss, gs;
12047
12048 -       if (user_mode_vm(regs)) {
12049 +       if (user_mode(regs)) {
12050                 sp = regs->sp;
12051                 ss = regs->ss & 0xffff;
12052                 gs = get_user_gs(regs);
12053 @@ -203,7 +204,7 @@ int copy_thread(unsigned long clone_flag
12054         struct task_struct *tsk;
12055         int err;
12056
12057 -       childregs = task_pt_regs(p);
12058 +       childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
12059         *childregs = *regs;
12060         childregs->ax = 0;
12061         childregs->sp = sp;
12062 @@ -237,6 +238,7 @@ int copy_thread(unsigned long clone_flag
12063          * Set a new TLS for the child thread?
12064          */
12065         if (clone_flags & CLONE_SETTLS)
12066 +//XXX needs set_fs()?
12067                 err = do_set_thread_area(p, -1,
12068                         (struct user_desc __user *)childregs->si, 0);
12069
12070 @@ -307,7 +309,7 @@ __switch_to(struct task_struct *prev_p,
12071         struct thread_struct *prev = &prev_p->thread,
12072                                  *next = &next_p->thread;
12073         int cpu = smp_processor_id();
12074 -       struct tss_struct *tss = &per_cpu(init_tss, cpu);
12075 +       struct tss_struct *tss = init_tss + cpu;
12076         bool preload_fpu;
12077
12078         /* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
12079 @@ -342,6 +344,11 @@ __switch_to(struct task_struct *prev_p,
12080          */
12081         lazy_save_gs(prev->gs);
12082
12083 +#ifdef CONFIG_PAX_MEMORY_UDEREF
12084 +       if (!segment_eq(task_thread_info(prev_p)->addr_limit, task_thread_info(next_p)->addr_limit))
12085 +               __set_fs(task_thread_info(next_p)->addr_limit, cpu);
12086 +#endif
12087 +
12088         /*
12089          * Load the per-thread Thread-Local Storage descriptor.
12090          */
12091 @@ -418,3 +425,27 @@ unsigned long get_wchan(struct task_stru
12092         return 0;
12093  }
12094
12095 +#ifdef CONFIG_PAX_RANDKSTACK
12096 +asmlinkage void pax_randomize_kstack(void)
12097 +{
12098 +       struct thread_struct *thread = &current->thread;
12099 +       unsigned long time;
12100 +
12101 +       if (!randomize_va_space)
12102 +               return;
12103 +
12104 +       rdtscl(time);
12105 +
12106 +       /* P4 seems to return a 0 LSB, ignore it */
12107 +#ifdef CONFIG_MPENTIUM4
12108 +       time &= 0x1EUL;
12109 +       time <<= 2;
12110 +#else
12111 +       time &= 0xFUL;
12112 +       time <<= 3;
12113 +#endif
12114 +
12115 +       thread->sp0 ^= time;
12116 +       load_sp0(init_tss + smp_processor_id(), thread);
12117 +}
12118 +#endif
12119 diff -urNp linux-2.6.33/arch/x86/kernel/process_64.c linux-2.6.33/arch/x86/kernel/process_64.c
12120 --- linux-2.6.33/arch/x86/kernel/process_64.c   2010-02-24 13:52:17.000000000 -0500
12121 +++ linux-2.6.33/arch/x86/kernel/process_64.c   2010-03-07 12:23:35.941628368 -0500
12122 @@ -88,7 +88,7 @@ static void __exit_idle(void)
12123  void exit_idle(void)
12124  {
12125         /* idle loop has pid 0 */
12126 -       if (current->pid)
12127 +       if (task_pid_nr(current))
12128                 return;
12129         __exit_idle();
12130  }
12131 @@ -389,7 +389,7 @@ __switch_to(struct task_struct *prev_p,
12132         struct thread_struct *prev = &prev_p->thread;
12133         struct thread_struct *next = &next_p->thread;
12134         int cpu = smp_processor_id();
12135 -       struct tss_struct *tss = &per_cpu(init_tss, cpu);
12136 +       struct tss_struct *tss = init_tss + cpu;
12137         unsigned fsindex, gsindex;
12138         bool preload_fpu;
12139
12140 @@ -542,12 +542,11 @@ unsigned long get_wchan(struct task_stru
12141         if (!p || p == current || p->state == TASK_RUNNING)
12142                 return 0;
12143         stack = (unsigned long)task_stack_page(p);
12144 -       if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
12145 +       if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
12146                 return 0;
12147         fp = *(u64 *)(p->thread.sp);
12148         do {
12149 -               if (fp < (unsigned long)stack ||
12150 -                   fp >= (unsigned long)stack+THREAD_SIZE)
12151 +               if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
12152                         return 0;
12153                 ip = *(u64 *)(fp+8);
12154                 if (!in_sched_functions(ip))
12155 diff -urNp linux-2.6.33/arch/x86/kernel/process.c linux-2.6.33/arch/x86/kernel/process.c
12156 --- linux-2.6.33/arch/x86/kernel/process.c      2010-02-24 13:52:17.000000000 -0500
12157 +++ linux-2.6.33/arch/x86/kernel/process.c      2010-03-07 12:23:35.941628368 -0500
12158 @@ -78,7 +78,7 @@ void exit_thread(void)
12159         unsigned long *bp = t->io_bitmap_ptr;
12160
12161         if (bp) {
12162 -               struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
12163 +               struct tss_struct *tss = init_tss + get_cpu();
12164
12165                 t->io_bitmap_ptr = NULL;
12166                 clear_thread_flag(TIF_IO_BITMAP);
12167 @@ -115,6 +115,9 @@ void flush_thread(void)
12168  {
12169         struct task_struct *tsk = current;
12170
12171 +#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR)
12172 +       loadsegment(gs, 0);
12173 +#endif
12174         flush_ptrace_hw_breakpoint(tsk);
12175         memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
12176         /*
12177 @@ -272,8 +275,8 @@ int kernel_thread(int (*fn)(void *), voi
12178         regs.di = (unsigned long) arg;
12179
12180  #ifdef CONFIG_X86_32
12181 -       regs.ds = __USER_DS;
12182 -       regs.es = __USER_DS;
12183 +       regs.ds = __KERNEL_DS;
12184 +       regs.es = __KERNEL_DS;
12185         regs.fs = __KERNEL_PERCPU;
12186         regs.gs = __KERNEL_STACK_CANARY;
12187  #else
12188 @@ -664,17 +667,3 @@ static int __init idle_setup(char *str)
12189         return 0;
12190  }
12191  early_param("idle", idle_setup);
12192 -
12193 -unsigned long arch_align_stack(unsigned long sp)
12194 -{
12195 -       if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
12196 -               sp -= get_random_int() % 8192;
12197 -       return sp & ~0xf;
12198 -}
12199 -
12200 -unsigned long arch_randomize_brk(struct mm_struct *mm)
12201 -{
12202 -       unsigned long range_end = mm->brk + 0x02000000;
12203 -       return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
12204 -}
12205 -
12206 diff -urNp linux-2.6.33/arch/x86/kernel/ptrace.c linux-2.6.33/arch/x86/kernel/ptrace.c
12207 --- linux-2.6.33/arch/x86/kernel/ptrace.c       2010-02-24 13:52:17.000000000 -0500
12208 +++ linux-2.6.33/arch/x86/kernel/ptrace.c       2010-03-07 12:23:35.941628368 -0500
12209 @@ -1167,7 +1167,7 @@ static const struct user_regset_view use
12210  long arch_ptrace(struct task_struct *child, long request, long addr, long data)
12211  {
12212         int ret;
12213 -       unsigned long __user *datap = (unsigned long __user *)data;
12214 +       unsigned long __user *datap = (__force unsigned long __user *)data;
12215
12216         switch (request) {
12217         /* read the word at location addr in the USER area. */
12218 @@ -1254,14 +1254,14 @@ long arch_ptrace(struct task_struct *chi
12219                 if (addr < 0)
12220                         return -EIO;
12221                 ret = do_get_thread_area(child, addr,
12222 -                                        (struct user_desc __user *) data);
12223 +                                        (__force struct user_desc __user *) data);
12224                 break;
12225
12226         case PTRACE_SET_THREAD_AREA:
12227                 if (addr < 0)
12228                         return -EIO;
12229                 ret = do_set_thread_area(child, addr,
12230 -                                        (struct user_desc __user *) data, 0);
12231 +                                        (__force struct user_desc __user *) data, 0);
12232                 break;
12233  #endif
12234
12235 @@ -1280,12 +1280,12 @@ long arch_ptrace(struct task_struct *chi
12236  #ifdef CONFIG_X86_PTRACE_BTS
12237         case PTRACE_BTS_CONFIG:
12238                 ret = ptrace_bts_config
12239 -                       (child, data, (struct ptrace_bts_config __user *)addr);
12240 +                       (child, data, (__force struct ptrace_bts_config __user *)addr);
12241                 break;
12242
12243         case PTRACE_BTS_STATUS:
12244                 ret = ptrace_bts_status
12245 -                       (child, data, (struct ptrace_bts_config __user *)addr);
12246 +                       (child, data, (__force struct ptrace_bts_config __user *)addr);
12247                 break;
12248
12249         case PTRACE_BTS_SIZE:
12250 @@ -1294,7 +1294,7 @@ long arch_ptrace(struct task_struct *chi
12251
12252         case PTRACE_BTS_GET:
12253                 ret = ptrace_bts_read_record
12254 -                       (child, data, (struct bts_struct __user *) addr);
12255 +                       (child, data, (__force struct bts_struct __user *) addr);
12256                 break;
12257
12258         case PTRACE_BTS_CLEAR:
12259 @@ -1303,7 +1303,7 @@ long arch_ptrace(struct task_struct *chi
12260
12261         case PTRACE_BTS_DRAIN:
12262                 ret = ptrace_bts_drain
12263 -                       (child, data, (struct bts_struct __user *) addr);
12264 +                       (child, data, (__force struct bts_struct __user *) addr);
12265                 break;
12266  #endif /* CONFIG_X86_PTRACE_BTS */
12267
12268 @@ -1690,7 +1690,7 @@ static void fill_sigtrap_info(struct tas
12269         memset(info, 0, sizeof(*info));
12270         info->si_signo = SIGTRAP;
12271         info->si_code = si_code;
12272 -       info->si_addr = user_mode_vm(regs) ? (void __user *)regs->ip : NULL;
12273 +       info->si_addr = user_mode(regs) ? (__force void __user *)regs->ip : NULL;
12274  }
12275
12276  void user_single_step_siginfo(struct task_struct *tsk,
12277 diff -urNp linux-2.6.33/arch/x86/kernel/reboot.c linux-2.6.33/arch/x86/kernel/reboot.c
12278 --- linux-2.6.33/arch/x86/kernel/reboot.c       2010-02-24 13:52:17.000000000 -0500
12279 +++ linux-2.6.33/arch/x86/kernel/reboot.c       2010-03-07 12:23:35.941628368 -0500
12280 @@ -33,7 +33,7 @@ void (*pm_power_off)(void);
12281  EXPORT_SYMBOL(pm_power_off);
12282
12283  static const struct desc_ptr no_idt = {};
12284 -static int reboot_mode;
12285 +static unsigned short reboot_mode;
12286  enum reboot_type reboot_type = BOOT_KBD;
12287  int reboot_force;
12288
12289 @@ -276,7 +276,7 @@ static struct dmi_system_id __initdata r
12290                         DMI_MATCH(DMI_BOARD_NAME, "P4S800"),
12291                 },
12292         },
12293 -       { }
12294 +       { NULL, NULL, {{0, {0}}}, NULL}
12295  };
12296
12297  static int __init reboot_init(void)
12298 @@ -292,12 +292,12 @@ core_initcall(reboot_init);
12299     controller to pulse the CPU reset line, which is more thorough, but
12300     doesn't work with at least one type of 486 motherboard.  It is easy
12301     to stop this code working; hence the copious comments. */
12302 -static const unsigned long long
12303 -real_mode_gdt_entries [3] =
12304 +static struct desc_struct
12305 +real_mode_gdt_entries [3] __read_only =
12306  {
12307 -       0x0000000000000000ULL,  /* Null descriptor */
12308 -       0x00009b000000ffffULL,  /* 16-bit real-mode 64k code at 0x00000000 */
12309 -       0x000093000100ffffULL   /* 16-bit real-mode 64k data at 0x00000100 */
12310 +       GDT_ENTRY_INIT(0, 0, 0),                /* Null descriptor */
12311 +       GDT_ENTRY_INIT(0x9b, 0, 0xffff),        /* 16-bit real-mode 64k code at 0x00000000 */
12312 +       GDT_ENTRY_INIT(0x93, 0x100, 0xffff)     /* 16-bit real-mode 64k data at 0x00000100 */
12313  };
12314
12315  static const struct desc_ptr
12316 @@ -346,7 +346,7 @@ static const unsigned char jump_to_bios
12317   * specified by the code and length parameters.
12318   * We assume that length will aways be less that 100!
12319   */
12320 -void machine_real_restart(const unsigned char *code, int length)
12321 +void machine_real_restart(const unsigned char *code, unsigned int length)
12322  {
12323         local_irq_disable();
12324
12325 @@ -366,8 +366,8 @@ void machine_real_restart(const unsigned
12326         /* Remap the kernel at virtual address zero, as well as offset zero
12327            from the kernel segment.  This assumes the kernel segment starts at
12328            virtual address PAGE_OFFSET. */
12329 -       memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
12330 -               sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
12331 +       clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
12332 +                       min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
12333
12334         /*
12335          * Use `swapper_pg_dir' as our page directory.
12336 @@ -379,16 +379,15 @@ void machine_real_restart(const unsigned
12337            boot)".  This seems like a fairly standard thing that gets set by
12338            REBOOT.COM programs, and the previous reset routine did this
12339            too. */
12340 -       *((unsigned short *)0x472) = reboot_mode;
12341 +       *(unsigned short *)(__va(0x472)) = reboot_mode;
12342
12343         /* For the switch to real mode, copy some code to low memory.  It has
12344            to be in the first 64k because it is running in 16-bit mode, and it
12345            has to have the same physical and virtual address, because it turns
12346            off paging.  Copy it near the end of the first page, out of the way
12347            of BIOS variables. */
12348 -       memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
12349 -               real_mode_switch, sizeof (real_mode_switch));
12350 -       memcpy((void *)(0x1000 - 100), code, length);
12351 +       memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
12352 +       memcpy(__va(0x1000 - 100), code, length);
12353
12354         /* Set up the IDT for real mode. */
12355         load_idt(&real_mode_idt);
12356 diff -urNp linux-2.6.33/arch/x86/kernel/setup.c linux-2.6.33/arch/x86/kernel/setup.c
12357 --- linux-2.6.33/arch/x86/kernel/setup.c        2010-02-24 13:52:17.000000000 -0500
12358 +++ linux-2.6.33/arch/x86/kernel/setup.c        2010-03-07 12:23:35.941628368 -0500
12359 @@ -749,14 +749,14 @@ void __init setup_arch(char **cmdline_p)
12360
12361         if (!boot_params.hdr.root_flags)
12362                 root_mountflags &= ~MS_RDONLY;
12363 -       init_mm.start_code = (unsigned long) _text;
12364 -       init_mm.end_code = (unsigned long) _etext;
12365 +       init_mm.start_code = ktla_ktva((unsigned long) _text);
12366 +       init_mm.end_code = ktla_ktva((unsigned long) _etext);
12367         init_mm.end_data = (unsigned long) _edata;
12368         init_mm.brk = _brk_end;
12369
12370 -       code_resource.start = virt_to_phys(_text);
12371 -       code_resource.end = virt_to_phys(_etext)-1;
12372 -       data_resource.start = virt_to_phys(_etext);
12373 +       code_resource.start = virt_to_phys(ktla_ktva(_text));
12374 +       code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
12375 +       data_resource.start = virt_to_phys(_sdata);
12376         data_resource.end = virt_to_phys(_edata)-1;
12377         bss_resource.start = virt_to_phys(&__bss_start);
12378         bss_resource.end = virt_to_phys(&__bss_stop)-1;
12379 diff -urNp linux-2.6.33/arch/x86/kernel/setup_percpu.c linux-2.6.33/arch/x86/kernel/setup_percpu.c
12380 --- linux-2.6.33/arch/x86/kernel/setup_percpu.c 2010-02-24 13:52:17.000000000 -0500
12381 +++ linux-2.6.33/arch/x86/kernel/setup_percpu.c 2010-03-07 12:23:35.941628368 -0500
12382 @@ -27,19 +27,17 @@
12383  # define DBG(fmt, ...) do { if (0) pr_dbg(fmt, ##__VA_ARGS__); } while (0)
12384  #endif
12385
12386 +#ifdef CONFIG_SMP
12387  DEFINE_PER_CPU(int, cpu_number);
12388  EXPORT_PER_CPU_SYMBOL(cpu_number);
12389 +#endif
12390
12391 -#ifdef CONFIG_X86_64
12392  #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
12393 -#else
12394 -#define BOOT_PERCPU_OFFSET 0
12395 -#endif
12396
12397  DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
12398  EXPORT_PER_CPU_SYMBOL(this_cpu_off);
12399
12400 -unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
12401 +unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
12402         [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
12403  };
12404  EXPORT_SYMBOL(__per_cpu_offset);
12405 @@ -160,13 +158,15 @@ static void __init pcpup_populate_pte(un
12406  static inline void setup_percpu_segment(int cpu)
12407  {
12408  #ifdef CONFIG_X86_32
12409 -       struct desc_struct gdt;
12410 +       struct desc_struct d, *gdt = get_cpu_gdt_table(cpu);
12411 +       unsigned long base = per_cpu_offset(cpu);
12412 +       const unsigned long limit = VMALLOC_END - base - 1;
12413
12414 -       pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
12415 -                       0x2 | DESCTYPE_S, 0x8);
12416 -       gdt.s = 1;
12417 -       write_gdt_entry(get_cpu_gdt_table(cpu),
12418 -                       GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
12419 +       if (limit < 64*1024)
12420 +               pack_descriptor(&d, base, limit, 0x80 | DESCTYPE_S | 0x3, 0x4);
12421 +       else
12422 +               pack_descriptor(&d, base, limit >> PAGE_SHIFT, 0x80 | DESCTYPE_S | 0x3, 0xC);
12423 +       write_gdt_entry(gdt, GDT_ENTRY_PERCPU, &d, DESCTYPE_S);
12424  #endif
12425  }
12426
12427 @@ -213,6 +213,11 @@ void __init setup_per_cpu_areas(void)
12428         /* alrighty, percpu areas up and running */
12429         delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
12430         for_each_possible_cpu(cpu) {
12431 +#ifdef CONFIG_CC_STACKPROTECTOR
12432 +#ifdef CONFIG_x86_32
12433 +               unsigned long canary = per_cpu(stack_canary, cpu);
12434 +#endif
12435 +#endif
12436                 per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
12437                 per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
12438                 per_cpu(cpu_number, cpu) = cpu;
12439 @@ -240,6 +245,12 @@ void __init setup_per_cpu_areas(void)
12440                         early_per_cpu_map(x86_cpu_to_node_map, cpu);
12441  #endif
12442  #endif
12443 +#ifdef CONFIG_CC_STACKPROTECTOR
12444 +#ifdef CONFIG_x86_32
12445 +               if (cpu == boot_cpu_id)
12446 +                       per_cpu(stack_canary, cpu) = canary;
12447 +#endif
12448 +#endif
12449                 /*
12450                  * Up to this point, the boot CPU has been using .data.init
12451                  * area.  Reload any changed state for the boot CPU.
12452 diff -urNp linux-2.6.33/arch/x86/kernel/signal.c linux-2.6.33/arch/x86/kernel/signal.c
12453 --- linux-2.6.33/arch/x86/kernel/signal.c       2010-02-24 13:52:17.000000000 -0500
12454 +++ linux-2.6.33/arch/x86/kernel/signal.c       2010-03-07 12:23:35.941628368 -0500
12455 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
12456          * Align the stack pointer according to the i386 ABI,
12457          * i.e. so that on function entry ((sp + 4) & 15) == 0.
12458          */
12459 -       sp = ((sp + 4) & -16ul) - 4;
12460 +       sp = ((sp - 12) & -16ul) - 4;
12461  #else /* !CONFIG_X86_32 */
12462         sp = round_down(sp, 16) - 8;
12463  #endif
12464 @@ -249,11 +249,11 @@ get_sigframe(struct k_sigaction *ka, str
12465          * Return an always-bogus address instead so we will die with SIGSEGV.
12466          */
12467         if (onsigstack && !likely(on_sig_stack(sp)))
12468 -               return (void __user *)-1L;
12469 +               return (__force void __user *)-1L;
12470
12471         /* save i387 state */
12472         if (used_math() && save_i387_xstate(*fpstate) < 0)
12473 -               return (void __user *)-1L;
12474 +               return (__force void __user *)-1L;
12475
12476         return (void __user *)sp;
12477  }
12478 @@ -308,9 +308,9 @@ __setup_frame(int sig, struct k_sigactio
12479         }
12480
12481         if (current->mm->context.vdso)
12482 -               restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
12483 +               restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
12484         else
12485 -               restorer = &frame->retcode;
12486 +               restorer = (void __user *)&frame->retcode;
12487         if (ka->sa.sa_flags & SA_RESTORER)
12488                 restorer = ka->sa.sa_restorer;
12489
12490 @@ -324,7 +324,7 @@ __setup_frame(int sig, struct k_sigactio
12491          * reasons and because gdb uses it as a signature to notice
12492          * signal handler stack frames.
12493          */
12494 -       err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
12495 +       err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
12496
12497         if (err)
12498                 return -EFAULT;
12499 @@ -378,7 +378,7 @@ static int __setup_rt_frame(int sig, str
12500                 err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
12501
12502                 /* Set up to return from userspace.  */
12503 -               restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
12504 +               restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
12505                 if (ka->sa.sa_flags & SA_RESTORER)
12506                         restorer = ka->sa.sa_restorer;
12507                 put_user_ex(restorer, &frame->pretcode);
12508 @@ -390,7 +390,7 @@ static int __setup_rt_frame(int sig, str
12509                  * reasons and because gdb uses it as a signature to notice
12510                  * signal handler stack frames.
12511                  */
12512 -               put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
12513 +               put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
12514         } put_user_catch(err);
12515
12516         if (err)
12517 @@ -780,7 +780,7 @@ static void do_signal(struct pt_regs *re
12518          * X86_32: vm86 regs switched out by assembly code before reaching
12519          * here, so testing against kernel CS suffices.
12520          */
12521 -       if (!user_mode(regs))
12522 +       if (!user_mode_novm(regs))
12523                 return;
12524
12525         if (current_thread_info()->status & TS_RESTORE_SIGMASK)
12526 diff -urNp linux-2.6.33/arch/x86/kernel/smpboot.c linux-2.6.33/arch/x86/kernel/smpboot.c
12527 --- linux-2.6.33/arch/x86/kernel/smpboot.c      2010-02-24 13:52:17.000000000 -0500
12528 +++ linux-2.6.33/arch/x86/kernel/smpboot.c      2010-03-07 12:23:35.941628368 -0500
12529 @@ -750,7 +750,11 @@ do_rest:
12530                 (unsigned long)task_stack_page(c_idle.idle) -
12531                 KERNEL_STACK_OFFSET + THREAD_SIZE;
12532  #endif
12533 +
12534 +       pax_open_kernel();
12535         early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
12536 +       pax_close_kernel();
12537 +
12538         initial_code = (unsigned long)start_secondary;
12539         stack_start.sp = (void *) c_idle.idle->thread.sp;
12540
12541 diff -urNp linux-2.6.33/arch/x86/kernel/step.c linux-2.6.33/arch/x86/kernel/step.c
12542 --- linux-2.6.33/arch/x86/kernel/step.c 2010-02-24 13:52:17.000000000 -0500
12543 +++ linux-2.6.33/arch/x86/kernel/step.c 2010-03-07 12:23:35.941628368 -0500
12544 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
12545                 struct desc_struct *desc;
12546                 unsigned long base;
12547
12548 -               seg &= ~7UL;
12549 +               seg >>= 3;
12550
12551                 mutex_lock(&child->mm->context.lock);
12552 -               if (unlikely((seg >> 3) >= child->mm->context.size))
12553 +               if (unlikely(seg >= child->mm->context.size))
12554                         addr = -1L; /* bogus selector, access would fault */
12555                 else {
12556                         desc = child->mm->context.ldt + seg;
12557 @@ -53,6 +53,9 @@ static int is_setting_trap_flag(struct t
12558         unsigned char opcode[15];
12559         unsigned long addr = convert_ip_to_linear(child, regs);
12560
12561 +       if (addr == -EINVAL)
12562 +               return 0;
12563 +
12564         copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
12565         for (i = 0; i < copied; i++) {
12566                 switch (opcode[i]) {
12567 @@ -74,7 +77,7 @@ static int is_setting_trap_flag(struct t
12568
12569  #ifdef CONFIG_X86_64
12570                 case 0x40 ... 0x4f:
12571 -                       if (regs->cs != __USER_CS)
12572 +                       if ((regs->cs & 0xffff) != __USER_CS)
12573                                 /* 32-bit mode: register increment */
12574                                 return 0;
12575                         /* 64-bit mode: REX prefix */
12576 diff -urNp linux-2.6.33/arch/x86/kernel/syscall_table_32.S linux-2.6.33/arch/x86/kernel/syscall_table_32.S
12577 --- linux-2.6.33/arch/x86/kernel/syscall_table_32.S     2010-02-24 13:52:17.000000000 -0500
12578 +++ linux-2.6.33/arch/x86/kernel/syscall_table_32.S     2010-03-07 12:23:35.941628368 -0500
12579 @@ -1,3 +1,4 @@
12580 +.section .rodata,"a",@progbits
12581  ENTRY(sys_call_table)
12582         .long sys_restart_syscall       /* 0 - old "setup()" system call, used for restarting */
12583         .long sys_exit
12584 diff -urNp linux-2.6.33/arch/x86/kernel/sys_i386_32.c linux-2.6.33/arch/x86/kernel/sys_i386_32.c
12585 --- linux-2.6.33/arch/x86/kernel/sys_i386_32.c  2010-02-24 13:52:17.000000000 -0500
12586 +++ linux-2.6.33/arch/x86/kernel/sys_i386_32.c  2010-03-07 12:23:35.945583410 -0500
12587 @@ -24,6 +24,21 @@
12588
12589  #include <asm/syscalls.h>
12590
12591 +int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
12592 +{
12593 +       unsigned long pax_task_size = TASK_SIZE;
12594 +
12595 +#ifdef CONFIG_PAX_SEGMEXEC
12596 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
12597 +               pax_task_size = SEGMEXEC_TASK_SIZE;
12598 +#endif
12599 +
12600 +       if (len > pax_task_size || addr > pax_task_size - len)
12601 +               return -EINVAL;
12602 +
12603 +       return 0;
12604 +}
12605 +
12606  /*
12607   * Perform the select(nd, in, out, ex, tv) and mmap() system
12608   * calls. Linux/i386 didn't use to be able to handle more than
12609 @@ -58,6 +73,205 @@ out:
12610         return err;
12611  }
12612
12613 +unsigned long
12614 +arch_get_unmapped_area(struct file *filp, unsigned long addr,
12615 +               unsigned long len, unsigned long pgoff, unsigned long flags)
12616 +{
12617 +       struct mm_struct *mm = current->mm;
12618 +       struct vm_area_struct *vma;
12619 +       unsigned long start_addr, pax_task_size = TASK_SIZE;
12620 +
12621 +#ifdef CONFIG_PAX_SEGMEXEC
12622 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
12623 +               pax_task_size = SEGMEXEC_TASK_SIZE;
12624 +#endif
12625 +
12626 +       if (len > pax_task_size)
12627 +               return -ENOMEM;
12628 +
12629 +       if (flags & MAP_FIXED)
12630 +               return addr;
12631 +
12632 +#ifdef CONFIG_PAX_RANDMMAP
12633 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12634 +#endif
12635 +
12636 +       if (addr) {
12637 +               addr = PAGE_ALIGN(addr);
12638 +               vma = find_vma(mm, addr);
12639 +               if (pax_task_size - len >= addr &&
12640 +                   (!vma || addr + len <= vma->vm_start))
12641 +                       return addr;
12642 +       }
12643 +       if (len > mm->cached_hole_size) {
12644 +               start_addr = addr = mm->free_area_cache;
12645 +       } else {
12646 +               start_addr = addr = mm->mmap_base;
12647 +               mm->cached_hole_size = 0;
12648 +       }
12649 +
12650 +#ifdef CONFIG_PAX_PAGEEXEC
12651 +       if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
12652 +               start_addr = 0x00110000UL;
12653 +
12654 +#ifdef CONFIG_PAX_RANDMMAP
12655 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
12656 +                       start_addr += mm->delta_mmap & 0x03FFF000UL;
12657 +#endif
12658 +
12659 +               if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
12660 +                       start_addr = addr = mm->mmap_base;
12661 +               else
12662 +                       addr = start_addr;
12663 +       }
12664 +#endif
12665 +
12666 +full_search:
12667 +       for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
12668 +               /* At this point:  (!vma || addr < vma->vm_end). */
12669 +               if (pax_task_size - len < addr) {
12670 +                       /*
12671 +                        * Start a new search - just in case we missed
12672 +                        * some holes.
12673 +                        */
12674 +                       if (start_addr != mm->mmap_base) {
12675 +                               start_addr = addr = mm->mmap_base;
12676 +                               mm->cached_hole_size = 0;
12677 +                               goto full_search;
12678 +                       }
12679 +                       return -ENOMEM;
12680 +               }
12681 +               if (!vma || addr + len <= vma->vm_start) {
12682 +                       /*
12683 +                        * Remember the place where we stopped the search:
12684 +                        */
12685 +                       mm->free_area_cache = addr + len;
12686 +                       return addr;
12687 +               }
12688 +               if (addr + mm->cached_hole_size < vma->vm_start)
12689 +                       mm->cached_hole_size = vma->vm_start - addr;
12690 +               addr = vma->vm_end;
12691 +               if (mm->start_brk <= addr && addr < mm->mmap_base) {
12692 +                       start_addr = addr = mm->mmap_base;
12693 +                       mm->cached_hole_size = 0;
12694 +                       goto full_search;
12695 +               }
12696 +       }
12697 +}
12698 +
12699 +unsigned long
12700 +arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
12701 +                         const unsigned long len, const unsigned long pgoff,
12702 +                         const unsigned long flags)
12703 +{
12704 +       struct vm_area_struct *vma;
12705 +       struct mm_struct *mm = current->mm;
12706 +       unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
12707 +
12708 +#ifdef CONFIG_PAX_SEGMEXEC
12709 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
12710 +               pax_task_size = SEGMEXEC_TASK_SIZE;
12711 +#endif
12712 +
12713 +       /* requested length too big for entire address space */
12714 +       if (len > pax_task_size)
12715 +               return -ENOMEM;
12716 +
12717 +       if (flags & MAP_FIXED)
12718 +               return addr;
12719 +
12720 +#ifdef CONFIG_PAX_PAGEEXEC
12721 +       if (!(__supported_pte_mask & _PAGE_NX) && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
12722 +               goto bottomup;
12723 +#endif
12724 +
12725 +#ifdef CONFIG_PAX_RANDMMAP
12726 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12727 +#endif
12728 +
12729 +       /* requesting a specific address */
12730 +       if (addr) {
12731 +               addr = PAGE_ALIGN(addr);
12732 +               vma = find_vma(mm, addr);
12733 +               if (pax_task_size - len >= addr &&
12734 +                               (!vma || addr + len <= vma->vm_start))
12735 +                       return addr;
12736 +       }
12737 +
12738 +       /* check if free_area_cache is useful for us */
12739 +       if (len <= mm->cached_hole_size) {
12740 +               mm->cached_hole_size = 0;
12741 +               mm->free_area_cache = mm->mmap_base;
12742 +       }
12743 +
12744 +       /* either no address requested or can't fit in requested address hole */
12745 +       addr = mm->free_area_cache;
12746 +
12747 +       /* make sure it can fit in the remaining address space */
12748 +       if (addr > len) {
12749 +               vma = find_vma(mm, addr-len);
12750 +               if (!vma || addr <= vma->vm_start)
12751 +                       /* remember the address as a hint for next time */
12752 +                       return (mm->free_area_cache = addr-len);
12753 +       }
12754 +
12755 +       if (mm->mmap_base < len)
12756 +               goto bottomup;
12757 +
12758 +       addr = mm->mmap_base-len;
12759 +
12760 +       do {
12761 +               /*
12762 +                * Lookup failure means no vma is above this address,
12763 +                * else if new region fits below vma->vm_start,
12764 +                * return with success:
12765 +                */
12766 +               vma = find_vma(mm, addr);
12767 +               if (!vma || addr+len <= vma->vm_start)
12768 +                       /* remember the address as a hint for next time */
12769 +                       return (mm->free_area_cache = addr);
12770 +
12771 +               /* remember the largest hole we saw so far */
12772 +               if (addr + mm->cached_hole_size < vma->vm_start)
12773 +                       mm->cached_hole_size = vma->vm_start - addr;
12774 +
12775 +               /* try just below the current vma->vm_start */
12776 +               addr = vma->vm_start-len;
12777 +       } while (len < vma->vm_start);
12778 +
12779 +bottomup:
12780 +       /*
12781 +        * A failed mmap() very likely causes application failure,
12782 +        * so fall back to the bottom-up function here. This scenario
12783 +        * can happen with large stack limits and large mmap()
12784 +        * allocations.
12785 +        */
12786 +
12787 +#ifdef CONFIG_PAX_SEGMEXEC
12788 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
12789 +               mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
12790 +       else
12791 +#endif
12792 +
12793 +       mm->mmap_base = TASK_UNMAPPED_BASE;
12794 +
12795 +#ifdef CONFIG_PAX_RANDMMAP
12796 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
12797 +               mm->mmap_base += mm->delta_mmap;
12798 +#endif
12799 +
12800 +       mm->free_area_cache = mm->mmap_base;
12801 +       mm->cached_hole_size = ~0UL;
12802 +       addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
12803 +       /*
12804 +        * Restore the topdown base:
12805 +        */
12806 +       mm->mmap_base = base;
12807 +       mm->free_area_cache = base;
12808 +       mm->cached_hole_size = ~0UL;
12809 +
12810 +       return addr;
12811 +}
12812
12813  struct sel_arg_struct {
12814         unsigned long n;
12815 @@ -93,7 +307,7 @@ asmlinkage int sys_ipc(uint call, int fi
12816                 return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
12817         case SEMTIMEDOP:
12818                 return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
12819 -                                       (const struct timespec __user *)fifth);
12820 +                                       (__force const struct timespec __user *)fifth);
12821
12822         case SEMGET:
12823                 return sys_semget(first, second, third);
12824 @@ -140,7 +354,7 @@ asmlinkage int sys_ipc(uint call, int fi
12825                         ret = do_shmat(first, (char __user *) ptr, second, &raddr);
12826                         if (ret)
12827                                 return ret;
12828 -                       return put_user(raddr, (ulong __user *) third);
12829 +                       return put_user(raddr, (__force ulong __user *) third);
12830                 }
12831                 case 1: /* iBCS2 emulator entry point */
12832                         if (!segment_eq(get_fs(), get_ds()))
12833 diff -urNp linux-2.6.33/arch/x86/kernel/sys_x86_64.c linux-2.6.33/arch/x86/kernel/sys_x86_64.c
12834 --- linux-2.6.33/arch/x86/kernel/sys_x86_64.c   2010-02-24 13:52:17.000000000 -0500
12835 +++ linux-2.6.33/arch/x86/kernel/sys_x86_64.c   2010-03-07 12:23:35.945583410 -0500
12836 @@ -32,8 +32,8 @@ out:
12837         return error;
12838  }
12839
12840 -static void find_start_end(unsigned long flags, unsigned long *begin,
12841 -                          unsigned long *end)
12842 +static void find_start_end(struct mm_struct *mm, unsigned long flags,
12843 +                          unsigned long *begin, unsigned long *end)
12844  {
12845         if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
12846                 unsigned long new_begin;
12847 @@ -52,7 +52,7 @@ static void find_start_end(unsigned long
12848                                 *begin = new_begin;
12849                 }
12850         } else {
12851 -               *begin = TASK_UNMAPPED_BASE;
12852 +               *begin = mm->mmap_base;
12853                 *end = TASK_SIZE;
12854         }
12855  }
12856 @@ -69,11 +69,15 @@ arch_get_unmapped_area(struct file *filp
12857         if (flags & MAP_FIXED)
12858                 return addr;
12859
12860 -       find_start_end(flags, &begin, &end);
12861 +       find_start_end(mm, flags, &begin, &end);
12862
12863         if (len > end)
12864                 return -ENOMEM;
12865
12866 +#ifdef CONFIG_PAX_RANDMMAP
12867 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12868 +#endif
12869 +
12870         if (addr) {
12871                 addr = PAGE_ALIGN(addr);
12872                 vma = find_vma(mm, addr);
12873 @@ -128,7 +132,7 @@ arch_get_unmapped_area_topdown(struct fi
12874  {
12875         struct vm_area_struct *vma;
12876         struct mm_struct *mm = current->mm;
12877 -       unsigned long addr = addr0;
12878 +       unsigned long base = mm->mmap_base, addr = addr0;
12879
12880         /* requested length too big for entire address space */
12881         if (len > TASK_SIZE)
12882 @@ -141,6 +145,10 @@ arch_get_unmapped_area_topdown(struct fi
12883         if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
12884                 goto bottomup;
12885
12886 +#ifdef CONFIG_PAX_RANDMMAP
12887 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
12888 +#endif
12889 +
12890         /* requesting a specific address */
12891         if (addr) {
12892                 addr = PAGE_ALIGN(addr);
12893 @@ -198,13 +206,21 @@ bottomup:
12894          * can happen with large stack limits and large mmap()
12895          * allocations.
12896          */
12897 +       mm->mmap_base = TASK_UNMAPPED_BASE;
12898 +
12899 +#ifdef CONFIG_PAX_RANDMMAP
12900 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
12901 +               mm->mmap_base += mm->delta_mmap;
12902 +#endif
12903 +
12904 +       mm->free_area_cache = mm->mmap_base;
12905         mm->cached_hole_size = ~0UL;
12906 -       mm->free_area_cache = TASK_UNMAPPED_BASE;
12907         addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
12908         /*
12909          * Restore the topdown base:
12910          */
12911 -       mm->free_area_cache = mm->mmap_base;
12912 +       mm->mmap_base = base;
12913 +       mm->free_area_cache = base;
12914         mm->cached_hole_size = ~0UL;
12915
12916         return addr;
12917 diff -urNp linux-2.6.33/arch/x86/kernel/time.c linux-2.6.33/arch/x86/kernel/time.c
12918 --- linux-2.6.33/arch/x86/kernel/time.c 2010-02-24 13:52:17.000000000 -0500
12919 +++ linux-2.6.33/arch/x86/kernel/time.c 2010-03-07 12:23:35.945583410 -0500
12920 @@ -26,17 +26,13 @@
12921  int timer_ack;
12922  #endif
12923
12924 -#ifdef CONFIG_X86_64
12925 -volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
12926 -#endif
12927 -
12928  unsigned long profile_pc(struct pt_regs *regs)
12929  {
12930         unsigned long pc = instruction_pointer(regs);
12931
12932 -       if (!user_mode_vm(regs) && in_lock_functions(pc)) {
12933 +       if (!user_mode(regs) && in_lock_functions(pc)) {
12934  #ifdef CONFIG_FRAME_POINTER
12935 -               return *(unsigned long *)(regs->bp + sizeof(long));
12936 +               return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
12937  #else
12938                 unsigned long *sp =
12939                         (unsigned long *)kernel_stack_pointer(regs);
12940 @@ -45,11 +41,17 @@ unsigned long profile_pc(struct pt_regs
12941                  * or above a saved flags. Eflags has bits 22-31 zero,
12942                  * kernel addresses don't.
12943                  */
12944 +
12945 +#ifdef CONFIG_PAX_KERNEXEC
12946 +               return ktla_ktva(sp[0]);
12947 +#else
12948                 if (sp[0] >> 22)
12949                         return sp[0];
12950                 if (sp[1] >> 22)
12951                         return sp[1];
12952  #endif
12953 +
12954 +#endif
12955         }
12956         return pc;
12957  }
12958 diff -urNp linux-2.6.33/arch/x86/kernel/tls.c linux-2.6.33/arch/x86/kernel/tls.c
12959 --- linux-2.6.33/arch/x86/kernel/tls.c  2010-02-24 13:52:17.000000000 -0500
12960 +++ linux-2.6.33/arch/x86/kernel/tls.c  2010-03-07 12:23:35.945583410 -0500
12961 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
12962         if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
12963                 return -EINVAL;
12964
12965 +#ifdef CONFIG_PAX_SEGMEXEC
12966 +       if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
12967 +               return -EINVAL;
12968 +#endif
12969 +
12970         set_tls_desc(p, idx, &info, 1);
12971
12972         return 0;
12973 diff -urNp linux-2.6.33/arch/x86/kernel/trampoline_32.S linux-2.6.33/arch/x86/kernel/trampoline_32.S
12974 --- linux-2.6.33/arch/x86/kernel/trampoline_32.S        2010-02-24 13:52:17.000000000 -0500
12975 +++ linux-2.6.33/arch/x86/kernel/trampoline_32.S        2010-03-07 12:23:35.945583410 -0500
12976 @@ -32,6 +32,12 @@
12977  #include <asm/segment.h>
12978  #include <asm/page_types.h>
12979
12980 +#ifdef CONFIG_PAX_KERNEXEC
12981 +#define ta(X) (X)
12982 +#else
12983 +#define ta(X) ((X) - __PAGE_OFFSET)
12984 +#endif
12985 +
12986  /* We can free up trampoline after bootup if cpu hotplug is not supported. */
12987  __CPUINITRODATA
12988  .code16
12989 @@ -60,7 +66,7 @@ r_base = .
12990         inc     %ax             # protected mode (PE) bit
12991         lmsw    %ax             # into protected mode
12992         # flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
12993 -       ljmpl   $__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
12994 +       ljmpl   $__BOOT_CS, $ta(startup_32_smp)
12995
12996         # These need to be in the same 64K segment as the above;
12997         # hence we don't use the boot_gdt_descr defined in head.S
12998 diff -urNp linux-2.6.33/arch/x86/kernel/traps.c linux-2.6.33/arch/x86/kernel/traps.c
12999 --- linux-2.6.33/arch/x86/kernel/traps.c        2010-02-24 13:52:17.000000000 -0500
13000 +++ linux-2.6.33/arch/x86/kernel/traps.c        2010-03-07 12:23:35.945583410 -0500
13001 @@ -69,12 +69,6 @@ asmlinkage int system_call(void);
13002
13003  /* Do we ignore FPU interrupts ? */
13004  char ignore_fpu_irq;
13005 -
13006 -/*
13007 - * The IDT has to be page-aligned to simplify the Pentium
13008 - * F0 0F bug workaround.
13009 - */
13010 -gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
13011  #endif
13012
13013  DECLARE_BITMAP(used_vectors, NR_VECTORS);
13014 @@ -112,19 +106,19 @@ static inline void preempt_conditional_c
13015  static inline void
13016  die_if_kernel(const char *str, struct pt_regs *regs, long err)
13017  {
13018 -       if (!user_mode_vm(regs))
13019 +       if (!user_mode(regs))
13020                 die(str, regs, err);
13021  }
13022  #endif
13023
13024  static void __kprobes
13025 -do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
13026 +do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
13027         long error_code, siginfo_t *info)
13028  {
13029         struct task_struct *tsk = current;
13030
13031  #ifdef CONFIG_X86_32
13032 -       if (regs->flags & X86_VM_MASK) {
13033 +       if (v8086_mode(regs)) {
13034                 /*
13035                  * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
13036                  * On nmi (interrupt 2), do_trap should not be called.
13037 @@ -135,7 +129,7 @@ do_trap(int trapnr, int signr, char *str
13038         }
13039  #endif
13040
13041 -       if (!user_mode(regs))
13042 +       if (!user_mode_novm(regs))
13043                 goto kernel_trap;
13044
13045  #ifdef CONFIG_X86_32
13046 @@ -158,7 +152,7 @@ trap_signal:
13047             printk_ratelimit()) {
13048                 printk(KERN_INFO
13049                        "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
13050 -                      tsk->comm, tsk->pid, str,
13051 +                      tsk->comm, task_pid_nr(tsk), str,
13052                        regs->ip, regs->sp, error_code);
13053                 print_vma_addr(" in ", regs->ip);
13054                 printk("\n");
13055 @@ -175,8 +169,20 @@ kernel_trap:
13056         if (!fixup_exception(regs)) {
13057                 tsk->thread.error_code = error_code;
13058                 tsk->thread.trap_no = trapnr;
13059 +
13060 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13061 +               if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
13062 +                       str = "PAX: suspicious stack segment fault";
13063 +#endif
13064 +
13065                 die(str, regs, error_code);
13066         }
13067 +
13068 +#ifdef CONFIG_PAX_REFCOUNT
13069 +       if (trapnr == 4)
13070 +               pax_report_refcount_overflow(regs);
13071 +#endif
13072 +
13073         return;
13074
13075  #ifdef CONFIG_X86_32
13076 @@ -265,14 +271,30 @@ do_general_protection(struct pt_regs *re
13077         conditional_sti(regs);
13078
13079  #ifdef CONFIG_X86_32
13080 -       if (regs->flags & X86_VM_MASK)
13081 +       if (v8086_mode(regs))
13082                 goto gp_in_vm86;
13083  #endif
13084
13085         tsk = current;
13086 -       if (!user_mode(regs))
13087 +       if (!user_mode_novm(regs))
13088                 goto gp_in_kernel;
13089
13090 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
13091 +       if (!(__supported_pte_mask & _PAGE_NX) && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
13092 +               struct mm_struct *mm = tsk->mm;
13093 +               unsigned long limit;
13094 +
13095 +               down_write(&mm->mmap_sem);
13096 +               limit = mm->context.user_cs_limit;
13097 +               if (limit < TASK_SIZE) {
13098 +                       track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
13099 +                       up_write(&mm->mmap_sem);
13100 +                       return;
13101 +               }
13102 +               up_write(&mm->mmap_sem);
13103 +       }
13104 +#endif
13105 +
13106         tsk->thread.error_code = error_code;
13107         tsk->thread.trap_no = 13;
13108
13109 @@ -305,6 +327,13 @@ gp_in_kernel:
13110         if (notify_die(DIE_GPF, "general protection fault", regs,
13111                                 error_code, 13, SIGSEGV) == NOTIFY_STOP)
13112                 return;
13113 +
13114 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13115 +       if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
13116 +               die("PAX: suspicious general protection fault", regs, error_code);
13117 +       else
13118 +#endif
13119 +
13120         die("general protection fault", regs, error_code);
13121  }
13122
13123 @@ -556,7 +585,7 @@ dotraplinkage void __kprobes do_debug(st
13124         /* It's safe to allow irq's after DR6 has been saved */
13125         preempt_conditional_sti(regs);
13126
13127 -       if (regs->flags & X86_VM_MASK) {
13128 +       if (v8086_mode(regs)) {
13129                 handle_vm86_trap((struct kernel_vm86_regs *) regs,
13130                                 error_code, 1);
13131                 return;
13132 @@ -569,7 +598,7 @@ dotraplinkage void __kprobes do_debug(st
13133          * We already checked v86 mode above, so we can check for kernel mode
13134          * by just checking the CPL of CS.
13135          */
13136 -       if ((dr6 & DR_STEP) && !user_mode(regs)) {
13137 +       if ((dr6 & DR_STEP) && !user_mode_novm(regs)) {
13138                 tsk->thread.debugreg6 &= ~DR_STEP;
13139                 set_tsk_thread_flag(tsk, TIF_SINGLESTEP);
13140                 regs->flags &= ~X86_EFLAGS_TF;
13141 @@ -736,7 +765,7 @@ do_simd_coprocessor_error(struct pt_regs
13142          * Handle strange cache flush from user space exception
13143          * in all other cases.  This is undocumented behaviour.
13144          */
13145 -       if (regs->flags & X86_VM_MASK) {
13146 +       if (v8086_mode(regs)) {
13147                 handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
13148                 return;
13149         }
13150 diff -urNp linux-2.6.33/arch/x86/kernel/tsc.c linux-2.6.33/arch/x86/kernel/tsc.c
13151 --- linux-2.6.33/arch/x86/kernel/tsc.c  2010-02-24 13:52:17.000000000 -0500
13152 +++ linux-2.6.33/arch/x86/kernel/tsc.c  2010-03-07 12:23:35.945583410 -0500
13153 @@ -795,7 +795,7 @@ static struct dmi_system_id __initdata b
13154                         DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
13155                 },
13156         },
13157 -       {}
13158 +       { NULL, NULL, {{0, {0}}}, NULL}
13159  };
13160
13161  static void __init check_system_tsc_reliable(void)
13162 diff -urNp linux-2.6.33/arch/x86/kernel/vm86_32.c linux-2.6.33/arch/x86/kernel/vm86_32.c
13163 --- linux-2.6.33/arch/x86/kernel/vm86_32.c      2010-02-24 13:52:17.000000000 -0500
13164 +++ linux-2.6.33/arch/x86/kernel/vm86_32.c      2010-03-07 12:23:35.945583410 -0500
13165 @@ -41,6 +41,7 @@
13166  #include <linux/ptrace.h>
13167  #include <linux/audit.h>
13168  #include <linux/stddef.h>
13169 +#include <linux/grsecurity.h>
13170
13171  #include <asm/uaccess.h>
13172  #include <asm/io.h>
13173 @@ -148,7 +149,7 @@ struct pt_regs *save_v86_state(struct ke
13174                 do_exit(SIGSEGV);
13175         }
13176
13177 -       tss = &per_cpu(init_tss, get_cpu());
13178 +       tss = init_tss + get_cpu();
13179         current->thread.sp0 = current->thread.saved_sp0;
13180         current->thread.sysenter_cs = __KERNEL_CS;
13181         load_sp0(tss, &current->thread);
13182 @@ -207,6 +208,13 @@ int sys_vm86old(struct vm86_struct __use
13183         struct task_struct *tsk;
13184         int tmp, ret = -EPERM;
13185
13186 +#ifdef CONFIG_GRKERNSEC_VM86
13187 +       if (!capable(CAP_SYS_RAWIO)) {
13188 +               gr_handle_vm86();
13189 +               goto out;
13190 +       }
13191 +#endif
13192 +
13193         tsk = current;
13194         if (tsk->thread.saved_sp0)
13195                 goto out;
13196 @@ -237,6 +245,14 @@ int sys_vm86(unsigned long cmd, unsigned
13197         int tmp, ret;
13198         struct vm86plus_struct __user *v86;
13199
13200 +#ifdef CONFIG_GRKERNSEC_VM86
13201 +       if (!capable(CAP_SYS_RAWIO)) {
13202 +               gr_handle_vm86();
13203 +               ret = -EPERM;
13204 +               goto out;
13205 +       }
13206 +#endif
13207 +
13208         tsk = current;
13209         switch (cmd) {
13210         case VM86_REQUEST_IRQ:
13211 @@ -323,7 +339,7 @@ static void do_sys_vm86(struct kernel_vm
13212         tsk->thread.saved_fs = info->regs32->fs;
13213         tsk->thread.saved_gs = get_user_gs(info->regs32);
13214
13215 -       tss = &per_cpu(init_tss, get_cpu());
13216 +       tss = init_tss + get_cpu();
13217         tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
13218         if (cpu_has_sep)
13219                 tsk->thread.sysenter_cs = 0;
13220 @@ -528,7 +544,7 @@ static void do_int(struct kernel_vm86_re
13221                 goto cannot_handle;
13222         if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
13223                 goto cannot_handle;
13224 -       intr_ptr = (unsigned long __user *) (i << 2);
13225 +       intr_ptr = (__force unsigned long __user *) (i << 2);
13226         if (get_user(segoffs, intr_ptr))
13227                 goto cannot_handle;
13228         if ((segoffs >> 16) == BIOSSEG)
13229 diff -urNp linux-2.6.33/arch/x86/kernel/vmi_32.c linux-2.6.33/arch/x86/kernel/vmi_32.c
13230 --- linux-2.6.33/arch/x86/kernel/vmi_32.c       2010-02-24 13:52:17.000000000 -0500
13231 +++ linux-2.6.33/arch/x86/kernel/vmi_32.c       2010-03-07 12:23:35.945583410 -0500
13232 @@ -44,12 +44,17 @@ typedef u32 __attribute__((regparm(1)))
13233  typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
13234
13235  #define call_vrom_func(rom,func) \
13236 -   (((VROMFUNC *)(rom->func))())
13237 +   (((VROMFUNC *)(ktva_ktla(rom.func)))())
13238
13239  #define call_vrom_long_func(rom,func,arg) \
13240 -   (((VROMLONGFUNC *)(rom->func)) (arg))
13241 +({\
13242 +       u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
13243 +       struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
13244 +       __rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
13245 +       __reloc;\
13246 +})
13247
13248 -static struct vrom_header *vmi_rom;
13249 +static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
13250  static int disable_pge;
13251  static int disable_pse;
13252  static int disable_sep;
13253 @@ -76,10 +81,10 @@ static struct {
13254         void (*set_initial_ap_state)(int, int);
13255         void (*halt)(void);
13256         void (*set_lazy_mode)(int mode);
13257 -} vmi_ops;
13258 +} vmi_ops __read_only;
13259
13260  /* Cached VMI operations */
13261 -struct vmi_timer_ops vmi_timer_ops;
13262 +struct vmi_timer_ops vmi_timer_ops __read_only;
13263
13264  /*
13265   * VMI patching routines.
13266 @@ -94,7 +99,7 @@ struct vmi_timer_ops vmi_timer_ops;
13267  static inline void patch_offset(void *insnbuf,
13268                                 unsigned long ip, unsigned long dest)
13269  {
13270 -        *(unsigned long *)(insnbuf+1) = dest-ip-5;
13271 +       *(unsigned long *)(insnbuf+1) = dest-ip-5;
13272  }
13273
13274  static unsigned patch_internal(int call, unsigned len, void *insnbuf,
13275 @@ -102,6 +107,7 @@ static unsigned patch_internal(int call,
13276  {
13277         u64 reloc;
13278         struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
13279 +
13280         reloc = call_vrom_long_func(vmi_rom, get_reloc, call);
13281         switch(rel->type) {
13282                 case VMI_RELOCATION_CALL_REL:
13283 @@ -404,13 +410,13 @@ static void vmi_set_pud(pud_t *pudp, pud
13284
13285  static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
13286  {
13287 -       const pte_t pte = { .pte = 0 };
13288 +       const pte_t pte = __pte(0ULL);
13289         vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
13290  }
13291
13292  static void vmi_pmd_clear(pmd_t *pmd)
13293  {
13294 -       const pte_t pte = { .pte = 0 };
13295 +       const pte_t pte = __pte(0ULL);
13296         vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
13297  }
13298  #endif
13299 @@ -438,8 +444,8 @@ vmi_startup_ipi_hook(int phys_apicid, un
13300         ap.ss = __KERNEL_DS;
13301         ap.esp = (unsigned long) start_esp;
13302
13303 -       ap.ds = __USER_DS;
13304 -       ap.es = __USER_DS;
13305 +       ap.ds = __KERNEL_DS;
13306 +       ap.es = __KERNEL_DS;
13307         ap.fs = __KERNEL_PERCPU;
13308         ap.gs = __KERNEL_STACK_CANARY;
13309
13310 @@ -486,6 +492,18 @@ static void vmi_leave_lazy_mmu(void)
13311         paravirt_leave_lazy_mmu();
13312  }
13313
13314 +#ifdef CONFIG_PAX_KERNEXEC
13315 +static unsigned long vmi_pax_open_kernel(void)
13316 +{
13317 +       return 0;
13318 +}
13319 +
13320 +static unsigned long vmi_pax_close_kernel(void)
13321 +{
13322 +       return 0;
13323 +}
13324 +#endif
13325 +
13326  static inline int __init check_vmi_rom(struct vrom_header *rom)
13327  {
13328         struct pci_header *pci;
13329 @@ -498,6 +516,10 @@ static inline int __init check_vmi_rom(s
13330                 return 0;
13331         if (rom->vrom_signature != VMI_SIGNATURE)
13332                 return 0;
13333 +       if (rom->rom_length * 512 > sizeof(*rom)) {
13334 +               printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
13335 +               return 0;
13336 +       }
13337         if (rom->api_version_maj != VMI_API_REV_MAJOR ||
13338             rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
13339                 printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
13340 @@ -562,7 +584,7 @@ static inline int __init probe_vmi_rom(v
13341                 struct vrom_header *romstart;
13342                 romstart = (struct vrom_header *)isa_bus_to_virt(base);
13343                 if (check_vmi_rom(romstart)) {
13344 -                       vmi_rom = romstart;
13345 +                       vmi_rom = *romstart;
13346                         return 1;
13347                 }
13348         }
13349 @@ -836,6 +858,11 @@ static inline int __init activate_vmi(vo
13350
13351         para_fill(pv_irq_ops.safe_halt, Halt);
13352
13353 +#ifdef CONFIG_PAX_KERNEXEC
13354 +       pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
13355 +       pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
13356 +#endif
13357 +
13358         /*
13359          * Alternative instruction rewriting doesn't happen soon enough
13360          * to convert VMI_IRET to a call instead of a jump; so we have
13361 @@ -853,16 +880,16 @@ static inline int __init activate_vmi(vo
13362
13363  void __init vmi_init(void)
13364  {
13365 -       if (!vmi_rom)
13366 +       if (!vmi_rom.rom_signature)
13367                 probe_vmi_rom();
13368         else
13369 -               check_vmi_rom(vmi_rom);
13370 +               check_vmi_rom(&vmi_rom);
13371
13372         /* In case probing for or validating the ROM failed, basil */
13373 -       if (!vmi_rom)
13374 +       if (!vmi_rom.rom_signature)
13375                 return;
13376
13377 -       reserve_top_address(-vmi_rom->virtual_top);
13378 +       reserve_top_address(-vmi_rom.virtual_top);
13379
13380  #ifdef CONFIG_X86_IO_APIC
13381         /* This is virtual hardware; timer routing is wired correctly */
13382 @@ -874,7 +901,7 @@ void __init vmi_activate(void)
13383  {
13384         unsigned long flags;
13385
13386 -       if (!vmi_rom)
13387 +       if (!vmi_rom.rom_signature)
13388                 return;
13389
13390         local_irq_save(flags);
13391 diff -urNp linux-2.6.33/arch/x86/kernel/vmlinux.lds.S linux-2.6.33/arch/x86/kernel/vmlinux.lds.S
13392 --- linux-2.6.33/arch/x86/kernel/vmlinux.lds.S  2010-02-24 13:52:17.000000000 -0500
13393 +++ linux-2.6.33/arch/x86/kernel/vmlinux.lds.S  2010-03-07 12:23:35.945583410 -0500
13394 @@ -26,6 +26,22 @@
13395  #include <asm/page_types.h>
13396  #include <asm/cache.h>
13397  #include <asm/boot.h>
13398 +#include <asm/segment.h>
13399 +
13400 +#undef PMD_SIZE
13401 +#undef PMD_SHIFT
13402 +#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
13403 +#define PMD_SHIFT 21
13404 +#else
13405 +#define PMD_SHIFT 22
13406 +#endif
13407 +#define PMD_SIZE (1 << PMD_SHIFT)
13408 +
13409 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13410 +#define __KERNEL_TEXT_OFFSET   (LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
13411 +#else
13412 +#define __KERNEL_TEXT_OFFSET   0
13413 +#endif
13414
13415  #undef i386     /* in case the preprocessor is a 32bit one */
13416
13417 @@ -34,13 +50,13 @@ OUTPUT_FORMAT(CONFIG_OUTPUT_FORMAT, CONF
13418  #ifdef CONFIG_X86_32
13419  OUTPUT_ARCH(i386)
13420  ENTRY(phys_startup_32)
13421 -jiffies = jiffies_64;
13422  #else
13423  OUTPUT_ARCH(i386:x86-64)
13424  ENTRY(phys_startup_64)
13425 -jiffies_64 = jiffies;
13426  #endif
13427
13428 +jiffies = jiffies_64;
13429 +
13430  #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
13431  /*
13432   * On 64-bit, align RODATA to 2MB so that even with CONFIG_DEBUG_RODATA
13433 @@ -69,31 +85,46 @@ jiffies_64 = jiffies;
13434
13435  PHDRS {
13436         text PT_LOAD FLAGS(5);          /* R_E */
13437 -       data PT_LOAD FLAGS(7);          /* RWE */
13438 +#ifdef CONFIG_XEN
13439 +       rodata PT_LOAD FLAGS(5);        /* R_E */
13440 +#else
13441 +       rodata PT_LOAD FLAGS(4);        /* R__ */
13442 +#endif
13443 +#ifdef CONFIG_X86_32
13444 +       module PT_LOAD FLAGS(5);        /* R_E */
13445 +#endif
13446 +       data PT_LOAD FLAGS(6);          /* RW_ */
13447  #ifdef CONFIG_X86_64
13448         user PT_LOAD FLAGS(5);          /* R_E */
13449 +#endif
13450 +       init.begin PT_LOAD FLAGS(6);    /* RW_ */
13451  #ifdef CONFIG_SMP
13452         percpu PT_LOAD FLAGS(6);        /* RW_ */
13453  #endif
13454 +       text.init PT_LOAD FLAGS(5);     /* R_E */
13455 +       text.exit PT_LOAD FLAGS(5);     /* R_E */
13456         init PT_LOAD FLAGS(7);          /* RWE */
13457 -#endif
13458         note PT_NOTE FLAGS(0);          /* ___ */
13459  }
13460
13461  SECTIONS
13462  {
13463  #ifdef CONFIG_X86_32
13464 -        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
13465 -        phys_startup_32 = startup_32 - LOAD_OFFSET;
13466 +       . = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
13467  #else
13468 -        . = __START_KERNEL;
13469 -        phys_startup_64 = startup_64 - LOAD_OFFSET;
13470 +       . = __START_KERNEL;
13471  #endif
13472
13473         /* Text and read-only data */
13474 -       .text :  AT(ADDR(.text) - LOAD_OFFSET) {
13475 -               _text = .;
13476 +       .text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
13477                 /* bootstrapping code */
13478 +#ifdef CONFIG_X86_32
13479 +               phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
13480 +#else
13481 +               phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
13482 +#endif
13483 +               __LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
13484 +               _text = .;
13485                 HEAD_TEXT
13486  #ifdef CONFIG_X86_32
13487                 . = ALIGN(PAGE_SIZE);
13488 @@ -108,30 +139,66 @@ SECTIONS
13489                 IRQENTRY_TEXT
13490                 *(.fixup)
13491                 *(.gnu.warning)
13492 -               /* End of text section */
13493 -               _etext = .;
13494         } :text = 0x9090
13495
13496 -       NOTES :text :note
13497 +       . += __KERNEL_TEXT_OFFSET;
13498 +
13499 +       . = ALIGN(PAGE_SIZE);
13500 +       NOTES :rodata :note
13501
13502 -       EXCEPTION_TABLE(16) :text = 0x9090
13503 +       EXCEPTION_TABLE(16) :rodata
13504
13505         X64_ALIGN_DEBUG_RODATA_BEGIN
13506         RO_DATA(PAGE_SIZE)
13507         X64_ALIGN_DEBUG_RODATA_END
13508
13509 +#ifdef CONFIG_X86_32
13510 +       . = ALIGN(PAGE_SIZE);
13511 +       .rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
13512 +               *(.idt)
13513 +               . = ALIGN(PAGE_SIZE);
13514 +               *(.empty_zero_page)
13515 +               *(.swapper_pg_pmd)
13516 +               *(.swapper_pg_dir)
13517 +       }
13518 +
13519 +       . = ALIGN(PAGE_SIZE);
13520 +       .vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
13521 +               *(.vmi.rom)
13522 +       } :module
13523 +
13524 +       . = ALIGN(PAGE_SIZE);
13525 +       .module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
13526 +
13527 +#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
13528 +               MODULES_EXEC_VADDR = .;
13529 +               BYTE(0)
13530 +               . += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
13531 +               . = ALIGN(PMD_SIZE);
13532 +               MODULES_EXEC_END = . - 1;
13533 +#endif
13534 +
13535 +       } :module
13536 +#endif
13537 +
13538         /* Data */
13539         .data : AT(ADDR(.data) - LOAD_OFFSET) {
13540 +               /* End of text section */
13541 +               _etext = . - __KERNEL_TEXT_OFFSET;
13542 +
13543 +#ifdef CONFIG_PAX_KERNEXEC
13544 +       . = ALIGN(PMD_SIZE);
13545 +#else
13546 +       . = ALIGN(PAGE_SIZE);
13547 +#endif
13548 +
13549                 /* Start of data section */
13550                 _sdata = .;
13551
13552                 /* init_task */
13553                 INIT_TASK_DATA(THREAD_SIZE)
13554
13555 -#ifdef CONFIG_X86_32
13556 -               /* 32 bit has nosave before _edata */
13557                 NOSAVE_DATA
13558 -#endif
13559
13560                 PAGE_ALIGNED_DATA(PAGE_SIZE)
13561
13562 @@ -194,12 +261,6 @@ SECTIONS
13563         }
13564         vgetcpu_mode = VVIRT(.vgetcpu_mode);
13565
13566 -       . = ALIGN(L1_CACHE_BYTES);
13567 -       .jiffies : AT(VLOAD(.jiffies)) {
13568 -               *(.jiffies)
13569 -       }
13570 -       jiffies = VVIRT(.jiffies);
13571 -
13572         .vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
13573                 *(.vsyscall_3)
13574         }
13575 @@ -215,12 +276,19 @@ SECTIONS
13576  #endif /* CONFIG_X86_64 */
13577
13578         /* Init code and data - will be freed after init */
13579 -       . = ALIGN(PAGE_SIZE);
13580         .init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
13581 +               BYTE(0)
13582 +
13583 +#ifdef CONFIG_PAX_KERNEXEC
13584 +               . = ALIGN(PMD_SIZE);
13585 +#else
13586 +               . = ALIGN(PAGE_SIZE);
13587 +#endif
13588 +
13589                 __init_begin = .; /* paired with __init_end */
13590 -       }
13591 +       } :init.begin
13592
13593 -#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
13594 +#ifdef CONFIG_SMP
13595         /*
13596          * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
13597          * output PHDR, so the next output section - .init.text - should
13598 @@ -229,12 +297,27 @@ SECTIONS
13599         PERCPU_VADDR(0, :percpu)
13600  #endif
13601
13602 -       INIT_TEXT_SECTION(PAGE_SIZE)
13603 -#ifdef CONFIG_X86_64
13604 -       :init
13605 -#endif
13606 +       . = ALIGN(PAGE_SIZE);
13607 +       init_begin = .;
13608 +       .init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
13609 +               VMLINUX_SYMBOL(_sinittext) = .;
13610 +               INIT_TEXT
13611 +               VMLINUX_SYMBOL(_einittext) = .;
13612 +               . = ALIGN(PAGE_SIZE);
13613 +       } :text.init
13614 +
13615 +       /*
13616 +        * .exit.text is discard at runtime, not link time, to deal with
13617 +        *  references from .altinstructions and .eh_frame
13618 +        */
13619 +       .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
13620 +               EXIT_TEXT
13621 +               . = ALIGN(16);
13622 +       } :text.exit
13623 +       . = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
13624
13625 -       INIT_DATA_SECTION(16)
13626 +       . = ALIGN(PAGE_SIZE);
13627 +       INIT_DATA_SECTION(16) :init
13628
13629         .x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
13630                 __x86_cpu_dev_start = .;
13631 @@ -260,19 +343,11 @@ SECTIONS
13632                 *(.altinstr_replacement)
13633         }
13634
13635 -       /*
13636 -        * .exit.text is discard at runtime, not link time, to deal with
13637 -        *  references from .altinstructions and .eh_frame
13638 -        */
13639 -       .exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
13640 -               EXIT_TEXT
13641 -       }
13642 -
13643         .exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
13644                 EXIT_DATA
13645         }
13646
13647 -#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
13648 +#ifndef CONFIG_SMP
13649         PERCPU(PAGE_SIZE)
13650  #endif
13651
13652 @@ -295,12 +370,6 @@ SECTIONS
13653                 . = ALIGN(PAGE_SIZE);
13654         }
13655
13656 -#ifdef CONFIG_X86_64
13657 -       .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
13658 -               NOSAVE_DATA
13659 -       }
13660 -#endif
13661 -
13662         /* BSS */
13663         . = ALIGN(PAGE_SIZE);
13664         .bss : AT(ADDR(.bss) - LOAD_OFFSET) {
13665 @@ -316,6 +385,7 @@ SECTIONS
13666                 __brk_base = .;
13667                 . += 64 * 1024;         /* 64k alignment slop space */
13668                 *(.brk_reservation)     /* areas brk users have reserved */
13669 +               . = ALIGN(PMD_SIZE);
13670                 __brk_limit = .;
13671         }
13672
13673 @@ -342,13 +412,12 @@ SECTIONS
13674   * for the boot processor.
13675   */
13676  #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
13677 -INIT_PER_CPU(gdt_page);
13678  INIT_PER_CPU(irq_stack_union);
13679
13680  /*
13681   * Build-time check on the image size:
13682   */
13683 -. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
13684 +. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
13685            "kernel image bigger than KERNEL_IMAGE_SIZE");
13686
13687  #ifdef CONFIG_SMP
13688 diff -urNp linux-2.6.33/arch/x86/kernel/vsyscall_64.c linux-2.6.33/arch/x86/kernel/vsyscall_64.c
13689 --- linux-2.6.33/arch/x86/kernel/vsyscall_64.c  2010-02-24 13:52:17.000000000 -0500
13690 +++ linux-2.6.33/arch/x86/kernel/vsyscall_64.c  2010-03-07 12:23:48.697874532 -0500
13691 @@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
13692
13693         write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
13694         /* copy vsyscall data */
13695 +       strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
13696         vsyscall_gtod_data.clock.vread = clock->vread;
13697         vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
13698         vsyscall_gtod_data.clock.mask = clock->mask;
13699 @@ -203,7 +204,7 @@ vgetcpu(unsigned *cpu, unsigned *node, s
13700            We do this here because otherwise user space would do it on
13701            its own in a likely inferior way (no access to jiffies).
13702            If you don't like it pass NULL. */
13703 -       if (tcache && tcache->blob[0] == (j = __jiffies)) {
13704 +       if (tcache && tcache->blob[0] == (j = jiffies)) {
13705                 p = tcache->blob[1];
13706         } else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
13707                 /* Load per CPU data from RDTSCP */
13708 diff -urNp linux-2.6.33/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.33/arch/x86/kernel/x8664_ksyms_64.c
13709 --- linux-2.6.33/arch/x86/kernel/x8664_ksyms_64.c       2010-02-24 13:52:17.000000000 -0500
13710 +++ linux-2.6.33/arch/x86/kernel/x8664_ksyms_64.c       2010-03-07 12:23:35.945583410 -0500
13711 @@ -28,8 +28,6 @@ EXPORT_SYMBOL(__put_user_8);
13712
13713  EXPORT_SYMBOL(copy_user_generic);
13714  EXPORT_SYMBOL(__copy_user_nocache);
13715 -EXPORT_SYMBOL(_copy_from_user);
13716 -EXPORT_SYMBOL(_copy_to_user);
13717
13718  EXPORT_SYMBOL(copy_page);
13719  EXPORT_SYMBOL(clear_page);
13720 diff -urNp linux-2.6.33/arch/x86/kernel/xsave.c linux-2.6.33/arch/x86/kernel/xsave.c
13721 --- linux-2.6.33/arch/x86/kernel/xsave.c        2010-02-24 13:52:17.000000000 -0500
13722 +++ linux-2.6.33/arch/x86/kernel/xsave.c        2010-03-07 12:23:35.945583410 -0500
13723 @@ -54,7 +54,7 @@ int check_for_xstate(struct i387_fxsave_
13724             fx_sw_user->xstate_size > fx_sw_user->extended_size)
13725                 return -1;
13726
13727 -       err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
13728 +       err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
13729                                             fx_sw_user->extended_size -
13730                                             FP_XSTATE_MAGIC2_SIZE));
13731         /*
13732 @@ -196,7 +196,7 @@ fx_only:
13733          * the other extended state.
13734          */
13735         xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
13736 -       return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
13737 +       return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
13738  }
13739
13740  /*
13741 @@ -228,7 +228,7 @@ int restore_i387_xstate(void __user *buf
13742         if (task_thread_info(tsk)->status & TS_XSAVE)
13743                 err = restore_user_xstate(buf);
13744         else
13745 -               err = fxrstor_checking((__force struct i387_fxsave_struct *)
13746 +               err = fxrstor_checking((struct i387_fxsave_struct __user *)
13747                                        buf);
13748         if (unlikely(err)) {
13749                 /*
13750 diff -urNp linux-2.6.33/arch/x86/kvm/emulate.c linux-2.6.33/arch/x86/kvm/emulate.c
13751 --- linux-2.6.33/arch/x86/kvm/emulate.c 2010-02-24 13:52:17.000000000 -0500
13752 +++ linux-2.6.33/arch/x86/kvm/emulate.c 2010-03-07 12:23:35.945583410 -0500
13753 @@ -398,6 +398,7 @@ static u32 group2_table[] = {
13754
13755  #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)     \
13756         do {                                                            \
13757 +               unsigned long _tmp;                                     \
13758                 __asm__ __volatile__ (                                  \
13759                         _PRE_EFLAGS("0", "4", "2")                      \
13760                         _op _suffix " %"_x"3,%1; "                      \
13761 @@ -411,8 +412,6 @@ static u32 group2_table[] = {
13762  /* Raw emulation: instruction has two explicit operands. */
13763  #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
13764         do {                                                            \
13765 -               unsigned long _tmp;                                     \
13766 -                                                                       \
13767                 switch ((_dst).bytes) {                                 \
13768                 case 2:                                                 \
13769                         ____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
13770 @@ -428,7 +427,6 @@ static u32 group2_table[] = {
13771
13772  #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
13773         do {                                                                 \
13774 -               unsigned long _tmp;                                          \
13775                 switch ((_dst).bytes) {                                      \
13776                 case 1:                                                      \
13777                         ____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
13778 diff -urNp linux-2.6.33/arch/x86/kvm/svm.c linux-2.6.33/arch/x86/kvm/svm.c
13779 --- linux-2.6.33/arch/x86/kvm/svm.c     2010-02-24 13:52:17.000000000 -0500
13780 +++ linux-2.6.33/arch/x86/kvm/svm.c     2010-03-07 12:23:35.945583410 -0500
13781 @@ -2428,7 +2428,11 @@ static void reload_tss(struct kvm_vcpu *
13782         int cpu = raw_smp_processor_id();
13783
13784         struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
13785 +
13786 +       pax_open_kernel();
13787         sd->tss_desc->type = 9; /* available 32/64-bit TSS */
13788 +       pax_close_kernel();
13789 +
13790         load_TR_desc();
13791  }
13792
13793 @@ -2910,7 +2914,7 @@ static bool svm_gb_page_enable(void)
13794         return true;
13795  }
13796
13797 -static struct kvm_x86_ops svm_x86_ops = {
13798 +static const struct kvm_x86_ops svm_x86_ops = {
13799         .cpu_has_kvm_support = has_svm,
13800         .disabled_by_bios = is_disabled,
13801         .hardware_setup = svm_hardware_setup,
13802 diff -urNp linux-2.6.33/arch/x86/kvm/vmx.c linux-2.6.33/arch/x86/kvm/vmx.c
13803 --- linux-2.6.33/arch/x86/kvm/vmx.c     2010-02-24 13:52:17.000000000 -0500
13804 +++ linux-2.6.33/arch/x86/kvm/vmx.c     2010-03-07 12:23:35.949701331 -0500
13805 @@ -580,7 +580,11 @@ static void reload_tss(void)
13806
13807         kvm_get_gdt(&gdt);
13808         descs = (void *)gdt.base;
13809 +
13810 +       pax_open_kernel();
13811         descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
13812 +       pax_close_kernel();
13813 +
13814         load_TR_desc();
13815  }
13816
13817 @@ -1383,8 +1387,11 @@ static __init int hardware_setup(void)
13818         if (!cpu_has_vmx_flexpriority())
13819                 flexpriority_enabled = 0;
13820
13821 -       if (!cpu_has_vmx_tpr_shadow())
13822 -               kvm_x86_ops->update_cr8_intercept = NULL;
13823 +       if (!cpu_has_vmx_tpr_shadow()) {
13824 +               pax_open_kernel();
13825 +               *(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
13826 +               pax_close_kernel();
13827 +       }
13828
13829         if (enable_ept && !cpu_has_vmx_ept_2m_page())
13830                 kvm_disable_largepages();
13831 @@ -2355,7 +2362,7 @@ static int vmx_vcpu_setup(struct vcpu_vm
13832         vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
13833
13834         asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
13835 -       vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
13836 +       vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
13837         vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
13838         vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
13839         vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
13840 @@ -3732,6 +3739,12 @@ static void vmx_vcpu_run(struct kvm_vcpu
13841                 "jmp .Lkvm_vmx_return \n\t"
13842                 ".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
13843                 ".Lkvm_vmx_return: "
13844 +
13845 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13846 +               "ljmp %[cs],$.Lkvm_vmx_return2\n\t"
13847 +               ".Lkvm_vmx_return2: "
13848 +#endif
13849 +
13850                 /* Save guest registers, load host registers, keep flags */
13851                 "xchg %0,     (%%"R"sp) \n\t"
13852                 "mov %%"R"ax, %c[rax](%0) \n\t"
13853 @@ -3778,6 +3791,11 @@ static void vmx_vcpu_run(struct kvm_vcpu
13854                 [r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
13855  #endif
13856                 [cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
13857 +
13858 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
13859 +               ,[cs]"i"(__KERNEL_CS)
13860 +#endif
13861 +
13862               : "cc", "memory"
13863                 , R"bx", R"di", R"si"
13864  #ifdef CONFIG_X86_64
13865 @@ -3796,7 +3814,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
13866         if (vmx->rmode.irq.pending)
13867                 fixup_rmode_irq(vmx);
13868
13869 -       asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
13870 +       asm("mov %0, %%ds; mov %0, %%es" : : "r"(__KERNEL_DS));
13871         vmx->launched = 1;
13872
13873         vmx_complete_interrupts(vmx);
13874 @@ -3964,7 +3982,7 @@ static bool vmx_gb_page_enable(void)
13875         return false;
13876  }
13877
13878 -static struct kvm_x86_ops vmx_x86_ops = {
13879 +static const struct kvm_x86_ops vmx_x86_ops = {
13880         .cpu_has_kvm_support = cpu_has_kvm_support,
13881         .disabled_by_bios = vmx_disabled_by_bios,
13882         .hardware_setup = hardware_setup,
13883 diff -urNp linux-2.6.33/arch/x86/kvm/x86.c linux-2.6.33/arch/x86/kvm/x86.c
13884 --- linux-2.6.33/arch/x86/kvm/x86.c     2010-02-24 13:52:17.000000000 -0500
13885 +++ linux-2.6.33/arch/x86/kvm/x86.c     2010-03-07 12:23:35.949701331 -0500
13886 @@ -83,7 +83,7 @@ static void update_cr8_intercept(struct
13887  static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
13888                                     struct kvm_cpuid_entry2 __user *entries);
13889
13890 -struct kvm_x86_ops *kvm_x86_ops;
13891 +const struct kvm_x86_ops *kvm_x86_ops;
13892  EXPORT_SYMBOL_GPL(kvm_x86_ops);
13893
13894  int ignore_msrs = 0;
13895 @@ -109,38 +109,38 @@ static struct kvm_shared_msrs_global __r
13896  static DEFINE_PER_CPU(struct kvm_shared_msrs, shared_msrs);
13897
13898  struct kvm_stats_debugfs_item debugfs_entries[] = {
13899 -       { "pf_fixed", VCPU_STAT(pf_fixed) },
13900 -       { "pf_guest", VCPU_STAT(pf_guest) },
13901 -       { "tlb_flush", VCPU_STAT(tlb_flush) },
13902 -       { "invlpg", VCPU_STAT(invlpg) },
13903 -       { "exits", VCPU_STAT(exits) },
13904 -       { "io_exits", VCPU_STAT(io_exits) },
13905 -       { "mmio_exits", VCPU_STAT(mmio_exits) },
13906 -       { "signal_exits", VCPU_STAT(signal_exits) },
13907 -       { "irq_window", VCPU_STAT(irq_window_exits) },
13908 -       { "nmi_window", VCPU_STAT(nmi_window_exits) },
13909 -       { "halt_exits", VCPU_STAT(halt_exits) },
13910 -       { "halt_wakeup", VCPU_STAT(halt_wakeup) },
13911 -       { "hypercalls", VCPU_STAT(hypercalls) },
13912 -       { "request_irq", VCPU_STAT(request_irq_exits) },
13913 -       { "irq_exits", VCPU_STAT(irq_exits) },
13914 -       { "host_state_reload", VCPU_STAT(host_state_reload) },
13915 -       { "efer_reload", VCPU_STAT(efer_reload) },
13916 -       { "fpu_reload", VCPU_STAT(fpu_reload) },
13917 -       { "insn_emulation", VCPU_STAT(insn_emulation) },
13918 -       { "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
13919 -       { "irq_injections", VCPU_STAT(irq_injections) },
13920 -       { "nmi_injections", VCPU_STAT(nmi_injections) },
13921 -       { "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
13922 -       { "mmu_pte_write", VM_STAT(mmu_pte_write) },
13923 -       { "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
13924 -       { "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
13925 -       { "mmu_flooded", VM_STAT(mmu_flooded) },
13926 -       { "mmu_recycled", VM_STAT(mmu_recycled) },
13927 -       { "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
13928 -       { "mmu_unsync", VM_STAT(mmu_unsync) },
13929 -       { "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
13930 -       { "largepages", VM_STAT(lpages) },
13931 +       { "pf_fixed", VCPU_STAT(pf_fixed), NULL },
13932 +       { "pf_guest", VCPU_STAT(pf_guest), NULL },
13933 +       { "tlb_flush", VCPU_STAT(tlb_flush), NULL },
13934 +       { "invlpg", VCPU_STAT(invlpg), NULL },
13935 +       { "exits", VCPU_STAT(exits), NULL },
13936 +       { "io_exits", VCPU_STAT(io_exits), NULL },
13937 +       { "mmio_exits", VCPU_STAT(mmio_exits), NULL },
13938 +       { "signal_exits", VCPU_STAT(signal_exits), NULL },
13939 +       { "irq_window", VCPU_STAT(irq_window_exits), NULL },
13940 +       { "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
13941 +       { "halt_exits", VCPU_STAT(halt_exits), NULL },
13942 +       { "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
13943 +       { "hypercalls", VCPU_STAT(hypercalls), NULL },
13944 +       { "request_irq", VCPU_STAT(request_irq_exits), NULL },
13945 +       { "irq_exits", VCPU_STAT(irq_exits), NULL },
13946 +       { "host_state_reload", VCPU_STAT(host_state_reload), NULL },
13947 +       { "efer_reload", VCPU_STAT(efer_reload), NULL },
13948 +       { "fpu_reload", VCPU_STAT(fpu_reload), NULL },
13949 +       { "insn_emulation", VCPU_STAT(insn_emulation), NULL },
13950 +       { "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
13951 +       { "irq_injections", VCPU_STAT(irq_injections), NULL },
13952 +       { "nmi_injections", VCPU_STAT(nmi_injections), NULL },
13953 +       { "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
13954 +       { "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
13955 +       { "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
13956 +       { "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
13957 +       { "mmu_flooded", VM_STAT(mmu_flooded), NULL },
13958 +       { "mmu_recycled", VM_STAT(mmu_recycled), NULL },
13959 +       { "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
13960 +       { "mmu_unsync", VM_STAT(mmu_unsync), NULL },
13961 +       { "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
13962 +       { "largepages", VM_STAT(lpages), NULL },
13963         { NULL }
13964  };
13965
13966 @@ -1405,6 +1405,8 @@ long kvm_arch_dev_ioctl(struct file *fil
13967                 if (n < msr_list.nmsrs)
13968                         goto out;
13969                 r = -EFAULT;
13970 +               if (num_msrs_to_save > ARRAY_SIZE(msrs_to_save))
13971 +                       goto out;
13972                 if (copy_to_user(user_msr_list->indices, &msrs_to_save,
13973                                  num_msrs_to_save * sizeof(u32)))
13974                         goto out;
13975 @@ -1787,7 +1789,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
13976  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
13977                                     struct kvm_interrupt *irq)
13978  {
13979 -       if (irq->irq < 0 || irq->irq >= 256)
13980 +       if (irq->irq >= 256)
13981                 return -EINVAL;
13982         if (irqchip_in_kernel(vcpu->kvm))
13983                 return -ENXIO;
13984 @@ -3414,10 +3416,10 @@ static void kvm_timer_init(void)
13985         }
13986  }
13987
13988 -int kvm_arch_init(void *opaque)
13989 +int kvm_arch_init(const void *opaque)
13990  {
13991         int r;
13992 -       struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
13993 +       const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
13994
13995         if (kvm_x86_ops) {
13996                 printk(KERN_ERR "kvm: already loaded the other module\n");
13997 diff -urNp linux-2.6.33/arch/x86/lib/checksum_32.S linux-2.6.33/arch/x86/lib/checksum_32.S
13998 --- linux-2.6.33/arch/x86/lib/checksum_32.S     2010-02-24 13:52:17.000000000 -0500
13999 +++ linux-2.6.33/arch/x86/lib/checksum_32.S     2010-03-07 12:23:35.949701331 -0500
14000 @@ -28,7 +28,8 @@
14001  #include <linux/linkage.h>
14002  #include <asm/dwarf2.h>
14003  #include <asm/errno.h>
14004 -
14005 +#include <asm/segment.h>
14006 +
14007  /*
14008   * computes a partial checksum, e.g. for TCP/UDP fragments
14009   */
14010 @@ -304,9 +305,22 @@ unsigned int csum_partial_copy_generic (
14011
14012  #define ARGBASE 16
14013  #define FP             12
14014 -
14015 -ENTRY(csum_partial_copy_generic)
14016 +
14017 +ENTRY(csum_partial_copy_generic_to_user)
14018         CFI_STARTPROC
14019 +       pushl $(__USER_DS)
14020 +       CFI_ADJUST_CFA_OFFSET 4
14021 +       popl %es
14022 +       CFI_ADJUST_CFA_OFFSET -4
14023 +       jmp csum_partial_copy_generic
14024 +
14025 +ENTRY(csum_partial_copy_generic_from_user)
14026 +       pushl $(__USER_DS)
14027 +       CFI_ADJUST_CFA_OFFSET 4
14028 +       popl %ds
14029 +       CFI_ADJUST_CFA_OFFSET -4
14030 +
14031 +ENTRY(csum_partial_copy_generic)
14032         subl  $4,%esp
14033         CFI_ADJUST_CFA_OFFSET 4
14034         pushl %edi
14035 @@ -331,7 +345,7 @@ ENTRY(csum_partial_copy_generic)
14036         jmp 4f
14037  SRC(1: movw (%esi), %bx        )
14038         addl $2, %esi
14039 -DST(   movw %bx, (%edi)        )
14040 +DST(   movw %bx, %es:(%edi)    )
14041         addl $2, %edi
14042         addw %bx, %ax
14043         adcl $0, %eax
14044 @@ -343,30 +357,30 @@ DST(      movw %bx, (%edi)        )
14045  SRC(1: movl (%esi), %ebx       )
14046  SRC(   movl 4(%esi), %edx      )
14047         adcl %ebx, %eax
14048 -DST(   movl %ebx, (%edi)       )
14049 +DST(   movl %ebx, %es:(%edi)   )
14050         adcl %edx, %eax
14051 -DST(   movl %edx, 4(%edi)      )
14052 +DST(   movl %edx, %es:4(%edi)  )
14053
14054  SRC(   movl 8(%esi), %ebx      )
14055  SRC(   movl 12(%esi), %edx     )
14056         adcl %ebx, %eax
14057 -DST(   movl %ebx, 8(%edi)      )
14058 +DST(   movl %ebx, %es:8(%edi)  )
14059         adcl %edx, %eax
14060 -DST(   movl %edx, 12(%edi)     )
14061 +DST(   movl %edx, %es:12(%edi) )
14062
14063  SRC(   movl 16(%esi), %ebx     )
14064  SRC(   movl 20(%esi), %edx     )
14065         adcl %ebx, %eax
14066 -DST(   movl %ebx, 16(%edi)     )
14067 +DST(   movl %ebx, %es:16(%edi) )
14068         adcl %edx, %eax
14069 -DST(   movl %edx, 20(%edi)     )
14070 +DST(   movl %edx, %es:20(%edi) )
14071
14072  SRC(   movl 24(%esi), %ebx     )
14073  SRC(   movl 28(%esi), %edx     )
14074         adcl %ebx, %eax
14075 -DST(   movl %ebx, 24(%edi)     )
14076 +DST(   movl %ebx, %es:24(%edi) )
14077         adcl %edx, %eax
14078 -DST(   movl %edx, 28(%edi)     )
14079 +DST(   movl %edx, %es:28(%edi) )
14080
14081         lea 32(%esi), %esi
14082         lea 32(%edi), %edi
14083 @@ -380,7 +394,7 @@ DST(        movl %edx, 28(%edi)     )
14084         shrl $2, %edx                   # This clears CF
14085  SRC(3: movl (%esi), %ebx       )
14086         adcl %ebx, %eax
14087 -DST(   movl %ebx, (%edi)       )
14088 +DST(   movl %ebx, %es:(%edi)   )
14089         lea 4(%esi), %esi
14090         lea 4(%edi), %edi
14091         dec %edx
14092 @@ -392,12 +406,12 @@ DST(      movl %ebx, (%edi)       )
14093         jb 5f
14094  SRC(   movw (%esi), %cx        )
14095         leal 2(%esi), %esi
14096 -DST(   movw %cx, (%edi)        )
14097 +DST(   movw %cx, %es:(%edi)    )
14098         leal 2(%edi), %edi
14099         je 6f
14100         shll $16,%ecx
14101  SRC(5: movb (%esi), %cl        )
14102 -DST(   movb %cl, (%edi)        )
14103 +DST(   movb %cl, %es:(%edi)    )
14104  6:     addl %ecx, %eax
14105         adcl $0, %eax
14106  7:
14107 @@ -408,7 +422,7 @@ DST(        movb %cl, (%edi)        )
14108
14109  6001:
14110         movl ARGBASE+20(%esp), %ebx     # src_err_ptr
14111 -       movl $-EFAULT, (%ebx)
14112 +       movl $-EFAULT, %ss:(%ebx)
14113
14114         # zero the complete destination - computing the rest
14115         # is too much work
14116 @@ -421,11 +435,19 @@ DST(      movb %cl, (%edi)        )
14117
14118  6002:
14119         movl ARGBASE+24(%esp), %ebx     # dst_err_ptr
14120 -       movl $-EFAULT,(%ebx)
14121 +       movl $-EFAULT,%ss:(%ebx)
14122         jmp 5000b
14123
14124  .previous
14125
14126 +       pushl %ss
14127 +       CFI_ADJUST_CFA_OFFSET 4
14128 +       popl %ds
14129 +       CFI_ADJUST_CFA_OFFSET -4
14130 +       pushl %ss
14131 +       CFI_ADJUST_CFA_OFFSET 4
14132 +       popl %es
14133 +       CFI_ADJUST_CFA_OFFSET -4
14134         popl %ebx
14135         CFI_ADJUST_CFA_OFFSET -4
14136         CFI_RESTORE ebx
14137 @@ -439,26 +461,41 @@ DST(      movb %cl, (%edi)        )
14138         CFI_ADJUST_CFA_OFFSET -4
14139         ret
14140         CFI_ENDPROC
14141 -ENDPROC(csum_partial_copy_generic)
14142 +ENDPROC(csum_partial_copy_generic_to_user)
14143
14144  #else
14145
14146  /* Version for PentiumII/PPro */
14147
14148  #define ROUND1(x) \
14149 +       nop; nop; nop;                          \
14150         SRC(movl x(%esi), %ebx  )       ;       \
14151         addl %ebx, %eax                 ;       \
14152 -       DST(movl %ebx, x(%edi)  )       ;
14153 +       DST(movl %ebx, %es:x(%edi))     ;
14154
14155  #define ROUND(x) \
14156 +       nop; nop; nop;                          \
14157         SRC(movl x(%esi), %ebx  )       ;       \
14158         adcl %ebx, %eax                 ;       \
14159 -       DST(movl %ebx, x(%edi)  )       ;
14160 +       DST(movl %ebx, %es:x(%edi))     ;
14161
14162  #define ARGBASE 12
14163 -
14164 -ENTRY(csum_partial_copy_generic)
14165 +
14166 +ENTRY(csum_partial_copy_generic_to_user)
14167         CFI_STARTPROC
14168 +       pushl $(__USER_DS)
14169 +       CFI_ADJUST_CFA_OFFSET 4
14170 +       popl %es
14171 +       CFI_ADJUST_CFA_OFFSET -4
14172 +       jmp csum_partial_copy_generic
14173 +
14174 +ENTRY(csum_partial_copy_generic_from_user)
14175 +       pushl $(__USER_DS)
14176 +       CFI_ADJUST_CFA_OFFSET 4
14177 +       popl %ds
14178 +       CFI_ADJUST_CFA_OFFSET -4
14179 +
14180 +ENTRY(csum_partial_copy_generic)
14181         pushl %ebx
14182         CFI_ADJUST_CFA_OFFSET 4
14183         CFI_REL_OFFSET ebx, 0
14184 @@ -482,7 +519,7 @@ ENTRY(csum_partial_copy_generic)
14185         subl %ebx, %edi
14186         lea  -1(%esi),%edx
14187         andl $-32,%edx
14188 -       lea 3f(%ebx,%ebx), %ebx
14189 +       lea 3f(%ebx,%ebx,2), %ebx
14190         testl %esi, %esi
14191         jmp *%ebx
14192  1:     addl $64,%esi
14193 @@ -503,19 +540,19 @@ ENTRY(csum_partial_copy_generic)
14194         jb 5f
14195  SRC(   movw (%esi), %dx         )
14196         leal 2(%esi), %esi
14197 -DST(   movw %dx, (%edi)         )
14198 +DST(   movw %dx, %es:(%edi)     )
14199         leal 2(%edi), %edi
14200         je 6f
14201         shll $16,%edx
14202  5:
14203  SRC(   movb (%esi), %dl         )
14204 -DST(   movb %dl, (%edi)         )
14205 +DST(   movb %dl, %es:(%edi)     )
14206  6:     addl %edx, %eax
14207         adcl $0, %eax
14208  7:
14209  .section .fixup, "ax"
14210  6001:  movl    ARGBASE+20(%esp), %ebx  # src_err_ptr
14211 -       movl $-EFAULT, (%ebx)
14212 +       movl $-EFAULT, %ss:(%ebx)
14213         # zero the complete destination (computing the rest is too much work)
14214         movl ARGBASE+8(%esp),%edi       # dst
14215         movl ARGBASE+12(%esp),%ecx      # len
14216 @@ -523,10 +560,18 @@ DST(      movb %dl, (%edi)         )
14217         rep; stosb
14218         jmp 7b
14219  6002:  movl ARGBASE+24(%esp), %ebx     # dst_err_ptr
14220 -       movl $-EFAULT, (%ebx)
14221 +       movl $-EFAULT, %ss:(%ebx)
14222         jmp  7b
14223  .previous
14224
14225 +       pushl %ss
14226 +       CFI_ADJUST_CFA_OFFSET 4
14227 +       popl %ds
14228 +       CFI_ADJUST_CFA_OFFSET -4
14229 +       pushl %ss
14230 +       CFI_ADJUST_CFA_OFFSET 4
14231 +       popl %es
14232 +       CFI_ADJUST_CFA_OFFSET -4
14233         popl %esi
14234         CFI_ADJUST_CFA_OFFSET -4
14235         CFI_RESTORE esi
14236 @@ -538,7 +583,7 @@ DST(        movb %dl, (%edi)         )
14237         CFI_RESTORE ebx
14238         ret
14239         CFI_ENDPROC
14240 -ENDPROC(csum_partial_copy_generic)
14241 +ENDPROC(csum_partial_copy_generic_to_user)
14242
14243  #undef ROUND
14244  #undef ROUND1
14245 diff -urNp linux-2.6.33/arch/x86/lib/clear_page_64.S linux-2.6.33/arch/x86/lib/clear_page_64.S
14246 --- linux-2.6.33/arch/x86/lib/clear_page_64.S   2010-02-24 13:52:17.000000000 -0500
14247 +++ linux-2.6.33/arch/x86/lib/clear_page_64.S   2010-03-07 12:23:35.949701331 -0500
14248 @@ -43,7 +43,7 @@ ENDPROC(clear_page)
14249
14250  #include <asm/cpufeature.h>
14251
14252 -       .section .altinstr_replacement,"ax"
14253 +       .section .altinstr_replacement,"a"
14254  1:     .byte 0xeb                                      /* jmp <disp8> */
14255         .byte (clear_page_c - clear_page) - (2f - 1b)   /* offset */
14256  2:
14257 diff -urNp linux-2.6.33/arch/x86/lib/copy_page_64.S linux-2.6.33/arch/x86/lib/copy_page_64.S
14258 --- linux-2.6.33/arch/x86/lib/copy_page_64.S    2010-02-24 13:52:17.000000000 -0500
14259 +++ linux-2.6.33/arch/x86/lib/copy_page_64.S    2010-03-07 12:23:35.949701331 -0500
14260 @@ -104,7 +104,7 @@ ENDPROC(copy_page)
14261
14262  #include <asm/cpufeature.h>
14263
14264 -       .section .altinstr_replacement,"ax"
14265 +       .section .altinstr_replacement,"a"
14266  1:     .byte 0xeb                                      /* jmp <disp8> */
14267         .byte (copy_page_c - copy_page) - (2f - 1b)     /* offset */
14268  2:
14269 diff -urNp linux-2.6.33/arch/x86/lib/copy_user_64.S linux-2.6.33/arch/x86/lib/copy_user_64.S
14270 --- linux-2.6.33/arch/x86/lib/copy_user_64.S    2010-02-24 13:52:17.000000000 -0500
14271 +++ linux-2.6.33/arch/x86/lib/copy_user_64.S    2010-03-07 12:23:35.949701331 -0500
14272 @@ -21,7 +21,7 @@
14273         .byte 0xe9      /* 32bit jump */
14274         .long \orig-1f  /* by default jump to orig */
14275  1:
14276 -       .section .altinstr_replacement,"ax"
14277 +       .section .altinstr_replacement,"a"
14278  2:     .byte 0xe9                      /* near jump with 32bit immediate */
14279         .long \alt-1b /* offset */   /* or alternatively to alt */
14280         .previous
14281 @@ -64,32 +64,6 @@
14282  #endif
14283         .endm
14284
14285 -/* Standard copy_to_user with segment limit checking */
14286 -ENTRY(_copy_to_user)
14287 -       CFI_STARTPROC
14288 -       GET_THREAD_INFO(%rax)
14289 -       movq %rdi,%rcx
14290 -       addq %rdx,%rcx
14291 -       jc bad_to_user
14292 -       cmpq TI_addr_limit(%rax),%rcx
14293 -       jae bad_to_user
14294 -       ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
14295 -       CFI_ENDPROC
14296 -ENDPROC(_copy_to_user)
14297 -
14298 -/* Standard copy_from_user with segment limit checking */
14299 -ENTRY(_copy_from_user)
14300 -       CFI_STARTPROC
14301 -       GET_THREAD_INFO(%rax)
14302 -       movq %rsi,%rcx
14303 -       addq %rdx,%rcx
14304 -       jc bad_from_user
14305 -       cmpq TI_addr_limit(%rax),%rcx
14306 -       jae bad_from_user
14307 -       ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
14308 -       CFI_ENDPROC
14309 -ENDPROC(_copy_from_user)
14310 -
14311  ENTRY(copy_user_generic)
14312         CFI_STARTPROC
14313         ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
14314 @@ -101,6 +75,8 @@ ENDPROC(copy_user_generic)
14315  ENTRY(bad_from_user)
14316  bad_from_user:
14317         CFI_STARTPROC
14318 +       testl %edx,%edx
14319 +       js bad_to_user
14320         movl %edx,%ecx
14321         xorl %eax,%eax
14322         rep
14323 diff -urNp linux-2.6.33/arch/x86/lib/getuser.S linux-2.6.33/arch/x86/lib/getuser.S
14324 --- linux-2.6.33/arch/x86/lib/getuser.S 2010-02-24 13:52:17.000000000 -0500
14325 +++ linux-2.6.33/arch/x86/lib/getuser.S 2010-03-07 12:23:35.949701331 -0500
14326 @@ -33,14 +33,28 @@
14327  #include <asm/asm-offsets.h>
14328  #include <asm/thread_info.h>
14329  #include <asm/asm.h>
14330 +#include <asm/segment.h>
14331
14332         .text
14333  ENTRY(__get_user_1)
14334         CFI_STARTPROC
14335 +
14336 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14337 +       pushl $(__USER_DS)
14338 +       popl %ds
14339 +#else
14340         GET_THREAD_INFO(%_ASM_DX)
14341         cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
14342         jae bad_get_user
14343 +#endif
14344 +
14345  1:     movzb (%_ASM_AX),%edx
14346 +
14347 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14348 +       pushl %ss
14349 +       pop %ds
14350 +#endif
14351 +
14352         xor %eax,%eax
14353         ret
14354         CFI_ENDPROC
14355 @@ -49,11 +63,24 @@ ENDPROC(__get_user_1)
14356  ENTRY(__get_user_2)
14357         CFI_STARTPROC
14358         add $1,%_ASM_AX
14359 +
14360 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14361 +       pushl $(__USER_DS)
14362 +       popl %ds
14363 +#else
14364         jc bad_get_user
14365         GET_THREAD_INFO(%_ASM_DX)
14366         cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
14367         jae bad_get_user
14368 +#endif
14369 +
14370  2:     movzwl -1(%_ASM_AX),%edx
14371 +
14372 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14373 +       pushl %ss
14374 +       pop %ds
14375 +#endif
14376 +
14377         xor %eax,%eax
14378         ret
14379         CFI_ENDPROC
14380 @@ -62,11 +89,24 @@ ENDPROC(__get_user_2)
14381  ENTRY(__get_user_4)
14382         CFI_STARTPROC
14383         add $3,%_ASM_AX
14384 +
14385 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14386 +       pushl $(__USER_DS)
14387 +       popl %ds
14388 +#else
14389         jc bad_get_user
14390         GET_THREAD_INFO(%_ASM_DX)
14391         cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
14392         jae bad_get_user
14393 +#endif
14394 +
14395  3:     mov -3(%_ASM_AX),%edx
14396 +
14397 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14398 +       pushl %ss
14399 +       pop %ds
14400 +#endif
14401 +
14402         xor %eax,%eax
14403         ret
14404         CFI_ENDPROC
14405 @@ -89,6 +129,12 @@ ENDPROC(__get_user_8)
14406
14407  bad_get_user:
14408         CFI_STARTPROC
14409 +
14410 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
14411 +       pushl %ss
14412 +       pop %ds
14413 +#endif
14414 +
14415         xor %edx,%edx
14416         mov $(-EFAULT),%_ASM_AX
14417         ret
14418 diff -urNp linux-2.6.33/arch/x86/lib/memcpy_64.S linux-2.6.33/arch/x86/lib/memcpy_64.S
14419 --- linux-2.6.33/arch/x86/lib/memcpy_64.S       2010-02-24 13:52:17.000000000 -0500
14420 +++ linux-2.6.33/arch/x86/lib/memcpy_64.S       2010-03-07 12:23:35.949701331 -0500
14421 @@ -128,7 +128,7 @@ ENDPROC(__memcpy)
14422          * It is also a lot simpler. Use this when possible:
14423          */
14424
14425 -       .section .altinstr_replacement, "ax"
14426 +       .section .altinstr_replacement, "a"
14427  1:     .byte 0xeb                              /* jmp <disp8> */
14428         .byte (memcpy_c - memcpy) - (2f - 1b)   /* offset */
14429  2:
14430 diff -urNp linux-2.6.33/arch/x86/lib/memset_64.S linux-2.6.33/arch/x86/lib/memset_64.S
14431 --- linux-2.6.33/arch/x86/lib/memset_64.S       2010-02-24 13:52:17.000000000 -0500
14432 +++ linux-2.6.33/arch/x86/lib/memset_64.S       2010-03-07 12:23:35.949701331 -0500
14433 @@ -118,7 +118,7 @@ ENDPROC(__memset)
14434
14435  #include <asm/cpufeature.h>
14436
14437 -       .section .altinstr_replacement,"ax"
14438 +       .section .altinstr_replacement,"a"
14439  1:     .byte 0xeb                              /* jmp <disp8> */
14440         .byte (memset_c - memset) - (2f - 1b)   /* offset */
14441  2:
14442 diff -urNp linux-2.6.33/arch/x86/lib/mmx_32.c linux-2.6.33/arch/x86/lib/mmx_32.c
14443 --- linux-2.6.33/arch/x86/lib/mmx_32.c  2010-02-24 13:52:17.000000000 -0500
14444 +++ linux-2.6.33/arch/x86/lib/mmx_32.c  2010-03-07 12:23:35.949701331 -0500
14445 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
14446  {
14447         void *p;
14448         int i;
14449 +       unsigned long cr0;
14450
14451         if (unlikely(in_interrupt()))
14452                 return __memcpy(to, from, len);
14453 @@ -39,44 +40,72 @@ void *_mmx_memcpy(void *to, const void *
14454         kernel_fpu_begin();
14455
14456         __asm__ __volatile__ (
14457 -               "1: prefetch (%0)\n"            /* This set is 28 bytes */
14458 -               "   prefetch 64(%0)\n"
14459 -               "   prefetch 128(%0)\n"
14460 -               "   prefetch 192(%0)\n"
14461 -               "   prefetch 256(%0)\n"
14462 +               "1: prefetch (%1)\n"            /* This set is 28 bytes */
14463 +               "   prefetch 64(%1)\n"
14464 +               "   prefetch 128(%1)\n"
14465 +               "   prefetch 192(%1)\n"
14466 +               "   prefetch 256(%1)\n"
14467                 "2:  \n"
14468                 ".section .fixup, \"ax\"\n"
14469 -               "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14470 +               "3:  \n"
14471 +
14472 +#ifdef CONFIG_PAX_KERNEXEC
14473 +               "   movl %%cr0, %0\n"
14474 +               "   movl %0, %%eax\n"
14475 +               "   andl $0xFFFEFFFF, %%eax\n"
14476 +               "   movl %%eax, %%cr0\n"
14477 +#endif
14478 +
14479 +               "   movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14480 +
14481 +#ifdef CONFIG_PAX_KERNEXEC
14482 +               "   movl %0, %%cr0\n"
14483 +#endif
14484 +
14485                 "   jmp 2b\n"
14486                 ".previous\n"
14487                         _ASM_EXTABLE(1b, 3b)
14488 -                       : : "r" (from));
14489 +                       : "=&r" (cr0) : "r" (from) : "ax");
14490
14491         for ( ; i > 5; i--) {
14492                 __asm__ __volatile__ (
14493 -               "1:  prefetch 320(%0)\n"
14494 -               "2:  movq (%0), %%mm0\n"
14495 -               "  movq 8(%0), %%mm1\n"
14496 -               "  movq 16(%0), %%mm2\n"
14497 -               "  movq 24(%0), %%mm3\n"
14498 -               "  movq %%mm0, (%1)\n"
14499 -               "  movq %%mm1, 8(%1)\n"
14500 -               "  movq %%mm2, 16(%1)\n"
14501 -               "  movq %%mm3, 24(%1)\n"
14502 -               "  movq 32(%0), %%mm0\n"
14503 -               "  movq 40(%0), %%mm1\n"
14504 -               "  movq 48(%0), %%mm2\n"
14505 -               "  movq 56(%0), %%mm3\n"
14506 -               "  movq %%mm0, 32(%1)\n"
14507 -               "  movq %%mm1, 40(%1)\n"
14508 -               "  movq %%mm2, 48(%1)\n"
14509 -               "  movq %%mm3, 56(%1)\n"
14510 +               "1:  prefetch 320(%1)\n"
14511 +               "2:  movq (%1), %%mm0\n"
14512 +               "  movq 8(%1), %%mm1\n"
14513 +               "  movq 16(%1), %%mm2\n"
14514 +               "  movq 24(%1), %%mm3\n"
14515 +               "  movq %%mm0, (%2)\n"
14516 +               "  movq %%mm1, 8(%2)\n"
14517 +               "  movq %%mm2, 16(%2)\n"
14518 +               "  movq %%mm3, 24(%2)\n"
14519 +               "  movq 32(%1), %%mm0\n"
14520 +               "  movq 40(%1), %%mm1\n"
14521 +               "  movq 48(%1), %%mm2\n"
14522 +               "  movq 56(%1), %%mm3\n"
14523 +               "  movq %%mm0, 32(%2)\n"
14524 +               "  movq %%mm1, 40(%2)\n"
14525 +               "  movq %%mm2, 48(%2)\n"
14526 +               "  movq %%mm3, 56(%2)\n"
14527                 ".section .fixup, \"ax\"\n"
14528 -               "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14529 +               "3:\n"
14530 +
14531 +#ifdef CONFIG_PAX_KERNEXEC
14532 +               "   movl %%cr0, %0\n"
14533 +               "   movl %0, %%eax\n"
14534 +               "   andl $0xFFFEFFFF, %%eax\n"
14535 +               "   movl %%eax, %%cr0\n"
14536 +#endif
14537 +
14538 +               "   movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14539 +
14540 +#ifdef CONFIG_PAX_KERNEXEC
14541 +               "   movl %0, %%cr0\n"
14542 +#endif
14543 +
14544                 "   jmp 2b\n"
14545                 ".previous\n"
14546                         _ASM_EXTABLE(1b, 3b)
14547 -                       : : "r" (from), "r" (to) : "memory");
14548 +                       : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
14549
14550                 from += 64;
14551                 to += 64;
14552 @@ -158,6 +187,7 @@ static void fast_clear_page(void *page)
14553  static void fast_copy_page(void *to, void *from)
14554  {
14555         int i;
14556 +       unsigned long cr0;
14557
14558         kernel_fpu_begin();
14559
14560 @@ -166,42 +196,70 @@ static void fast_copy_page(void *to, voi
14561          * but that is for later. -AV
14562          */
14563         __asm__ __volatile__(
14564 -               "1: prefetch (%0)\n"
14565 -               "   prefetch 64(%0)\n"
14566 -               "   prefetch 128(%0)\n"
14567 -               "   prefetch 192(%0)\n"
14568 -               "   prefetch 256(%0)\n"
14569 +               "1: prefetch (%1)\n"
14570 +               "   prefetch 64(%1)\n"
14571 +               "   prefetch 128(%1)\n"
14572 +               "   prefetch 192(%1)\n"
14573 +               "   prefetch 256(%1)\n"
14574                 "2:  \n"
14575                 ".section .fixup, \"ax\"\n"
14576 -               "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14577 +               "3:  \n"
14578 +
14579 +#ifdef CONFIG_PAX_KERNEXEC
14580 +               "   movl %%cr0, %0\n"
14581 +               "   movl %0, %%eax\n"
14582 +               "   andl $0xFFFEFFFF, %%eax\n"
14583 +               "   movl %%eax, %%cr0\n"
14584 +#endif
14585 +
14586 +               "   movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14587 +
14588 +#ifdef CONFIG_PAX_KERNEXEC
14589 +               "   movl %0, %%cr0\n"
14590 +#endif
14591 +
14592                 "   jmp 2b\n"
14593                 ".previous\n"
14594 -                       _ASM_EXTABLE(1b, 3b) : : "r" (from));
14595 +                       _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
14596
14597         for (i = 0; i < (4096-320)/64; i++) {
14598                 __asm__ __volatile__ (
14599 -               "1: prefetch 320(%0)\n"
14600 -               "2: movq (%0), %%mm0\n"
14601 -               "   movntq %%mm0, (%1)\n"
14602 -               "   movq 8(%0), %%mm1\n"
14603 -               "   movntq %%mm1, 8(%1)\n"
14604 -               "   movq 16(%0), %%mm2\n"
14605 -               "   movntq %%mm2, 16(%1)\n"
14606 -               "   movq 24(%0), %%mm3\n"
14607 -               "   movntq %%mm3, 24(%1)\n"
14608 -               "   movq 32(%0), %%mm4\n"
14609 -               "   movntq %%mm4, 32(%1)\n"
14610 -               "   movq 40(%0), %%mm5\n"
14611 -               "   movntq %%mm5, 40(%1)\n"
14612 -               "   movq 48(%0), %%mm6\n"
14613 -               "   movntq %%mm6, 48(%1)\n"
14614 -               "   movq 56(%0), %%mm7\n"
14615 -               "   movntq %%mm7, 56(%1)\n"
14616 +               "1: prefetch 320(%1)\n"
14617 +               "2: movq (%1), %%mm0\n"
14618 +               "   movntq %%mm0, (%2)\n"
14619 +               "   movq 8(%1), %%mm1\n"
14620 +               "   movntq %%mm1, 8(%2)\n"
14621 +               "   movq 16(%1), %%mm2\n"
14622 +               "   movntq %%mm2, 16(%2)\n"
14623 +               "   movq 24(%1), %%mm3\n"
14624 +               "   movntq %%mm3, 24(%2)\n"
14625 +               "   movq 32(%1), %%mm4\n"
14626 +               "   movntq %%mm4, 32(%2)\n"
14627 +               "   movq 40(%1), %%mm5\n"
14628 +               "   movntq %%mm5, 40(%2)\n"
14629 +               "   movq 48(%1), %%mm6\n"
14630 +               "   movntq %%mm6, 48(%2)\n"
14631 +               "   movq 56(%1), %%mm7\n"
14632 +               "   movntq %%mm7, 56(%2)\n"
14633                 ".section .fixup, \"ax\"\n"
14634 -               "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14635 +               "3:\n"
14636 +
14637 +#ifdef CONFIG_PAX_KERNEXEC
14638 +               "   movl %%cr0, %0\n"
14639 +               "   movl %0, %%eax\n"
14640 +               "   andl $0xFFFEFFFF, %%eax\n"
14641 +               "   movl %%eax, %%cr0\n"
14642 +#endif
14643 +
14644 +               "   movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14645 +
14646 +#ifdef CONFIG_PAX_KERNEXEC
14647 +               "   movl %0, %%cr0\n"
14648 +#endif
14649 +
14650                 "   jmp 2b\n"
14651                 ".previous\n"
14652 -               _ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
14653 +               _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
14654
14655                 from += 64;
14656                 to += 64;
14657 @@ -280,47 +338,76 @@ static void fast_clear_page(void *page)
14658  static void fast_copy_page(void *to, void *from)
14659  {
14660         int i;
14661 +       unsigned long cr0;
14662
14663         kernel_fpu_begin();
14664
14665         __asm__ __volatile__ (
14666 -               "1: prefetch (%0)\n"
14667 -               "   prefetch 64(%0)\n"
14668 -               "   prefetch 128(%0)\n"
14669 -               "   prefetch 192(%0)\n"
14670 -               "   prefetch 256(%0)\n"
14671 +               "1: prefetch (%1)\n"
14672 +               "   prefetch 64(%1)\n"
14673 +               "   prefetch 128(%1)\n"
14674 +               "   prefetch 192(%1)\n"
14675 +               "   prefetch 256(%1)\n"
14676                 "2:  \n"
14677                 ".section .fixup, \"ax\"\n"
14678 -               "3: movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14679 +               "3:  \n"
14680 +
14681 +#ifdef CONFIG_PAX_KERNEXEC
14682 +               "   movl %%cr0, %0\n"
14683 +               "   movl %0, %%eax\n"
14684 +               "   andl $0xFFFEFFFF, %%eax\n"
14685 +               "   movl %%eax, %%cr0\n"
14686 +#endif
14687 +
14688 +               "   movw $0x1AEB, 1b\n" /* jmp on 26 bytes */
14689 +
14690 +#ifdef CONFIG_PAX_KERNEXEC
14691 +               "   movl %0, %%cr0\n"
14692 +#endif
14693 +
14694                 "   jmp 2b\n"
14695                 ".previous\n"
14696 -                       _ASM_EXTABLE(1b, 3b) : : "r" (from));
14697 +                       _ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
14698
14699         for (i = 0; i < 4096/64; i++) {
14700                 __asm__ __volatile__ (
14701 -               "1: prefetch 320(%0)\n"
14702 -               "2: movq (%0), %%mm0\n"
14703 -               "   movq 8(%0), %%mm1\n"
14704 -               "   movq 16(%0), %%mm2\n"
14705 -               "   movq 24(%0), %%mm3\n"
14706 -               "   movq %%mm0, (%1)\n"
14707 -               "   movq %%mm1, 8(%1)\n"
14708 -               "   movq %%mm2, 16(%1)\n"
14709 -               "   movq %%mm3, 24(%1)\n"
14710 -               "   movq 32(%0), %%mm0\n"
14711 -               "   movq 40(%0), %%mm1\n"
14712 -               "   movq 48(%0), %%mm2\n"
14713 -               "   movq 56(%0), %%mm3\n"
14714 -               "   movq %%mm0, 32(%1)\n"
14715 -               "   movq %%mm1, 40(%1)\n"
14716 -               "   movq %%mm2, 48(%1)\n"
14717 -               "   movq %%mm3, 56(%1)\n"
14718 +               "1: prefetch 320(%1)\n"
14719 +               "2: movq (%1), %%mm0\n"
14720 +               "   movq 8(%1), %%mm1\n"
14721 +               "   movq 16(%1), %%mm2\n"
14722 +               "   movq 24(%1), %%mm3\n"
14723 +               "   movq %%mm0, (%2)\n"
14724 +               "   movq %%mm1, 8(%2)\n"
14725 +               "   movq %%mm2, 16(%2)\n"
14726 +               "   movq %%mm3, 24(%2)\n"
14727 +               "   movq 32(%1), %%mm0\n"
14728 +               "   movq 40(%1), %%mm1\n"
14729 +               "   movq 48(%1), %%mm2\n"
14730 +               "   movq 56(%1), %%mm3\n"
14731 +               "   movq %%mm0, 32(%2)\n"
14732 +               "   movq %%mm1, 40(%2)\n"
14733 +               "   movq %%mm2, 48(%2)\n"
14734 +               "   movq %%mm3, 56(%2)\n"
14735                 ".section .fixup, \"ax\"\n"
14736 -               "3: movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14737 +               "3:\n"
14738 +
14739 +#ifdef CONFIG_PAX_KERNEXEC
14740 +               "   movl %%cr0, %0\n"
14741 +               "   movl %0, %%eax\n"
14742 +               "   andl $0xFFFEFFFF, %%eax\n"
14743 +               "   movl %%eax, %%cr0\n"
14744 +#endif
14745 +
14746 +               "   movw $0x05EB, 1b\n" /* jmp on 5 bytes */
14747 +
14748 +#ifdef CONFIG_PAX_KERNEXEC
14749 +               "   movl %0, %%cr0\n"
14750 +#endif
14751 +
14752                 "   jmp 2b\n"
14753                 ".previous\n"
14754                         _ASM_EXTABLE(1b, 3b)
14755 -                       : : "r" (from), "r" (to) : "memory");
14756 +                       : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
14757
14758                 from += 64;
14759                 to += 64;
14760 diff -urNp linux-2.6.33/arch/x86/lib/putuser.S linux-2.6.33/arch/x86/lib/putuser.S
14761 --- linux-2.6.33/arch/x86/lib/putuser.S 2010-02-24 13:52:17.000000000 -0500
14762 +++ linux-2.6.33/arch/x86/lib/putuser.S 2010-03-07 12:23:35.949701331 -0500
14763 @@ -15,6 +15,7 @@
14764  #include <asm/thread_info.h>
14765  #include <asm/errno.h>
14766  #include <asm/asm.h>
14767 +#include <asm/segment.h>
14768
14769
14770  /*
14771 @@ -39,7 +40,19 @@ ENTRY(__put_user_1)
14772         ENTER
14773         cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
14774         jae bad_put_user
14775 +
14776 +#ifdef CONFIG_X86_32
14777 +       pushl $(__USER_DS)
14778 +       popl %ds
14779 +#endif
14780 +
14781  1:     movb %al,(%_ASM_CX)
14782 +
14783 +#ifdef CONFIG_X86_32
14784 +       pushl %ss
14785 +       popl %ds
14786 +#endif
14787 +
14788         xor %eax,%eax
14789         EXIT
14790  ENDPROC(__put_user_1)
14791 @@ -50,7 +63,19 @@ ENTRY(__put_user_2)
14792         sub $1,%_ASM_BX
14793         cmp %_ASM_BX,%_ASM_CX
14794         jae bad_put_user
14795 +
14796 +#ifdef CONFIG_X86_32
14797 +       pushl $(__USER_DS)
14798 +       popl %ds
14799 +#endif
14800 +
14801  2:     movw %ax,(%_ASM_CX)
14802 +
14803 +#ifdef CONFIG_X86_32
14804 +       pushl %ss
14805 +       popl %ds
14806 +#endif
14807 +
14808         xor %eax,%eax
14809         EXIT
14810  ENDPROC(__put_user_2)
14811 @@ -61,7 +86,19 @@ ENTRY(__put_user_4)
14812         sub $3,%_ASM_BX
14813         cmp %_ASM_BX,%_ASM_CX
14814         jae bad_put_user
14815 +
14816 +#ifdef CONFIG_X86_32
14817 +       pushl $(__USER_DS)
14818 +       popl %ds
14819 +#endif
14820 +
14821  3:     movl %eax,(%_ASM_CX)
14822 +
14823 +#ifdef CONFIG_X86_32
14824 +       pushl %ss
14825 +       popl %ds
14826 +#endif
14827 +
14828         xor %eax,%eax
14829         EXIT
14830  ENDPROC(__put_user_4)
14831 @@ -72,16 +109,34 @@ ENTRY(__put_user_8)
14832         sub $7,%_ASM_BX
14833         cmp %_ASM_BX,%_ASM_CX
14834         jae bad_put_user
14835 +
14836 +#ifdef CONFIG_X86_32
14837 +       pushl $(__USER_DS)
14838 +       popl %ds
14839 +#endif
14840 +
14841  4:     mov %_ASM_AX,(%_ASM_CX)
14842  #ifdef CONFIG_X86_32
14843  5:     movl %edx,4(%_ASM_CX)
14844  #endif
14845 +
14846 +#ifdef CONFIG_X86_32
14847 +       pushl %ss
14848 +       popl %ds
14849 +#endif
14850 +
14851         xor %eax,%eax
14852         EXIT
14853  ENDPROC(__put_user_8)
14854
14855  bad_put_user:
14856         CFI_STARTPROC
14857 +
14858 +#ifdef CONFIG_X86_32
14859 +       pushl %ss
14860 +       popl %ds
14861 +#endif
14862 +
14863         movl $-EFAULT,%eax
14864         EXIT
14865  END(bad_put_user)
14866 diff -urNp linux-2.6.33/arch/x86/lib/usercopy_32.c linux-2.6.33/arch/x86/lib/usercopy_32.c
14867 --- linux-2.6.33/arch/x86/lib/usercopy_32.c     2010-02-24 13:52:17.000000000 -0500
14868 +++ linux-2.6.33/arch/x86/lib/usercopy_32.c     2010-03-07 12:23:35.953604355 -0500
14869 @@ -36,31 +36,38 @@ static inline int __movsl_is_ok(unsigned
14870   * Copy a null terminated string from userspace.
14871   */
14872
14873 -#define __do_strncpy_from_user(dst, src, count, res)                      \
14874 -do {                                                                      \
14875 -       int __d0, __d1, __d2;                                              \
14876 -       might_fault();                                                     \
14877 -       __asm__ __volatile__(                                              \
14878 -               "       testl %1,%1\n"                                     \
14879 -               "       jz 2f\n"                                           \
14880 -               "0:     lodsb\n"                                           \
14881 -               "       stosb\n"                                           \
14882 -               "       testb %%al,%%al\n"                                 \
14883 -               "       jz 1f\n"                                           \
14884 -               "       decl %1\n"                                         \
14885 -               "       jnz 0b\n"                                          \
14886 -               "1:     subl %1,%0\n"                                      \
14887 -               "2:\n"                                                     \
14888 -               ".section .fixup,\"ax\"\n"                                 \
14889 -               "3:     movl %5,%0\n"                                      \
14890 -               "       jmp 2b\n"                                          \
14891 -               ".previous\n"                                              \
14892 -               _ASM_EXTABLE(0b,3b)                                        \
14893 -               : "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),    \
14894 -                 "=&D" (__d2)                                             \
14895 -               : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst) \
14896 -               : "memory");                                               \
14897 -} while (0)
14898 +static long __do_strncpy_from_user(char *dst, const char __user *src, long count)
14899 +{
14900 +       int __d0, __d1, __d2;
14901 +       long res = -EFAULT;
14902 +
14903 +       might_fault();
14904 +       __asm__ __volatile__(
14905 +               "       movw %w10,%%ds\n"
14906 +               "       testl %1,%1\n"
14907 +               "       jz 2f\n"
14908 +               "0:     lodsb\n"
14909 +               "       stosb\n"
14910 +               "       testb %%al,%%al\n"
14911 +               "       jz 1f\n"
14912 +               "       decl %1\n"
14913 +               "       jnz 0b\n"
14914 +               "1:     subl %1,%0\n"
14915 +               "2:\n"
14916 +               "       pushl %%ss\n"
14917 +               "       popl %%ds\n"
14918 +               ".section .fixup,\"ax\"\n"
14919 +               "3:     movl %5,%0\n"
14920 +               "       jmp 2b\n"
14921 +               ".previous\n"
14922 +               _ASM_EXTABLE(0b,3b)
14923 +               : "=&d"(res), "=&c"(count), "=&a" (__d0), "=&S" (__d1),
14924 +                 "=&D" (__d2)
14925 +               : "i"(-EFAULT), "0"(count), "1"(count), "3"(src), "4"(dst),
14926 +                 "r"(__USER_DS)
14927 +               : "memory");
14928 +       return res;
14929 +}
14930
14931  /**
14932   * __strncpy_from_user: - Copy a NUL terminated string from userspace, with less checking.
14933 @@ -85,9 +92,7 @@ do {                                                                     \
14934  long
14935  __strncpy_from_user(char *dst, const char __user *src, long count)
14936  {
14937 -       long res;
14938 -       __do_strncpy_from_user(dst, src, count, res);
14939 -       return res;
14940 +       return __do_strncpy_from_user(dst, src, count);
14941  }
14942  EXPORT_SYMBOL(__strncpy_from_user);
14943
14944 @@ -114,7 +119,7 @@ strncpy_from_user(char *dst, const char
14945  {
14946         long res = -EFAULT;
14947         if (access_ok(VERIFY_READ, src, 1))
14948 -               __do_strncpy_from_user(dst, src, count, res);
14949 +               res = __do_strncpy_from_user(dst, src, count);
14950         return res;
14951  }
14952  EXPORT_SYMBOL(strncpy_from_user);
14953 @@ -123,24 +128,30 @@ EXPORT_SYMBOL(strncpy_from_user);
14954   * Zero Userspace
14955   */
14956
14957 -#define __do_clear_user(addr,size)                                     \
14958 -do {                                                                   \
14959 -       int __d0;                                                       \
14960 -       might_fault();                                                  \
14961 -       __asm__ __volatile__(                                           \
14962 -               "0:     rep; stosl\n"                                   \
14963 -               "       movl %2,%0\n"                                   \
14964 -               "1:     rep; stosb\n"                                   \
14965 -               "2:\n"                                                  \
14966 -               ".section .fixup,\"ax\"\n"                              \
14967 -               "3:     lea 0(%2,%0,4),%0\n"                            \
14968 -               "       jmp 2b\n"                                       \
14969 -               ".previous\n"                                           \
14970 -               _ASM_EXTABLE(0b,3b)                                     \
14971 -               _ASM_EXTABLE(1b,2b)                                     \
14972 -               : "=&c"(size), "=&D" (__d0)                             \
14973 -               : "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0));     \
14974 -} while (0)
14975 +static unsigned long __do_clear_user(void __user *addr, unsigned long size)
14976 +{
14977 +       int __d0;
14978 +
14979 +       might_fault();
14980 +       __asm__ __volatile__(
14981 +               "       movw %w6,%%es\n"
14982 +               "0:     rep; stosl\n"
14983 +               "       movl %2,%0\n"
14984 +               "1:     rep; stosb\n"
14985 +               "2:\n"
14986 +               "       pushl %%ss\n"
14987 +               "       popl %%es\n"
14988 +               ".section .fixup,\"ax\"\n"
14989 +               "3:     lea 0(%2,%0,4),%0\n"
14990 +               "       jmp 2b\n"
14991 +               ".previous\n"
14992 +               _ASM_EXTABLE(0b,3b)
14993 +               _ASM_EXTABLE(1b,2b)
14994 +               : "=&c"(size), "=&D" (__d0)
14995 +               : "r"(size & 3), "0"(size / 4), "1"(addr), "a"(0),
14996 +                 "r"(__USER_DS));
14997 +       return size;
14998 +}
14999
15000  /**
15001   * clear_user: - Zero a block of memory in user space.
15002 @@ -157,7 +168,7 @@ clear_user(void __user *to, unsigned lon
15003  {
15004         might_fault();
15005         if (access_ok(VERIFY_WRITE, to, n))
15006 -               __do_clear_user(to, n);
15007 +               n = __do_clear_user(to, n);
15008         return n;
15009  }
15010  EXPORT_SYMBOL(clear_user);
15011 @@ -176,8 +187,7 @@ EXPORT_SYMBOL(clear_user);
15012  unsigned long
15013  __clear_user(void __user *to, unsigned long n)
15014  {
15015 -       __do_clear_user(to, n);
15016 -       return n;
15017 +       return __do_clear_user(to, n);
15018  }
15019  EXPORT_SYMBOL(__clear_user);
15020
15021 @@ -200,14 +210,17 @@ long strnlen_user(const char __user *s,
15022         might_fault();
15023
15024         __asm__ __volatile__(
15025 +               "       movw %w8,%%es\n"
15026                 "       testl %0, %0\n"
15027                 "       jz 3f\n"
15028 -               "       andl %0,%%ecx\n"
15029 +               "       movl %0,%%ecx\n"
15030                 "0:     repne; scasb\n"
15031                 "       setne %%al\n"
15032                 "       subl %%ecx,%0\n"
15033                 "       addl %0,%%eax\n"
15034                 "1:\n"
15035 +               "       pushl %%ss\n"
15036 +               "       popl %%es\n"
15037                 ".section .fixup,\"ax\"\n"
15038                 "2:     xorl %%eax,%%eax\n"
15039                 "       jmp 1b\n"
15040 @@ -219,7 +232,7 @@ long strnlen_user(const char __user *s,
15041                 "       .long 0b,2b\n"
15042                 ".previous"
15043                 :"=&r" (n), "=&D" (s), "=&a" (res), "=&c" (tmp)
15044 -               :"0" (n), "1" (s), "2" (0), "3" (mask)
15045 +               :"0" (n), "1" (s), "2" (0), "3" (mask), "r" (__USER_DS)
15046                 :"cc");
15047         return res & mask;
15048  }
15049 @@ -227,10 +240,121 @@ EXPORT_SYMBOL(strnlen_user);
15050
15051  #ifdef CONFIG_X86_INTEL_USERCOPY
15052  static unsigned long
15053 -__copy_user_intel(void __user *to, const void *from, unsigned long size)
15054 +__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
15055 +{
15056 +       int d0, d1;
15057 +       __asm__ __volatile__(
15058 +                      "       movw %w6, %%es\n"
15059 +                      "       .align 2,0x90\n"
15060 +                      "1:     movl 32(%4), %%eax\n"
15061 +                      "       cmpl $67, %0\n"
15062 +                      "       jbe 3f\n"
15063 +                      "2:     movl 64(%4), %%eax\n"
15064 +                      "       .align 2,0x90\n"
15065 +                      "3:     movl 0(%4), %%eax\n"
15066 +                      "4:     movl 4(%4), %%edx\n"
15067 +                      "5:     movl %%eax, %%es:0(%3)\n"
15068 +                      "6:     movl %%edx, %%es:4(%3)\n"
15069 +                      "7:     movl 8(%4), %%eax\n"
15070 +                      "8:     movl 12(%4),%%edx\n"
15071 +                      "9:     movl %%eax, %%es:8(%3)\n"
15072 +                      "10:    movl %%edx, %%es:12(%3)\n"
15073 +                      "11:    movl 16(%4), %%eax\n"
15074 +                      "12:    movl 20(%4), %%edx\n"
15075 +                      "13:    movl %%eax, %%es:16(%3)\n"
15076 +                      "14:    movl %%edx, %%es:20(%3)\n"
15077 +                      "15:    movl 24(%4), %%eax\n"
15078 +                      "16:    movl 28(%4), %%edx\n"
15079 +                      "17:    movl %%eax, %%es:24(%3)\n"
15080 +                      "18:    movl %%edx, %%es:28(%3)\n"
15081 +                      "19:    movl 32(%4), %%eax\n"
15082 +                      "20:    movl 36(%4), %%edx\n"
15083 +                      "21:    movl %%eax, %%es:32(%3)\n"
15084 +                      "22:    movl %%edx, %%es:36(%3)\n"
15085 +                      "23:    movl 40(%4), %%eax\n"
15086 +                      "24:    movl 44(%4), %%edx\n"
15087 +                      "25:    movl %%eax, %%es:40(%3)\n"
15088 +                      "26:    movl %%edx, %%es:44(%3)\n"
15089 +                      "27:    movl 48(%4), %%eax\n"
15090 +                      "28:    movl 52(%4), %%edx\n"
15091 +                      "29:    movl %%eax, %%es:48(%3)\n"
15092 +                      "30:    movl %%edx, %%es:52(%3)\n"
15093 +                      "31:    movl 56(%4), %%eax\n"
15094 +                      "32:    movl 60(%4), %%edx\n"
15095 +                      "33:    movl %%eax, %%es:56(%3)\n"
15096 +                      "34:    movl %%edx, %%es:60(%3)\n"
15097 +                      "       addl $-64, %0\n"
15098 +                      "       addl $64, %4\n"
15099 +                      "       addl $64, %3\n"
15100 +                      "       cmpl $63, %0\n"
15101 +                      "       ja  1b\n"
15102 +                      "35:    movl  %0, %%eax\n"
15103 +                      "       shrl  $2, %0\n"
15104 +                      "       andl  $3, %%eax\n"
15105 +                      "       cld\n"
15106 +                      "99:    rep; movsl\n"
15107 +                      "36:    movl %%eax, %0\n"
15108 +                      "37:    rep; movsb\n"
15109 +                      "100:\n"
15110 +                      "       pushl %%ss\n"
15111 +                      "       popl %%es\n"
15112 +                      ".section .fixup,\"ax\"\n"
15113 +                      "101:   lea 0(%%eax,%0,4),%0\n"
15114 +                      "       jmp 100b\n"
15115 +                      ".previous\n"
15116 +                      ".section __ex_table,\"a\"\n"
15117 +                      "       .align 4\n"
15118 +                      "       .long 1b,100b\n"
15119 +                      "       .long 2b,100b\n"
15120 +                      "       .long 3b,100b\n"
15121 +                      "       .long 4b,100b\n"
15122 +                      "       .long 5b,100b\n"
15123 +                      "       .long 6b,100b\n"
15124 +                      "       .long 7b,100b\n"
15125 +                      "       .long 8b,100b\n"
15126 +                      "       .long 9b,100b\n"
15127 +                      "       .long 10b,100b\n"
15128 +                      "       .long 11b,100b\n"
15129 +                      "       .long 12b,100b\n"
15130 +                      "       .long 13b,100b\n"
15131 +                      "       .long 14b,100b\n"
15132 +                      "       .long 15b,100b\n"
15133 +                      "       .long 16b,100b\n"
15134 +                      "       .long 17b,100b\n"
15135 +                      "       .long 18b,100b\n"
15136 +                      "       .long 19b,100b\n"
15137 +                      "       .long 20b,100b\n"
15138 +                      "       .long 21b,100b\n"
15139 +                      "       .long 22b,100b\n"
15140 +                      "       .long 23b,100b\n"
15141 +                      "       .long 24b,100b\n"
15142 +                      "       .long 25b,100b\n"
15143 +                      "       .long 26b,100b\n"
15144 +                      "       .long 27b,100b\n"
15145 +                      "       .long 28b,100b\n"
15146 +                      "       .long 29b,100b\n"
15147 +                      "       .long 30b,100b\n"
15148 +                      "       .long 31b,100b\n"
15149 +                      "       .long 32b,100b\n"
15150 +                      "       .long 33b,100b\n"
15151 +                      "       .long 34b,100b\n"
15152 +                      "       .long 35b,100b\n"
15153 +                      "       .long 36b,100b\n"
15154 +                      "       .long 37b,100b\n"
15155 +                      "       .long 99b,101b\n"
15156 +                      ".previous"
15157 +                      : "=&c"(size), "=&D" (d0), "=&S" (d1)
15158 +                      :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
15159 +                      : "eax", "edx", "memory");
15160 +       return size;
15161 +}
15162 +
15163 +static unsigned long
15164 +__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
15165  {
15166         int d0, d1;
15167         __asm__ __volatile__(
15168 +                      "       movw %w6, %%ds\n"
15169                        "       .align 2,0x90\n"
15170                        "1:     movl 32(%4), %%eax\n"
15171                        "       cmpl $67, %0\n"
15172 @@ -239,36 +363,36 @@ __copy_user_intel(void __user *to, const
15173                        "       .align 2,0x90\n"
15174                        "3:     movl 0(%4), %%eax\n"
15175                        "4:     movl 4(%4), %%edx\n"
15176 -                      "5:     movl %%eax, 0(%3)\n"
15177 -                      "6:     movl %%edx, 4(%3)\n"
15178 +                      "5:     movl %%eax, %%es:0(%3)\n"
15179 +                      "6:     movl %%edx, %%es:4(%3)\n"
15180                        "7:     movl 8(%4), %%eax\n"
15181                        "8:     movl 12(%4),%%edx\n"
15182 -                      "9:     movl %%eax, 8(%3)\n"
15183 -                      "10:    movl %%edx, 12(%3)\n"
15184 +                      "9:     movl %%eax, %%es:8(%3)\n"
15185 +                      "10:    movl %%edx, %%es:12(%3)\n"
15186                        "11:    movl 16(%4), %%eax\n"
15187                        "12:    movl 20(%4), %%edx\n"
15188 -                      "13:    movl %%eax, 16(%3)\n"
15189 -                      "14:    movl %%edx, 20(%3)\n"
15190 +                      "13:    movl %%eax, %%es:16(%3)\n"
15191 +                      "14:    movl %%edx, %%es:20(%3)\n"
15192                        "15:    movl 24(%4), %%eax\n"
15193                        "16:    movl 28(%4), %%edx\n"
15194 -                      "17:    movl %%eax, 24(%3)\n"
15195 -                      "18:    movl %%edx, 28(%3)\n"
15196 +                      "17:    movl %%eax, %%es:24(%3)\n"
15197 +                      "18:    movl %%edx, %%es:28(%3)\n"
15198                        "19:    movl 32(%4), %%eax\n"
15199                        "20:    movl 36(%4), %%edx\n"
15200 -                      "21:    movl %%eax, 32(%3)\n"
15201 -                      "22:    movl %%edx, 36(%3)\n"
15202 +                      "21:    movl %%eax, %%es:32(%3)\n"
15203 +                      "22:    movl %%edx, %%es:36(%3)\n"
15204                        "23:    movl 40(%4), %%eax\n"
15205                        "24:    movl 44(%4), %%edx\n"
15206 -                      "25:    movl %%eax, 40(%3)\n"
15207 -                      "26:    movl %%edx, 44(%3)\n"
15208 +                      "25:    movl %%eax, %%es:40(%3)\n"
15209 +                      "26:    movl %%edx, %%es:44(%3)\n"
15210                        "27:    movl 48(%4), %%eax\n"
15211                        "28:    movl 52(%4), %%edx\n"
15212 -                      "29:    movl %%eax, 48(%3)\n"
15213 -                      "30:    movl %%edx, 52(%3)\n"
15214 +                      "29:    movl %%eax, %%es:48(%3)\n"
15215 +                      "30:    movl %%edx, %%es:52(%3)\n"
15216                        "31:    movl 56(%4), %%eax\n"
15217                        "32:    movl 60(%4), %%edx\n"
15218 -                      "33:    movl %%eax, 56(%3)\n"
15219 -                      "34:    movl %%edx, 60(%3)\n"
15220 +                      "33:    movl %%eax, %%es:56(%3)\n"
15221 +                      "34:    movl %%edx, %%es:60(%3)\n"
15222                        "       addl $-64, %0\n"
15223                        "       addl $64, %4\n"
15224                        "       addl $64, %3\n"
15225 @@ -282,6 +406,8 @@ __copy_user_intel(void __user *to, const
15226                        "36:    movl %%eax, %0\n"
15227                        "37:    rep; movsb\n"
15228                        "100:\n"
15229 +                      "       pushl %%ss\n"
15230 +                      "       popl %%ds\n"
15231                        ".section .fixup,\"ax\"\n"
15232                        "101:   lea 0(%%eax,%0,4),%0\n"
15233                        "       jmp 100b\n"
15234 @@ -328,7 +454,7 @@ __copy_user_intel(void __user *to, const
15235                        "       .long 99b,101b\n"
15236                        ".previous"
15237                        : "=&c"(size), "=&D" (d0), "=&S" (d1)
15238 -                      :  "1"(to), "2"(from), "0"(size)
15239 +                      :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
15240                        : "eax", "edx", "memory");
15241         return size;
15242  }
15243 @@ -338,6 +464,7 @@ __copy_user_zeroing_intel(void *to, cons
15244  {
15245         int d0, d1;
15246         __asm__ __volatile__(
15247 +                      "        movw %w6, %%ds\n"
15248                        "        .align 2,0x90\n"
15249                        "0:      movl 32(%4), %%eax\n"
15250                        "        cmpl $67, %0\n"
15251 @@ -346,36 +473,36 @@ __copy_user_zeroing_intel(void *to, cons
15252                        "        .align 2,0x90\n"
15253                        "2:      movl 0(%4), %%eax\n"
15254                        "21:     movl 4(%4), %%edx\n"
15255 -                      "        movl %%eax, 0(%3)\n"
15256 -                      "        movl %%edx, 4(%3)\n"
15257 +                      "        movl %%eax, %%es:0(%3)\n"
15258 +                      "        movl %%edx, %%es:4(%3)\n"
15259                        "3:      movl 8(%4), %%eax\n"
15260                        "31:     movl 12(%4),%%edx\n"
15261 -                      "        movl %%eax, 8(%3)\n"
15262 -                      "        movl %%edx, 12(%3)\n"
15263 +                      "        movl %%eax, %%es:8(%3)\n"
15264 +                      "        movl %%edx, %%es:12(%3)\n"
15265                        "4:      movl 16(%4), %%eax\n"
15266                        "41:     movl 20(%4), %%edx\n"
15267 -                      "        movl %%eax, 16(%3)\n"
15268 -                      "        movl %%edx, 20(%3)\n"
15269 +                      "        movl %%eax, %%es:16(%3)\n"
15270 +                      "        movl %%edx, %%es:20(%3)\n"
15271                        "10:     movl 24(%4), %%eax\n"
15272                        "51:     movl 28(%4), %%edx\n"
15273 -                      "        movl %%eax, 24(%3)\n"
15274 -                      "        movl %%edx, 28(%3)\n"
15275 +                      "        movl %%eax, %%es:24(%3)\n"
15276 +                      "        movl %%edx, %%es:28(%3)\n"
15277                        "11:     movl 32(%4), %%eax\n"
15278                        "61:     movl 36(%4), %%edx\n"
15279 -                      "        movl %%eax, 32(%3)\n"
15280 -                      "        movl %%edx, 36(%3)\n"
15281 +                      "        movl %%eax, %%es:32(%3)\n"
15282 +                      "        movl %%edx, %%es:36(%3)\n"
15283                        "12:     movl 40(%4), %%eax\n"
15284                        "71:     movl 44(%4), %%edx\n"
15285 -                      "        movl %%eax, 40(%3)\n"
15286 -                      "        movl %%edx, 44(%3)\n"
15287 +                      "        movl %%eax, %%es:40(%3)\n"
15288 +                      "        movl %%edx, %%es:44(%3)\n"
15289                        "13:     movl 48(%4), %%eax\n"
15290                        "81:     movl 52(%4), %%edx\n"
15291 -                      "        movl %%eax, 48(%3)\n"
15292 -                      "        movl %%edx, 52(%3)\n"
15293 +                      "        movl %%eax, %%es:48(%3)\n"
15294 +                      "        movl %%edx, %%es:52(%3)\n"
15295                        "14:     movl 56(%4), %%eax\n"
15296                        "91:     movl 60(%4), %%edx\n"
15297 -                      "        movl %%eax, 56(%3)\n"
15298 -                      "        movl %%edx, 60(%3)\n"
15299 +                      "        movl %%eax, %%es:56(%3)\n"
15300 +                      "        movl %%edx, %%es:60(%3)\n"
15301                        "        addl $-64, %0\n"
15302                        "        addl $64, %4\n"
15303                        "        addl $64, %3\n"
15304 @@ -389,6 +516,8 @@ __copy_user_zeroing_intel(void *to, cons
15305                        "        movl %%eax,%0\n"
15306                        "7:      rep; movsb\n"
15307                        "8:\n"
15308 +                      "        pushl %%ss\n"
15309 +                      "        popl %%ds\n"
15310                        ".section .fixup,\"ax\"\n"
15311                        "9:      lea 0(%%eax,%0,4),%0\n"
15312                        "16:     pushl %0\n"
15313 @@ -423,7 +552,7 @@ __copy_user_zeroing_intel(void *to, cons
15314                        "        .long 7b,16b\n"
15315                        ".previous"
15316                        : "=&c"(size), "=&D" (d0), "=&S" (d1)
15317 -                      :  "1"(to), "2"(from), "0"(size)
15318 +                      :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
15319                        : "eax", "edx", "memory");
15320         return size;
15321  }
15322 @@ -439,6 +568,7 @@ static unsigned long __copy_user_zeroing
15323         int d0, d1;
15324
15325         __asm__ __volatile__(
15326 +              "        movw %w6, %%ds\n"
15327                "        .align 2,0x90\n"
15328                "0:      movl 32(%4), %%eax\n"
15329                "        cmpl $67, %0\n"
15330 @@ -447,36 +577,36 @@ static unsigned long __copy_user_zeroing
15331                "        .align 2,0x90\n"
15332                "2:      movl 0(%4), %%eax\n"
15333                "21:     movl 4(%4), %%edx\n"
15334 -              "        movnti %%eax, 0(%3)\n"
15335 -              "        movnti %%edx, 4(%3)\n"
15336 +              "        movnti %%eax, %%es:0(%3)\n"
15337 +              "        movnti %%edx, %%es:4(%3)\n"
15338                "3:      movl 8(%4), %%eax\n"
15339                "31:     movl 12(%4),%%edx\n"
15340 -              "        movnti %%eax, 8(%3)\n"
15341 -              "        movnti %%edx, 12(%3)\n"
15342 +              "        movnti %%eax, %%es:8(%3)\n"
15343 +              "        movnti %%edx, %%es:12(%3)\n"
15344                "4:      movl 16(%4), %%eax\n"
15345                "41:     movl 20(%4), %%edx\n"
15346 -              "        movnti %%eax, 16(%3)\n"
15347 -              "        movnti %%edx, 20(%3)\n"
15348 +              "        movnti %%eax, %%es:16(%3)\n"
15349 +              "        movnti %%edx, %%es:20(%3)\n"
15350                "10:     movl 24(%4), %%eax\n"
15351                "51:     movl 28(%4), %%edx\n"
15352 -              "        movnti %%eax, 24(%3)\n"
15353 -              "        movnti %%edx, 28(%3)\n"
15354 +              "        movnti %%eax, %%es:24(%3)\n"
15355 +              "        movnti %%edx, %%es:28(%3)\n"
15356                "11:     movl 32(%4), %%eax\n"
15357                "61:     movl 36(%4), %%edx\n"
15358 -              "        movnti %%eax, 32(%3)\n"
15359 -              "        movnti %%edx, 36(%3)\n"
15360 +              "        movnti %%eax, %%es:32(%3)\n"
15361 +              "        movnti %%edx, %%es:36(%3)\n"
15362                "12:     movl 40(%4), %%eax\n"
15363                "71:     movl 44(%4), %%edx\n"
15364 -              "        movnti %%eax, 40(%3)\n"
15365 -              "        movnti %%edx, 44(%3)\n"
15366 +              "        movnti %%eax, %%es:40(%3)\n"
15367 +              "        movnti %%edx, %%es:44(%3)\n"
15368                "13:     movl 48(%4), %%eax\n"
15369                "81:     movl 52(%4), %%edx\n"
15370 -              "        movnti %%eax, 48(%3)\n"
15371 -              "        movnti %%edx, 52(%3)\n"
15372 +              "        movnti %%eax, %%es:48(%3)\n"
15373 +              "        movnti %%edx, %%es:52(%3)\n"
15374                "14:     movl 56(%4), %%eax\n"
15375                "91:     movl 60(%4), %%edx\n"
15376 -              "        movnti %%eax, 56(%3)\n"
15377 -              "        movnti %%edx, 60(%3)\n"
15378 +              "        movnti %%eax, %%es:56(%3)\n"
15379 +              "        movnti %%edx, %%es:60(%3)\n"
15380                "        addl $-64, %0\n"
15381                "        addl $64, %4\n"
15382                "        addl $64, %3\n"
15383 @@ -491,6 +621,8 @@ static unsigned long __copy_user_zeroing
15384                "        movl %%eax,%0\n"
15385                "7:      rep; movsb\n"
15386                "8:\n"
15387 +              "        pushl %%ss\n"
15388 +              "        popl %%ds\n"
15389                ".section .fixup,\"ax\"\n"
15390                "9:      lea 0(%%eax,%0,4),%0\n"
15391                "16:     pushl %0\n"
15392 @@ -525,7 +657,7 @@ static unsigned long __copy_user_zeroing
15393                "        .long 7b,16b\n"
15394                ".previous"
15395                : "=&c"(size), "=&D" (d0), "=&S" (d1)
15396 -              :  "1"(to), "2"(from), "0"(size)
15397 +              :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
15398                : "eax", "edx", "memory");
15399         return size;
15400  }
15401 @@ -536,6 +668,7 @@ static unsigned long __copy_user_intel_n
15402         int d0, d1;
15403
15404         __asm__ __volatile__(
15405 +              "        movw %w6, %%ds\n"
15406                "        .align 2,0x90\n"
15407                "0:      movl 32(%4), %%eax\n"
15408                "        cmpl $67, %0\n"
15409 @@ -544,36 +677,36 @@ static unsigned long __copy_user_intel_n
15410                "        .align 2,0x90\n"
15411                "2:      movl 0(%4), %%eax\n"
15412                "21:     movl 4(%4), %%edx\n"
15413 -              "        movnti %%eax, 0(%3)\n"
15414 -              "        movnti %%edx, 4(%3)\n"
15415 +              "        movnti %%eax, %%es:0(%3)\n"
15416 +              "        movnti %%edx, %%es:4(%3)\n"
15417                "3:      movl 8(%4), %%eax\n"
15418                "31:     movl 12(%4),%%edx\n"
15419 -              "        movnti %%eax, 8(%3)\n"
15420 -              "        movnti %%edx, 12(%3)\n"
15421 +              "        movnti %%eax, %%es:8(%3)\n"
15422 +              "        movnti %%edx, %%es:12(%3)\n"
15423                "4:      movl 16(%4), %%eax\n"
15424                "41:     movl 20(%4), %%edx\n"
15425 -              "        movnti %%eax, 16(%3)\n"
15426 -              "        movnti %%edx, 20(%3)\n"
15427 +              "        movnti %%eax, %%es:16(%3)\n"
15428 +              "        movnti %%edx, %%es:20(%3)\n"
15429                "10:     movl 24(%4), %%eax\n"
15430                "51:     movl 28(%4), %%edx\n"
15431 -              "        movnti %%eax, 24(%3)\n"
15432 -              "        movnti %%edx, 28(%3)\n"
15433 +              "        movnti %%eax, %%es:24(%3)\n"
15434 +              "        movnti %%edx, %%es:28(%3)\n"
15435                "11:     movl 32(%4), %%eax\n"
15436                "61:     movl 36(%4), %%edx\n"
15437 -              "        movnti %%eax, 32(%3)\n"
15438 -              "        movnti %%edx, 36(%3)\n"
15439 +              "        movnti %%eax, %%es:32(%3)\n"
15440 +              "        movnti %%edx, %%es:36(%3)\n"
15441                "12:     movl 40(%4), %%eax\n"
15442                "71:     movl 44(%4), %%edx\n"
15443 -              "        movnti %%eax, 40(%3)\n"
15444 -              "        movnti %%edx, 44(%3)\n"
15445 +              "        movnti %%eax, %%es:40(%3)\n"
15446 +              "        movnti %%edx, %%es:44(%3)\n"
15447                "13:     movl 48(%4), %%eax\n"
15448                "81:     movl 52(%4), %%edx\n"
15449 -              "        movnti %%eax, 48(%3)\n"
15450 -              "        movnti %%edx, 52(%3)\n"
15451 +              "        movnti %%eax, %%es:48(%3)\n"
15452 +              "        movnti %%edx, %%es:52(%3)\n"
15453                "14:     movl 56(%4), %%eax\n"
15454                "91:     movl 60(%4), %%edx\n"
15455 -              "        movnti %%eax, 56(%3)\n"
15456 -              "        movnti %%edx, 60(%3)\n"
15457 +              "        movnti %%eax, %%es:56(%3)\n"
15458 +              "        movnti %%edx, %%es:60(%3)\n"
15459                "        addl $-64, %0\n"
15460                "        addl $64, %4\n"
15461                "        addl $64, %3\n"
15462 @@ -588,6 +721,8 @@ static unsigned long __copy_user_intel_n
15463                "        movl %%eax,%0\n"
15464                "7:      rep; movsb\n"
15465                "8:\n"
15466 +              "        pushl %%ss\n"
15467 +              "        popl %%ds\n"
15468                ".section .fixup,\"ax\"\n"
15469                "9:      lea 0(%%eax,%0,4),%0\n"
15470                "16:     jmp 8b\n"
15471 @@ -616,7 +751,7 @@ static unsigned long __copy_user_intel_n
15472                "        .long 7b,16b\n"
15473                ".previous"
15474                : "=&c"(size), "=&D" (d0), "=&S" (d1)
15475 -              :  "1"(to), "2"(from), "0"(size)
15476 +              :  "1"(to), "2"(from), "0"(size), "r"(__USER_DS)
15477                : "eax", "edx", "memory");
15478         return size;
15479  }
15480 @@ -629,90 +764,146 @@ static unsigned long __copy_user_intel_n
15481   */
15482  unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
15483                                         unsigned long size);
15484 -unsigned long __copy_user_intel(void __user *to, const void *from,
15485 +unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
15486 +                                       unsigned long size);
15487 +unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
15488                                         unsigned long size);
15489  unsigned long __copy_user_zeroing_intel_nocache(void *to,
15490                                 const void __user *from, unsigned long size);
15491  #endif /* CONFIG_X86_INTEL_USERCOPY */
15492
15493  /* Generic arbitrary sized copy.  */
15494 -#define __copy_user(to, from, size)                                    \
15495 -do {                                                                   \
15496 -       int __d0, __d1, __d2;                                           \
15497 -       __asm__ __volatile__(                                           \
15498 -               "       cmp  $7,%0\n"                                   \
15499 -               "       jbe  1f\n"                                      \
15500 -               "       movl %1,%0\n"                                   \
15501 -               "       negl %0\n"                                      \
15502 -               "       andl $7,%0\n"                                   \
15503 -               "       subl %0,%3\n"                                   \
15504 -               "4:     rep; movsb\n"                                   \
15505 -               "       movl %3,%0\n"                                   \
15506 -               "       shrl $2,%0\n"                                   \
15507 -               "       andl $3,%3\n"                                   \
15508 -               "       .align 2,0x90\n"                                \
15509 -               "0:     rep; movsl\n"                                   \
15510 -               "       movl %3,%0\n"                                   \
15511 -               "1:     rep; movsb\n"                                   \
15512 -               "2:\n"                                                  \
15513 -               ".section .fixup,\"ax\"\n"                              \
15514 -               "5:     addl %3,%0\n"                                   \
15515 -               "       jmp 2b\n"                                       \
15516 -               "3:     lea 0(%3,%0,4),%0\n"                            \
15517 -               "       jmp 2b\n"                                       \
15518 -               ".previous\n"                                           \
15519 -               ".section __ex_table,\"a\"\n"                           \
15520 -               "       .align 4\n"                                     \
15521 -               "       .long 4b,5b\n"                                  \
15522 -               "       .long 0b,3b\n"                                  \
15523 -               "       .long 1b,2b\n"                                  \
15524 -               ".previous"                                             \
15525 -               : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)   \
15526 -               : "3"(size), "0"(size), "1"(to), "2"(from)              \
15527 -               : "memory");                                            \
15528 -} while (0)
15529 -
15530 -#define __copy_user_zeroing(to, from, size)                            \
15531 -do {                                                                   \
15532 -       int __d0, __d1, __d2;                                           \
15533 -       __asm__ __volatile__(                                           \
15534 -               "       cmp  $7,%0\n"                                   \
15535 -               "       jbe  1f\n"                                      \
15536 -               "       movl %1,%0\n"                                   \
15537 -               "       negl %0\n"                                      \
15538 -               "       andl $7,%0\n"                                   \
15539 -               "       subl %0,%3\n"                                   \
15540 -               "4:     rep; movsb\n"                                   \
15541 -               "       movl %3,%0\n"                                   \
15542 -               "       shrl $2,%0\n"                                   \
15543 -               "       andl $3,%3\n"                                   \
15544 -               "       .align 2,0x90\n"                                \
15545 -               "0:     rep; movsl\n"                                   \
15546 -               "       movl %3,%0\n"                                   \
15547 -               "1:     rep; movsb\n"                                   \
15548 -               "2:\n"                                                  \
15549 -               ".section .fixup,\"ax\"\n"                              \
15550 -               "5:     addl %3,%0\n"                                   \
15551 -               "       jmp 6f\n"                                       \
15552 -               "3:     lea 0(%3,%0,4),%0\n"                            \
15553 -               "6:     pushl %0\n"                                     \
15554 -               "       pushl %%eax\n"                                  \
15555 -               "       xorl %%eax,%%eax\n"                             \
15556 -               "       rep; stosb\n"                                   \
15557 -               "       popl %%eax\n"                                   \
15558 -               "       popl %0\n"                                      \
15559 -               "       jmp 2b\n"                                       \
15560 -               ".previous\n"                                           \
15561 -               ".section __ex_table,\"a\"\n"                           \
15562 -               "       .align 4\n"                                     \
15563 -               "       .long 4b,5b\n"                                  \
15564 -               "       .long 0b,3b\n"                                  \
15565 -               "       .long 1b,6b\n"                                  \
15566 -               ".previous"                                             \
15567 -               : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)   \
15568 -               : "3"(size), "0"(size), "1"(to), "2"(from)              \
15569 -               : "memory");                                            \
15570 -} while (0)
15571 +static unsigned long
15572 +__generic_copy_to_user(void __user *to, const void *from, unsigned long size)
15573 +{
15574 +       int __d0, __d1, __d2;
15575 +
15576 +       __asm__ __volatile__(
15577 +               "       movw %w8,%%es\n"
15578 +               "       cmp  $7,%0\n"
15579 +               "       jbe  1f\n"
15580 +               "       movl %1,%0\n"
15581 +               "       negl %0\n"
15582 +               "       andl $7,%0\n"
15583 +               "       subl %0,%3\n"
15584 +               "4:     rep; movsb\n"
15585 +               "       movl %3,%0\n"
15586 +               "       shrl $2,%0\n"
15587 +               "       andl $3,%3\n"
15588 +               "       .align 2,0x90\n"
15589 +               "0:     rep; movsl\n"
15590 +               "       movl %3,%0\n"
15591 +               "1:     rep; movsb\n"
15592 +               "2:\n"
15593 +               "       pushl %%ss\n"
15594 +               "       popl %%es\n"
15595 +               ".section .fixup,\"ax\"\n"
15596 +               "5:     addl %3,%0\n"
15597 +               "       jmp 2b\n"
15598 +               "3:     lea 0(%3,%0,4),%0\n"
15599 +               "       jmp 2b\n"
15600 +               ".previous\n"
15601 +               ".section __ex_table,\"a\"\n"
15602 +               "       .align 4\n"
15603 +               "       .long 4b,5b\n"
15604 +               "       .long 0b,3b\n"
15605 +               "       .long 1b,2b\n"
15606 +               ".previous"
15607 +               : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
15608 +               : "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
15609 +               : "memory");
15610 +       return size;
15611 +}
15612 +
15613 +static unsigned long
15614 +__generic_copy_from_user(void *to, const void __user *from, unsigned long size)
15615 +{
15616 +       int __d0, __d1, __d2;
15617 +
15618 +       __asm__ __volatile__(
15619 +               "       movw %w8,%%ds\n"
15620 +               "       cmp  $7,%0\n"
15621 +               "       jbe  1f\n"
15622 +               "       movl %1,%0\n"
15623 +               "       negl %0\n"
15624 +               "       andl $7,%0\n"
15625 +               "       subl %0,%3\n"
15626 +               "4:     rep; movsb\n"
15627 +               "       movl %3,%0\n"
15628 +               "       shrl $2,%0\n"
15629 +               "       andl $3,%3\n"
15630 +               "       .align 2,0x90\n"
15631 +               "0:     rep; movsl\n"
15632 +               "       movl %3,%0\n"
15633 +               "1:     rep; movsb\n"
15634 +               "2:\n"
15635 +               "       pushl %%ss\n"
15636 +               "       popl %%ds\n"
15637 +               ".section .fixup,\"ax\"\n"
15638 +               "5:     addl %3,%0\n"
15639 +               "       jmp 2b\n"
15640 +               "3:     lea 0(%3,%0,4),%0\n"
15641 +               "       jmp 2b\n"
15642 +               ".previous\n"
15643 +               ".section __ex_table,\"a\"\n"
15644 +               "       .align 4\n"
15645 +               "       .long 4b,5b\n"
15646 +               "       .long 0b,3b\n"
15647 +               "       .long 1b,2b\n"
15648 +               ".previous"
15649 +               : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
15650 +               : "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
15651 +               : "memory");
15652 +       return size;
15653 +}
15654 +
15655 +static unsigned long
15656 +__copy_user_zeroing(void *to, const void __user *from, unsigned long size)
15657 +{
15658 +       int __d0, __d1, __d2;
15659 +
15660 +       __asm__ __volatile__(
15661 +               "       movw %w8,%%ds\n"
15662 +               "       cmp  $7,%0\n"
15663 +               "       jbe  1f\n"
15664 +               "       movl %1,%0\n"
15665 +               "       negl %0\n"
15666 +               "       andl $7,%0\n"
15667 +               "       subl %0,%3\n"
15668 +               "4:     rep; movsb\n"
15669 +               "       movl %3,%0\n"
15670 +               "       shrl $2,%0\n"
15671 +               "       andl $3,%3\n"
15672 +               "       .align 2,0x90\n"
15673 +               "0:     rep; movsl\n"
15674 +               "       movl %3,%0\n"
15675 +               "1:     rep; movsb\n"
15676 +               "2:\n"
15677 +               "       pushl %%ss\n"
15678 +               "       popl %%ds\n"
15679 +               ".section .fixup,\"ax\"\n"
15680 +               "5:     addl %3,%0\n"
15681 +               "       jmp 6f\n"
15682 +               "3:     lea 0(%3,%0,4),%0\n"
15683 +               "6:     pushl %0\n"
15684 +               "       pushl %%eax\n"
15685 +               "       xorl %%eax,%%eax\n"
15686 +               "       rep; stosb\n"
15687 +               "       popl %%eax\n"
15688 +               "       popl %0\n"
15689 +               "       jmp 2b\n"
15690 +               ".previous\n"
15691 +               ".section __ex_table,\"a\"\n"
15692 +               "       .align 4\n"
15693 +               "       .long 4b,5b\n"
15694 +               "       .long 0b,3b\n"
15695 +               "       .long 1b,6b\n"
15696 +               ".previous"
15697 +               : "=&c"(size), "=&D" (__d0), "=&S" (__d1), "=r"(__d2)
15698 +               : "3"(size), "0"(size), "1"(to), "2"(from), "r"(__USER_DS)
15699 +               : "memory");
15700 +       return size;
15701 +}
15702
15703  unsigned long __copy_to_user_ll(void __user *to, const void *from,
15704                                 unsigned long n)
15705 @@ -775,9 +966,9 @@ survive:
15706         }
15707  #endif
15708         if (movsl_is_ok(to, from, n))
15709 -               __copy_user(to, from, n);
15710 +               n = __generic_copy_to_user(to, from, n);
15711         else
15712 -               n = __copy_user_intel(to, from, n);
15713 +               n = __generic_copy_to_user_intel(to, from, n);
15714         return n;
15715  }
15716  EXPORT_SYMBOL(__copy_to_user_ll);
15717 @@ -786,7 +977,7 @@ unsigned long __copy_from_user_ll(void *
15718                                         unsigned long n)
15719  {
15720         if (movsl_is_ok(to, from, n))
15721 -               __copy_user_zeroing(to, from, n);
15722 +               n = __copy_user_zeroing(to, from, n);
15723         else
15724                 n = __copy_user_zeroing_intel(to, from, n);
15725         return n;
15726 @@ -797,10 +988,9 @@ unsigned long __copy_from_user_ll_nozero
15727                                          unsigned long n)
15728  {
15729         if (movsl_is_ok(to, from, n))
15730 -               __copy_user(to, from, n);
15731 +               n = __generic_copy_from_user(to, from, n);
15732         else
15733 -               n = __copy_user_intel((void __user *)to,
15734 -                                     (const void *)from, n);
15735 +               n = __generic_copy_from_user_intel(to, from, n);
15736         return n;
15737  }
15738  EXPORT_SYMBOL(__copy_from_user_ll_nozero);
15739 @@ -812,9 +1002,9 @@ unsigned long __copy_from_user_ll_nocach
15740         if (n > 64 && cpu_has_xmm2)
15741                 n = __copy_user_zeroing_intel_nocache(to, from, n);
15742         else
15743 -               __copy_user_zeroing(to, from, n);
15744 +               n = __copy_user_zeroing(to, from, n);
15745  #else
15746 -       __copy_user_zeroing(to, from, n);
15747 +       n = __copy_user_zeroing(to, from, n);
15748  #endif
15749         return n;
15750  }
15751 @@ -827,65 +1017,53 @@ unsigned long __copy_from_user_ll_nocach
15752         if (n > 64 && cpu_has_xmm2)
15753                 n = __copy_user_intel_nocache(to, from, n);
15754         else
15755 -               __copy_user(to, from, n);
15756 +               n = __generic_copy_from_user(to, from, n);
15757  #else
15758 -       __copy_user(to, from, n);
15759 +       n = __generic_copy_from_user(to, from, n);
15760  #endif
15761         return n;
15762  }
15763  EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
15764
15765 -/**
15766 - * copy_to_user: - Copy a block of data into user space.
15767 - * @to:   Destination address, in user space.
15768 - * @from: Source address, in kernel space.
15769 - * @n:    Number of bytes to copy.
15770 - *
15771 - * Context: User context only.  This function may sleep.
15772 - *
15773 - * Copy data from kernel space to user space.
15774 - *
15775 - * Returns number of bytes that could not be copied.
15776 - * On success, this will be zero.
15777 - */
15778 -unsigned long
15779 -copy_to_user(void __user *to, const void *from, unsigned long n)
15780 +void copy_from_user_overflow(void)
15781  {
15782 -       if (access_ok(VERIFY_WRITE, to, n))
15783 -               n = __copy_to_user(to, from, n);
15784 -       return n;
15785 +       WARN(1, "Buffer overflow detected!\n");
15786  }
15787 -EXPORT_SYMBOL(copy_to_user);
15788 +EXPORT_SYMBOL(copy_from_user_overflow);
15789
15790 -/**
15791 - * copy_from_user: - Copy a block of data from user space.
15792 - * @to:   Destination address, in kernel space.
15793 - * @from: Source address, in user space.
15794 - * @n:    Number of bytes to copy.
15795 - *
15796 - * Context: User context only.  This function may sleep.
15797 - *
15798 - * Copy data from user space to kernel space.
15799 - *
15800 - * Returns number of bytes that could not be copied.
15801 - * On success, this will be zero.
15802 - *
15803 - * If some data could not be copied, this function will pad the copied
15804 - * data to the requested size using zero bytes.
15805 - */
15806 -unsigned long
15807 -_copy_from_user(void *to, const void __user *from, unsigned long n)
15808 +void copy_to_user_overflow(void)
15809  {
15810 -       if (access_ok(VERIFY_READ, from, n))
15811 -               n = __copy_from_user(to, from, n);
15812 -       else
15813 -               memset(to, 0, n);
15814 -       return n;
15815 +       WARN(1, "Buffer overflow detected!\n");
15816  }
15817 -EXPORT_SYMBOL(_copy_from_user);
15818 +EXPORT_SYMBOL(copy_to_user_overflow);
15819
15820 -void copy_from_user_overflow(void)
15821 +#ifdef CONFIG_PAX_MEMORY_UDEREF
15822 +void __set_fs(mm_segment_t x, int cpu)
15823  {
15824 -       WARN(1, "Buffer overflow detected!\n");
15825 +       unsigned long limit = x.seg;
15826 +       struct desc_struct d;
15827 +
15828 +       current_thread_info()->addr_limit = x;
15829 +       if (unlikely(paravirt_enabled()))
15830 +               return;
15831 +
15832 +       if (likely(limit))
15833 +               limit = (limit - 1UL) >> PAGE_SHIFT;
15834 +       pack_descriptor(&d, 0UL, limit, 0xF3, 0xC);
15835 +       write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_DS, &d, DESCTYPE_S);
15836  }
15837 -EXPORT_SYMBOL(copy_from_user_overflow);
15838 +
15839 +void set_fs(mm_segment_t x)
15840 +{
15841 +       __set_fs(x, get_cpu());
15842 +       put_cpu();
15843 +}
15844 +EXPORT_SYMBOL(copy_from_user);
15845 +#else
15846 +void set_fs(mm_segment_t x)
15847 +{
15848 +       current_thread_info()->addr_limit = x;
15849 +}
15850 +#endif
15851 +
15852 +EXPORT_SYMBOL(set_fs);
15853 diff -urNp linux-2.6.33/arch/x86/Makefile linux-2.6.33/arch/x86/Makefile
15854 --- linux-2.6.33/arch/x86/Makefile      2010-02-24 13:52:17.000000000 -0500
15855 +++ linux-2.6.33/arch/x86/Makefile      2010-03-07 12:23:35.953604355 -0500
15856 @@ -192,3 +192,12 @@ define archhelp
15857    echo  '                  FDARGS="..."  arguments for the booted kernel'
15858    echo  '                  FDINITRD=file initrd for the booted kernel'
15859  endef
15860 +
15861 +define OLD_LD
15862 +
15863 +*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
15864 +*** Please upgrade your binutils to 2.18 or newer
15865 +endef
15866 +
15867 +archprepare:
15868 +       $(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
15869 diff -urNp linux-2.6.33/arch/x86/mm/extable.c linux-2.6.33/arch/x86/mm/extable.c
15870 --- linux-2.6.33/arch/x86/mm/extable.c  2010-02-24 13:52:17.000000000 -0500
15871 +++ linux-2.6.33/arch/x86/mm/extable.c  2010-03-07 12:23:35.953604355 -0500
15872 @@ -1,14 +1,71 @@
15873  #include <linux/module.h>
15874  #include <linux/spinlock.h>
15875 +#include <linux/sort.h>
15876  #include <asm/uaccess.h>
15877 +#include <asm/pgtable.h>
15878
15879 +/*
15880 + * The exception table needs to be sorted so that the binary
15881 + * search that we use to find entries in it works properly.
15882 + * This is used both for the kernel exception table and for
15883 + * the exception tables of modules that get loaded.
15884 + */
15885 +static int cmp_ex(const void *a, const void *b)
15886 +{
15887 +       const struct exception_table_entry *x = a, *y = b;
15888 +
15889 +       /* avoid overflow */
15890 +       if (x->insn > y->insn)
15891 +               return 1;
15892 +       if (x->insn < y->insn)
15893 +               return -1;
15894 +       return 0;
15895 +}
15896 +
15897 +static void swap_ex(void *a, void *b, int size)
15898 +{
15899 +       struct exception_table_entry t, *x = a, *y = b;
15900 +
15901 +       t = *x;
15902 +
15903 +       pax_open_kernel();
15904 +       *x = *y;
15905 +       *y = t;
15906 +       pax_close_kernel();
15907 +}
15908 +
15909 +void sort_extable(struct exception_table_entry *start,
15910 +                 struct exception_table_entry *finish)
15911 +{
15912 +       sort(start, finish - start, sizeof(struct exception_table_entry),
15913 +            cmp_ex, swap_ex);
15914 +}
15915 +
15916 +#ifdef CONFIG_MODULES
15917 +/*
15918 + * If the exception table is sorted, any referring to the module init
15919 + * will be at the beginning or the end.
15920 + */
15921 +void trim_init_extable(struct module *m)
15922 +{
15923 +       /*trim the beginning*/
15924 +       while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
15925 +               m->extable++;
15926 +               m->num_exentries--;
15927 +       }
15928 +       /*trim the end*/
15929 +       while (m->num_exentries &&
15930 +               within_module_init(m->extable[m->num_exentries-1].insn, m))
15931 +               m->num_exentries--;
15932 +}
15933 +#endif /* CONFIG_MODULES */
15934
15935  int fixup_exception(struct pt_regs *regs)
15936  {
15937         const struct exception_table_entry *fixup;
15938
15939  #ifdef CONFIG_PNPBIOS
15940 -       if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
15941 +       if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
15942                 extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
15943                 extern u32 pnp_bios_is_utter_crap;
15944                 pnp_bios_is_utter_crap = 1;
15945 diff -urNp linux-2.6.33/arch/x86/mm/fault.c linux-2.6.33/arch/x86/mm/fault.c
15946 --- linux-2.6.33/arch/x86/mm/fault.c    2010-02-24 13:52:17.000000000 -0500
15947 +++ linux-2.6.33/arch/x86/mm/fault.c    2010-03-07 12:23:35.953604355 -0500
15948 @@ -11,10 +11,14 @@
15949  #include <linux/kprobes.h>             /* __kprobes, ...               */
15950  #include <linux/mmiotrace.h>           /* kmmio_handler, ...           */
15951  #include <linux/perf_event.h>          /* perf_sw_event                */
15952 +#include <linux/unistd.h>
15953 +#include <linux/compiler.h>
15954
15955  #include <asm/traps.h>                 /* dotraplinkage, ...           */
15956  #include <asm/pgalloc.h>               /* pgd_*(), ...                 */
15957  #include <asm/kmemcheck.h>             /* kmemcheck_*(), ...           */
15958 +#include <asm/vsyscall.h>
15959 +#include <asm/tlbflush.h>
15960
15961  /*
15962   * Page fault error code bits:
15963 @@ -52,7 +56,7 @@ static inline int __kprobes notify_page_
15964         int ret = 0;
15965
15966         /* kprobe_running() needs smp_processor_id() */
15967 -       if (kprobes_built_in() && !user_mode_vm(regs)) {
15968 +       if (kprobes_built_in() && !user_mode(regs)) {
15969                 preempt_disable();
15970                 if (kprobe_running() && kprobe_fault_handler(regs, 14))
15971                         ret = 1;
15972 @@ -173,6 +177,30 @@ force_sig_info_fault(int si_signo, int s
15973         force_sig_info(si_signo, &info, tsk);
15974  }
15975
15976 +#ifdef CONFIG_PAX_EMUTRAMP
15977 +static int pax_handle_fetch_fault(struct pt_regs *regs);
15978 +#endif
15979 +
15980 +#ifdef CONFIG_PAX_PAGEEXEC
15981 +static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
15982 +{
15983 +       pgd_t *pgd;
15984 +       pud_t *pud;
15985 +       pmd_t *pmd;
15986 +
15987 +       pgd = pgd_offset(mm, address);
15988 +       if (!pgd_present(*pgd))
15989 +               return NULL;
15990 +       pud = pud_offset(pgd, address);
15991 +       if (!pud_present(*pud))
15992 +               return NULL;
15993 +       pmd = pmd_offset(pud, address);
15994 +       if (!pmd_present(*pmd))
15995 +               return NULL;
15996 +       return pmd;
15997 +}
15998 +#endif
15999 +
16000  DEFINE_SPINLOCK(pgd_lock);
16001  LIST_HEAD(pgd_list);
16002
16003 @@ -536,7 +564,7 @@ static int is_errata93(struct pt_regs *r
16004  static int is_errata100(struct pt_regs *regs, unsigned long address)
16005  {
16006  #ifdef CONFIG_X86_64
16007 -       if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
16008 +       if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
16009                 return 1;
16010  #endif
16011         return 0;
16012 @@ -563,7 +591,7 @@ static int is_f00f_bug(struct pt_regs *r
16013  }
16014
16015  static const char nx_warning[] = KERN_CRIT
16016 -"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
16017 +"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
16018
16019  static void
16020  show_fault_oops(struct pt_regs *regs, unsigned long error_code,
16021 @@ -572,15 +600,26 @@ show_fault_oops(struct pt_regs *regs, un
16022         if (!oops_may_print())
16023                 return;
16024
16025 -       if (error_code & PF_INSTR) {
16026 +       if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) {
16027                 unsigned int level;
16028
16029                 pte_t *pte = lookup_address(address, &level);
16030
16031                 if (pte && pte_present(*pte) && !pte_exec(*pte))
16032 -                       printk(nx_warning, current_uid());
16033 +                       printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
16034         }
16035
16036 +#ifdef CONFIG_PAX_KERNEXEC
16037 +       if (init_mm.start_code <= address && address < init_mm.end_code) {
16038 +               if (current->signal->curr_ip)
16039 +                       printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
16040 +                                        &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
16041 +               else
16042 +                       printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
16043 +                                        current->comm, task_pid_nr(current), current_uid(), current_euid());
16044 +       }
16045 +#endif
16046 +
16047         printk(KERN_ALERT "BUG: unable to handle kernel ");
16048         if (address < PAGE_SIZE)
16049                 printk(KERN_CONT "NULL pointer dereference");
16050 @@ -705,6 +744,68 @@ __bad_area_nosemaphore(struct pt_regs *r
16051                        unsigned long address, int si_code)
16052  {
16053         struct task_struct *tsk = current;
16054 +       struct mm_struct *mm = tsk->mm;
16055 +
16056 +#ifdef CONFIG_X86_64
16057 +       if (mm && (error_code & PF_INSTR)) {
16058 +               if (regs->ip == (unsigned long)vgettimeofday) {
16059 +                       regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
16060 +                       return;
16061 +               } else if (regs->ip == (unsigned long)vtime) {
16062 +                       regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
16063 +                       return;
16064 +               } else if (regs->ip == (unsigned long)vgetcpu) {
16065 +                       regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
16066 +                       return;
16067 +               }
16068 +       }
16069 +#endif
16070 +
16071 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16072 +       if (mm && (error_code & PF_USER)) {
16073 +               unsigned long ip = regs->ip;
16074 +
16075 +               if (v8086_mode(regs))
16076 +                       ip = ((regs->cs & 0xffff) << 4) + (regs->ip & 0xffff);
16077 +
16078 +               /*
16079 +                * It's possible to have interrupts off here:
16080 +                */
16081 +               local_irq_enable();
16082 +
16083 +#ifdef CONFIG_PAX_PAGEEXEC
16084 +               if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
16085 +                   (((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && regs->ip == address))) {
16086 +
16087 +#ifdef CONFIG_PAX_EMUTRAMP
16088 +                       switch (pax_handle_fetch_fault(regs)) {
16089 +                       case 2:
16090 +                               return;
16091 +                       }
16092 +#endif
16093 +
16094 +                       pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
16095 +                       do_group_exit(SIGKILL);
16096 +               }
16097 +#endif
16098 +
16099 +#ifdef CONFIG_PAX_SEGMEXEC
16100 +               if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (regs->ip + SEGMEXEC_TASK_SIZE == address)) {
16101 +
16102 +#ifdef CONFIG_PAX_EMUTRAMP
16103 +                       switch (pax_handle_fetch_fault(regs)) {
16104 +                       case 2:
16105 +                               return;
16106 +                       }
16107 +#endif
16108 +
16109 +                       pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
16110 +                       do_group_exit(SIGKILL);
16111 +               }
16112 +#endif
16113 +
16114 +       }
16115 +#endif
16116
16117         /* User mode accesses just cause a SIGSEGV */
16118         if (error_code & PF_USER) {
16119 @@ -849,6 +950,106 @@ static int spurious_fault_check(unsigned
16120         return 1;
16121  }
16122
16123 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
16124 +static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
16125 +{
16126 +       pte_t *pte;
16127 +       pmd_t *pmd;
16128 +       spinlock_t *ptl;
16129 +       unsigned char pte_mask;
16130 +
16131 +       if ((__supported_pte_mask & _PAGE_NX) || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
16132 +           !(mm->pax_flags & MF_PAX_PAGEEXEC))
16133 +               return 0;
16134 +
16135 +       /* PaX: it's our fault, let's handle it if we can */
16136 +
16137 +       /* PaX: take a look at read faults before acquiring any locks */
16138 +       if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
16139 +               /* instruction fetch attempt from a protected page in user mode */
16140 +               up_read(&mm->mmap_sem);
16141 +
16142 +#ifdef CONFIG_PAX_EMUTRAMP
16143 +               switch (pax_handle_fetch_fault(regs)) {
16144 +               case 2:
16145 +                       return 1;
16146 +               }
16147 +#endif
16148 +
16149 +               pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
16150 +               do_group_exit(SIGKILL);
16151 +       }
16152 +
16153 +       pmd = pax_get_pmd(mm, address);
16154 +       if (unlikely(!pmd))
16155 +               return 0;
16156 +
16157 +       pte = pte_offset_map_lock(mm, pmd, address, &ptl);
16158 +       if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
16159 +               pte_unmap_unlock(pte, ptl);
16160 +               return 0;
16161 +       }
16162 +
16163 +       if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
16164 +               /* write attempt to a protected page in user mode */
16165 +               pte_unmap_unlock(pte, ptl);
16166 +               return 0;
16167 +       }
16168 +
16169 +#ifdef CONFIG_SMP
16170 +       if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
16171 +#else
16172 +       if (likely(address > get_limit(regs->cs)))
16173 +#endif
16174 +       {
16175 +               set_pte(pte, pte_mkread(*pte));
16176 +               __flush_tlb_one(address);
16177 +               pte_unmap_unlock(pte, ptl);
16178 +               up_read(&mm->mmap_sem);
16179 +               return 1;
16180 +       }
16181 +
16182 +       pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
16183 +
16184 +       /*
16185 +        * PaX: fill DTLB with user rights and retry
16186 +        */
16187 +       __asm__ __volatile__ (
16188 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16189 +               "movw %w4,%%es\n"
16190 +#endif
16191 +               "orb %2,(%1)\n"
16192 +#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
16193 +/*
16194 + * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
16195 + * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
16196 + * page fault when examined during a TLB load attempt. this is true not only
16197 + * for PTEs holding a non-present entry but also present entries that will
16198 + * raise a page fault (such as those set up by PaX, or the copy-on-write
16199 + * mechanism). in effect it means that we do *not* need to flush the TLBs
16200 + * for our target pages since their PTEs are simply not in the TLBs at all.
16201 +
16202 + * the best thing in omitting it is that we gain around 15-20% speed in the
16203 + * fast path of the page fault handler and can get rid of tracing since we
16204 + * can no longer flush unintended entries.
16205 + */
16206 +               "invlpg (%0)\n"
16207 +#endif
16208 +               "testb $0,%%es:(%0)\n"
16209 +               "xorb %3,(%1)\n"
16210 +#ifdef CONFIG_PAX_MEMORY_UDEREF
16211 +               "pushl %%ss\n"
16212 +               "popl %%es\n"
16213 +#endif
16214 +               :
16215 +               : "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER), "r" (__USER_DS)
16216 +               : "memory", "cc");
16217 +       pte_unmap_unlock(pte, ptl);
16218 +       up_read(&mm->mmap_sem);
16219 +       return 1;
16220 +}
16221 +#endif
16222 +
16223  /*
16224   * Handle a spurious fault caused by a stale TLB entry.
16225   *
16226 @@ -915,6 +1116,9 @@ int show_unhandled_signals = 1;
16227  static inline int
16228  access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
16229  {
16230 +       if ((__supported_pte_mask & _PAGE_NX) && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
16231 +               return 1;
16232 +
16233         if (write) {
16234                 /* write, present and write, not present: */
16235                 if (unlikely(!(vma->vm_flags & VM_WRITE)))
16236 @@ -948,17 +1152,16 @@ do_page_fault(struct pt_regs *regs, unsi
16237  {
16238         struct vm_area_struct *vma;
16239         struct task_struct *tsk;
16240 -       unsigned long address;
16241         struct mm_struct *mm;
16242         int write;
16243         int fault;
16244
16245 +       /* Get the faulting address: */
16246 +       const unsigned long address = read_cr2();
16247 +
16248         tsk = current;
16249         mm = tsk->mm;
16250
16251 -       /* Get the faulting address: */
16252 -       address = read_cr2();
16253 -
16254         /*
16255          * Detect and handle instructions that would cause a page fault for
16256          * both a tracked kernel page and a userspace page.
16257 @@ -1018,7 +1221,7 @@ do_page_fault(struct pt_regs *regs, unsi
16258          * User-mode registers count as a user access even for any
16259          * potential system fault or CPU buglet:
16260          */
16261 -       if (user_mode_vm(regs)) {
16262 +       if (user_mode(regs)) {
16263                 local_irq_enable();
16264                 error_code |= PF_USER;
16265         } else {
16266 @@ -1072,6 +1275,11 @@ do_page_fault(struct pt_regs *regs, unsi
16267                 might_sleep();
16268         }
16269
16270 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
16271 +       if (pax_handle_pageexec_fault(regs, mm, address, error_code))
16272 +               return;
16273 +#endif
16274 +
16275         vma = find_vma(mm, address);
16276         if (unlikely(!vma)) {
16277                 bad_area(regs, error_code, address);
16278 @@ -1083,18 +1291,24 @@ do_page_fault(struct pt_regs *regs, unsi
16279                 bad_area(regs, error_code, address);
16280                 return;
16281         }
16282 -       if (error_code & PF_USER) {
16283 -               /*
16284 -                * Accessing the stack below %sp is always a bug.
16285 -                * The large cushion allows instructions like enter
16286 -                * and pusha to work. ("enter $65535, $31" pushes
16287 -                * 32 pointers and then decrements %sp by 65535.)
16288 -                */
16289 -               if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
16290 -                       bad_area(regs, error_code, address);
16291 -                       return;
16292 -               }
16293 +       /*
16294 +        * Accessing the stack below %sp is always a bug.
16295 +        * The large cushion allows instructions like enter
16296 +        * and pusha to work. ("enter $65535, $31" pushes
16297 +        * 32 pointers and then decrements %sp by 65535.)
16298 +        */
16299 +       if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
16300 +               bad_area(regs, error_code, address);
16301 +               return;
16302 +       }
16303 +
16304 +#ifdef CONFIG_PAX_SEGMEXEC
16305 +       if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
16306 +               bad_area(regs, error_code, address);
16307 +               return;
16308         }
16309 +#endif
16310 +
16311         if (unlikely(expand_stack(vma, address))) {
16312                 bad_area(regs, error_code, address);
16313                 return;
16314 @@ -1138,3 +1352,199 @@ good_area:
16315
16316         up_read(&mm->mmap_sem);
16317  }
16318 +
16319 +#ifdef CONFIG_PAX_EMUTRAMP
16320 +static int pax_handle_fetch_fault_32(struct pt_regs *regs)
16321 +{
16322 +       int err;
16323 +
16324 +       do { /* PaX: gcc trampoline emulation #1 */
16325 +               unsigned char mov1, mov2;
16326 +               unsigned short jmp;
16327 +               unsigned int addr1, addr2;
16328 +
16329 +#ifdef CONFIG_X86_64
16330 +               if ((regs->ip + 11) >> 32)
16331 +                       break;
16332 +#endif
16333 +
16334 +               err = get_user(mov1, (unsigned char __user *)regs->ip);
16335 +               err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
16336 +               err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
16337 +               err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
16338 +               err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
16339 +
16340 +               if (err)
16341 +                       break;
16342 +
16343 +               if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
16344 +                       regs->cx = addr1;
16345 +                       regs->ax = addr2;
16346 +                       regs->ip = addr2;
16347 +                       return 2;
16348 +               }
16349 +       } while (0);
16350 +
16351 +       do { /* PaX: gcc trampoline emulation #2 */
16352 +               unsigned char mov, jmp;
16353 +               unsigned int addr1, addr2;
16354 +
16355 +#ifdef CONFIG_X86_64
16356 +               if ((regs->ip + 9) >> 32)
16357 +                       break;
16358 +#endif
16359 +
16360 +               err = get_user(mov, (unsigned char __user *)regs->ip);
16361 +               err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
16362 +               err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
16363 +               err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
16364 +
16365 +               if (err)
16366 +                       break;
16367 +
16368 +               if (mov == 0xB9 && jmp == 0xE9) {
16369 +                       regs->cx = addr1;
16370 +                       regs->ip = (unsigned int)(regs->ip + addr2 + 10);
16371 +                       return 2;
16372 +               }
16373 +       } while (0);
16374 +
16375 +       return 1; /* PaX in action */
16376 +}
16377 +
16378 +#ifdef CONFIG_X86_64
16379 +static int pax_handle_fetch_fault_64(struct pt_regs *regs)
16380 +{
16381 +       int err;
16382 +
16383 +       do { /* PaX: gcc trampoline emulation #1 */
16384 +               unsigned short mov1, mov2, jmp1;
16385 +               unsigned char jmp2;
16386 +               unsigned int addr1;
16387 +               unsigned long addr2;
16388 +
16389 +               err = get_user(mov1, (unsigned short __user *)regs->ip);
16390 +               err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
16391 +               err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
16392 +               err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
16393 +               err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
16394 +               err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
16395 +
16396 +               if (err)
16397 +                       break;
16398 +
16399 +               if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
16400 +                       regs->r11 = addr1;
16401 +                       regs->r10 = addr2;
16402 +                       regs->ip = addr1;
16403 +                       return 2;
16404 +               }
16405 +       } while (0);
16406 +
16407 +       do { /* PaX: gcc trampoline emulation #2 */
16408 +               unsigned short mov1, mov2, jmp1;
16409 +               unsigned char jmp2;
16410 +               unsigned long addr1, addr2;
16411 +
16412 +               err = get_user(mov1, (unsigned short __user *)regs->ip);
16413 +               err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
16414 +               err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
16415 +               err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
16416 +               err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
16417 +               err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
16418 +
16419 +               if (err)
16420 +                       break;
16421 +
16422 +               if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
16423 +                       regs->r11 = addr1;
16424 +                       regs->r10 = addr2;
16425 +                       regs->ip = addr1;
16426 +                       return 2;
16427 +               }
16428 +       } while (0);
16429 +
16430 +       return 1; /* PaX in action */
16431 +}
16432 +#endif
16433 +
16434 +/*
16435 + * PaX: decide what to do with offenders (regs->ip = fault address)
16436 + *
16437 + * returns 1 when task should be killed
16438 + *         2 when gcc trampoline was detected
16439 + */
16440 +static int pax_handle_fetch_fault(struct pt_regs *regs)
16441 +{
16442 +       if (v8086_mode(regs))
16443 +               return 1;
16444 +
16445 +       if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
16446 +               return 1;
16447 +
16448 +#ifdef CONFIG_X86_32
16449 +       return pax_handle_fetch_fault_32(regs);
16450 +#else
16451 +       if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
16452 +               return pax_handle_fetch_fault_32(regs);
16453 +       else
16454 +               return pax_handle_fetch_fault_64(regs);
16455 +#endif
16456 +}
16457 +#endif
16458 +
16459 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16460 +void pax_report_insns(void *pc, void *sp)
16461 +{
16462 +       long i;
16463 +
16464 +       printk(KERN_ERR "PAX: bytes at PC: ");
16465 +       for (i = 0; i < 20; i++) {
16466 +               unsigned char c;
16467 +               if (get_user(c, (__force unsigned char __user *)pc+i))
16468 +                       printk(KERN_CONT "?? ");
16469 +               else
16470 +                       printk(KERN_CONT "%02x ", c);
16471 +       }
16472 +       printk("\n");
16473 +
16474 +       printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
16475 +       for (i = -1; i < 80 / (long)sizeof(long); i++) {
16476 +               unsigned long c;
16477 +               if (get_user(c, (__force unsigned long __user *)sp+i))
16478 +#ifdef CONFIG_X86_32
16479 +                       printk(KERN_CONT "???????? ");
16480 +#else
16481 +                       printk(KERN_CONT "???????????????? ");
16482 +#endif
16483 +               else
16484 +                       printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
16485 +       }
16486 +       printk("\n");
16487 +}
16488 +#endif
16489 +
16490 +/**
16491 + * probe_kernel_write(): safely attempt to write to a location
16492 + * @dst: address to write to
16493 + * @src: pointer to the data that shall be written
16494 + * @size: size of the data chunk
16495 + *
16496 + * Safely write to address @dst from the buffer at @src.  If a kernel fault
16497 + * happens, handle that and return -EFAULT.
16498 + */
16499 +long notrace probe_kernel_write(void *dst, const void *src, size_t size)
16500 +{
16501 +       long ret;
16502 +       mm_segment_t old_fs = get_fs();
16503 +
16504 +       set_fs(KERNEL_DS);
16505 +       pagefault_disable();
16506 +       pax_open_kernel();
16507 +       ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
16508 +       pax_close_kernel();
16509 +       pagefault_enable();
16510 +       set_fs(old_fs);
16511 +
16512 +       return ret ? -EFAULT : 0;
16513 +}
16514 diff -urNp linux-2.6.33/arch/x86/mm/gup.c linux-2.6.33/arch/x86/mm/gup.c
16515 --- linux-2.6.33/arch/x86/mm/gup.c      2010-02-24 13:52:17.000000000 -0500
16516 +++ linux-2.6.33/arch/x86/mm/gup.c      2010-03-07 12:23:35.953604355 -0500
16517 @@ -237,7 +237,7 @@ int __get_user_pages_fast(unsigned long
16518         addr = start;
16519         len = (unsigned long) nr_pages << PAGE_SHIFT;
16520         end = start + len;
16521 -       if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
16522 +       if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
16523                                         (void __user *)start, len)))
16524                 return 0;
16525
16526 diff -urNp linux-2.6.33/arch/x86/mm/highmem_32.c linux-2.6.33/arch/x86/mm/highmem_32.c
16527 --- linux-2.6.33/arch/x86/mm/highmem_32.c       2010-02-24 13:52:17.000000000 -0500
16528 +++ linux-2.6.33/arch/x86/mm/highmem_32.c       2010-03-07 12:23:35.953604355 -0500
16529 @@ -43,7 +43,10 @@ void *kmap_atomic_prot(struct page *page
16530         idx = type + KM_TYPE_NR*smp_processor_id();
16531         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
16532         BUG_ON(!pte_none(*(kmap_pte-idx)));
16533 +
16534 +       pax_open_kernel();
16535         set_pte(kmap_pte-idx, mk_pte(page, prot));
16536 +       pax_close_kernel();
16537
16538         return (void *)vaddr;
16539  }
16540 diff -urNp linux-2.6.33/arch/x86/mm/hugetlbpage.c linux-2.6.33/arch/x86/mm/hugetlbpage.c
16541 --- linux-2.6.33/arch/x86/mm/hugetlbpage.c      2010-02-24 13:52:17.000000000 -0500
16542 +++ linux-2.6.33/arch/x86/mm/hugetlbpage.c      2010-03-07 12:23:35.953604355 -0500
16543 @@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
16544         struct hstate *h = hstate_file(file);
16545         struct mm_struct *mm = current->mm;
16546         struct vm_area_struct *vma;
16547 -       unsigned long start_addr;
16548 +       unsigned long start_addr, pax_task_size = TASK_SIZE;
16549 +
16550 +#ifdef CONFIG_PAX_SEGMEXEC
16551 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
16552 +               pax_task_size = SEGMEXEC_TASK_SIZE;
16553 +#endif
16554
16555         if (len > mm->cached_hole_size) {
16556 -               start_addr = mm->free_area_cache;
16557 +               start_addr = mm->free_area_cache;
16558         } else {
16559 -               start_addr = TASK_UNMAPPED_BASE;
16560 -               mm->cached_hole_size = 0;
16561 +               start_addr = mm->mmap_base;
16562 +               mm->cached_hole_size = 0;
16563         }
16564
16565  full_search:
16566 @@ -281,13 +286,13 @@ full_search:
16567
16568         for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
16569                 /* At this point:  (!vma || addr < vma->vm_end). */
16570 -               if (TASK_SIZE - len < addr) {
16571 +               if (pax_task_size - len < addr) {
16572                         /*
16573                          * Start a new search - just in case we missed
16574                          * some holes.
16575                          */
16576 -                       if (start_addr != TASK_UNMAPPED_BASE) {
16577 -                               start_addr = TASK_UNMAPPED_BASE;
16578 +                       if (start_addr != mm->mmap_base) {
16579 +                               start_addr = mm->mmap_base;
16580                                 mm->cached_hole_size = 0;
16581                                 goto full_search;
16582                         }
16583 @@ -310,9 +315,8 @@ static unsigned long hugetlb_get_unmappe
16584         struct hstate *h = hstate_file(file);
16585         struct mm_struct *mm = current->mm;
16586         struct vm_area_struct *vma, *prev_vma;
16587 -       unsigned long base = mm->mmap_base, addr = addr0;
16588 +       unsigned long base = mm->mmap_base, addr;
16589         unsigned long largest_hole = mm->cached_hole_size;
16590 -       int first_time = 1;
16591
16592         /* don't allow allocations above current base */
16593         if (mm->free_area_cache > base)
16594 @@ -322,7 +326,7 @@ static unsigned long hugetlb_get_unmappe
16595                 largest_hole = 0;
16596                 mm->free_area_cache  = base;
16597         }
16598 -try_again:
16599 +
16600         /* make sure it can fit in the remaining address space */
16601         if (mm->free_area_cache < len)
16602                 goto fail;
16603 @@ -364,22 +368,26 @@ try_again:
16604
16605  fail:
16606         /*
16607 -        * if hint left us with no space for the requested
16608 -        * mapping then try again:
16609 -        */
16610 -       if (first_time) {
16611 -               mm->free_area_cache = base;
16612 -               largest_hole = 0;
16613 -               first_time = 0;
16614 -               goto try_again;
16615 -       }
16616 -       /*
16617          * A failed mmap() very likely causes application failure,
16618          * so fall back to the bottom-up function here. This scenario
16619          * can happen with large stack limits and large mmap()
16620          * allocations.
16621          */
16622 -       mm->free_area_cache = TASK_UNMAPPED_BASE;
16623 +
16624 +#ifdef CONFIG_PAX_SEGMEXEC
16625 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
16626 +               mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
16627 +       else
16628 +#endif
16629 +
16630 +       mm->mmap_base = TASK_UNMAPPED_BASE;
16631 +
16632 +#ifdef CONFIG_PAX_RANDMMAP
16633 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
16634 +               mm->mmap_base += mm->delta_mmap;
16635 +#endif
16636 +
16637 +       mm->free_area_cache = mm->mmap_base;
16638         mm->cached_hole_size = ~0UL;
16639         addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
16640                         len, pgoff, flags);
16641 @@ -387,6 +395,7 @@ fail:
16642         /*
16643          * Restore the topdown base:
16644          */
16645 +       mm->mmap_base = base;
16646         mm->free_area_cache = base;
16647         mm->cached_hole_size = ~0UL;
16648
16649 @@ -400,10 +409,17 @@ hugetlb_get_unmapped_area(struct file *f
16650         struct hstate *h = hstate_file(file);
16651         struct mm_struct *mm = current->mm;
16652         struct vm_area_struct *vma;
16653 +       unsigned long pax_task_size = TASK_SIZE;
16654
16655         if (len & ~huge_page_mask(h))
16656                 return -EINVAL;
16657 -       if (len > TASK_SIZE)
16658 +
16659 +#ifdef CONFIG_PAX_SEGMEXEC
16660 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
16661 +               pax_task_size = SEGMEXEC_TASK_SIZE;
16662 +#endif
16663 +
16664 +       if (len > pax_task_size)
16665                 return -ENOMEM;
16666
16667         if (flags & MAP_FIXED) {
16668 @@ -415,7 +431,7 @@ hugetlb_get_unmapped_area(struct file *f
16669         if (addr) {
16670                 addr = ALIGN(addr, huge_page_size(h));
16671                 vma = find_vma(mm, addr);
16672 -               if (TASK_SIZE - len >= addr &&
16673 +               if (pax_task_size - len >= addr &&
16674                     (!vma || addr + len <= vma->vm_start))
16675                         return addr;
16676         }
16677 diff -urNp linux-2.6.33/arch/x86/mm/init_32.c linux-2.6.33/arch/x86/mm/init_32.c
16678 --- linux-2.6.33/arch/x86/mm/init_32.c  2010-02-24 13:52:17.000000000 -0500
16679 +++ linux-2.6.33/arch/x86/mm/init_32.c  2010-03-07 12:23:35.953604355 -0500
16680 @@ -72,36 +72,6 @@ static __init void *alloc_low_page(void)
16681  }
16682
16683  /*
16684 - * Creates a middle page table and puts a pointer to it in the
16685 - * given global directory entry. This only returns the gd entry
16686 - * in non-PAE compilation mode, since the middle layer is folded.
16687 - */
16688 -static pmd_t * __init one_md_table_init(pgd_t *pgd)
16689 -{
16690 -       pud_t *pud;
16691 -       pmd_t *pmd_table;
16692 -
16693 -#ifdef CONFIG_X86_PAE
16694 -       if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
16695 -               if (after_bootmem)
16696 -                       pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
16697 -               else
16698 -                       pmd_table = (pmd_t *)alloc_low_page();
16699 -               paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
16700 -               set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
16701 -               pud = pud_offset(pgd, 0);
16702 -               BUG_ON(pmd_table != pmd_offset(pud, 0));
16703 -
16704 -               return pmd_table;
16705 -       }
16706 -#endif
16707 -       pud = pud_offset(pgd, 0);
16708 -       pmd_table = pmd_offset(pud, 0);
16709 -
16710 -       return pmd_table;
16711 -}
16712 -
16713 -/*
16714   * Create a page table and place a pointer to it in a middle page
16715   * directory entry:
16716   */
16717 @@ -121,13 +91,28 @@ static pte_t * __init one_page_table_ini
16718                         page_table = (pte_t *)alloc_low_page();
16719
16720                 paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
16721 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
16722 +               set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
16723 +#else
16724                 set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
16725 +#endif
16726                 BUG_ON(page_table != pte_offset_kernel(pmd, 0));
16727         }
16728
16729         return pte_offset_kernel(pmd, 0);
16730  }
16731
16732 +static pmd_t * __init one_md_table_init(pgd_t *pgd)
16733 +{
16734 +       pud_t *pud;
16735 +       pmd_t *pmd_table;
16736 +
16737 +       pud = pud_offset(pgd, 0);
16738 +       pmd_table = pmd_offset(pud, 0);
16739 +
16740 +       return pmd_table;
16741 +}
16742 +
16743  pmd_t * __init populate_extra_pmd(unsigned long vaddr)
16744  {
16745         int pgd_idx = pgd_index(vaddr);
16746 @@ -201,6 +186,7 @@ page_table_range_init(unsigned long star
16747         int pgd_idx, pmd_idx;
16748         unsigned long vaddr;
16749         pgd_t *pgd;
16750 +       pud_t *pud;
16751         pmd_t *pmd;
16752         pte_t *pte = NULL;
16753
16754 @@ -210,8 +196,13 @@ page_table_range_init(unsigned long star
16755         pgd = pgd_base + pgd_idx;
16756
16757         for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
16758 -               pmd = one_md_table_init(pgd);
16759 -               pmd = pmd + pmd_index(vaddr);
16760 +               pud = pud_offset(pgd, vaddr);
16761 +               pmd = pmd_offset(pud, vaddr);
16762 +
16763 +#ifdef CONFIG_X86_PAE
16764 +               paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
16765 +#endif
16766 +
16767                 for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
16768                                                         pmd++, pmd_idx++) {
16769                         pte = page_table_kmap_check(one_page_table_init(pmd),
16770 @@ -223,11 +214,20 @@ page_table_range_init(unsigned long star
16771         }
16772  }
16773
16774 -static inline int is_kernel_text(unsigned long addr)
16775 +static inline int is_kernel_text(unsigned long start, unsigned long end)
16776  {
16777 -       if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
16778 -               return 1;
16779 -       return 0;
16780 +       if ((start > ktla_ktva((unsigned long)_etext) ||
16781 +            end <= ktla_ktva((unsigned long)_stext)) &&
16782 +           (start > ktla_ktva((unsigned long)_einittext) ||
16783 +            end <= ktla_ktva((unsigned long)_sinittext)) &&
16784 +
16785 +#ifdef CONFIG_ACPI_SLEEP
16786 +           (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
16787 +#endif
16788 +
16789 +           (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
16790 +               return 0;
16791 +       return 1;
16792  }
16793
16794  /*
16795 @@ -243,9 +243,10 @@ kernel_physical_mapping_init(unsigned lo
16796         int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
16797         unsigned long start_pfn, end_pfn;
16798         pgd_t *pgd_base = swapper_pg_dir;
16799 -       int pgd_idx, pmd_idx, pte_ofs;
16800 +       unsigned int pgd_idx, pmd_idx, pte_ofs;
16801         unsigned long pfn;
16802         pgd_t *pgd;
16803 +       pud_t *pud;
16804         pmd_t *pmd;
16805         pte_t *pte;
16806         unsigned pages_2m, pages_4k;
16807 @@ -278,8 +279,13 @@ repeat:
16808         pfn = start_pfn;
16809         pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
16810         pgd = pgd_base + pgd_idx;
16811 -       for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
16812 -               pmd = one_md_table_init(pgd);
16813 +       for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
16814 +               pud = pud_offset(pgd, 0);
16815 +               pmd = pmd_offset(pud, 0);
16816 +
16817 +#ifdef CONFIG_X86_PAE
16818 +               paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
16819 +#endif
16820
16821                 if (pfn >= end_pfn)
16822                         continue;
16823 @@ -291,14 +297,13 @@ repeat:
16824  #endif
16825                 for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
16826                      pmd++, pmd_idx++) {
16827 -                       unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
16828 +                       unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
16829
16830                         /*
16831                          * Map with big pages if possible, otherwise
16832                          * create normal page tables:
16833                          */
16834                         if (use_pse) {
16835 -                               unsigned int addr2;
16836                                 pgprot_t prot = PAGE_KERNEL_LARGE;
16837                                 /*
16838                                  * first pass will use the same initial
16839 @@ -308,11 +313,7 @@ repeat:
16840                                         __pgprot(PTE_IDENT_ATTR |
16841                                                  _PAGE_PSE);
16842
16843 -                               addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
16844 -                                       PAGE_OFFSET + PAGE_SIZE-1;
16845 -
16846 -                               if (is_kernel_text(addr) ||
16847 -                                   is_kernel_text(addr2))
16848 +                               if (is_kernel_text(address, address + PMD_SIZE))
16849                                         prot = PAGE_KERNEL_LARGE_EXEC;
16850
16851                                 pages_2m++;
16852 @@ -329,7 +330,7 @@ repeat:
16853                         pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
16854                         pte += pte_ofs;
16855                         for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
16856 -                            pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
16857 +                            pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
16858                                 pgprot_t prot = PAGE_KERNEL;
16859                                 /*
16860                                  * first pass will use the same initial
16861 @@ -337,7 +338,7 @@ repeat:
16862                                  */
16863                                 pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
16864
16865 -                               if (is_kernel_text(addr))
16866 +                               if (is_kernel_text(address, address + PAGE_SIZE))
16867                                         prot = PAGE_KERNEL_EXEC;
16868
16869                                 pages_4k++;
16870 @@ -489,7 +490,7 @@ void __init native_pagetable_setup_start
16871
16872                 pud = pud_offset(pgd, va);
16873                 pmd = pmd_offset(pud, va);
16874 -               if (!pmd_present(*pmd))
16875 +               if (!pmd_present(*pmd) || pmd_huge(*pmd))
16876                         break;
16877
16878                 pte = pte_offset_kernel(pmd, va);
16879 @@ -541,9 +542,7 @@ void __init early_ioremap_page_table_ran
16880
16881  static void __init pagetable_init(void)
16882  {
16883 -       pgd_t *pgd_base = swapper_pg_dir;
16884 -
16885 -       permanent_kmaps_init(pgd_base);
16886 +       permanent_kmaps_init(swapper_pg_dir);
16887  }
16888
16889  #ifdef CONFIG_ACPI_SLEEP
16890 @@ -551,12 +550,12 @@ static void __init pagetable_init(void)
16891   * ACPI suspend needs this for resume, because things like the intel-agp
16892   * driver might have split up a kernel 4MB mapping.
16893   */
16894 -char swsusp_pg_dir[PAGE_SIZE]
16895 +pgd_t swsusp_pg_dir[PTRS_PER_PGD]
16896         __attribute__ ((aligned(PAGE_SIZE)));
16897
16898  static inline void save_pg_dir(void)
16899  {
16900 -       memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
16901 +       clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
16902  }
16903  #else /* !CONFIG_ACPI_SLEEP */
16904  static inline void save_pg_dir(void)
16905 @@ -588,7 +587,7 @@ void zap_low_mappings(bool early)
16906                 flush_tlb_all();
16907  }
16908
16909 -pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
16910 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
16911  EXPORT_SYMBOL_GPL(__supported_pte_mask);
16912
16913  /* user-defined highmem size */
16914 @@ -881,7 +880,7 @@ void __init mem_init(void)
16915         set_highmem_pages_init();
16916
16917         codesize =  (unsigned long) &_etext - (unsigned long) &_text;
16918 -       datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
16919 +       datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
16920         initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
16921
16922         printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
16923 @@ -922,10 +921,10 @@ void __init mem_init(void)
16924                 ((unsigned long)&__init_end -
16925                  (unsigned long)&__init_begin) >> 10,
16926
16927 -               (unsigned long)&_etext, (unsigned long)&_edata,
16928 -               ((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
16929 +               (unsigned long)&_sdata, (unsigned long)&_edata,
16930 +               ((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
16931
16932 -               (unsigned long)&_text, (unsigned long)&_etext,
16933 +               ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
16934                 ((unsigned long)&_etext - (unsigned long)&_text) >> 10);
16935
16936         /*
16937 @@ -1006,6 +1005,7 @@ void set_kernel_text_rw(void)
16938         if (!kernel_set_to_readonly)
16939                 return;
16940
16941 +       start = ktla_ktva(start);
16942         pr_debug("Set kernel text: %lx - %lx for read write\n",
16943                  start, start+size);
16944
16945 @@ -1020,6 +1020,7 @@ void set_kernel_text_ro(void)
16946         if (!kernel_set_to_readonly)
16947                 return;
16948
16949 +       start = ktla_ktva(start);
16950         pr_debug("Set kernel text: %lx - %lx for read only\n",
16951                  start, start+size);
16952
16953 @@ -1031,6 +1032,7 @@ void mark_rodata_ro(void)
16954         unsigned long start = PFN_ALIGN(_text);
16955         unsigned long size = PFN_ALIGN(_etext) - start;
16956
16957 +       start = ktla_ktva(start);
16958         set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
16959         printk(KERN_INFO "Write protecting the kernel text: %luk\n",
16960                 size >> 10);
16961 diff -urNp linux-2.6.33/arch/x86/mm/init_64.c linux-2.6.33/arch/x86/mm/init_64.c
16962 --- linux-2.6.33/arch/x86/mm/init_64.c  2010-02-24 13:52:17.000000000 -0500
16963 +++ linux-2.6.33/arch/x86/mm/init_64.c  2010-03-07 12:23:35.953604355 -0500
16964 @@ -73,7 +73,7 @@ early_param("gbpages", parse_direct_gbpa
16965   * around without checking the pgd every time.
16966   */
16967
16968 -pteval_t __supported_pte_mask __read_mostly = ~_PAGE_IOMAP;
16969 +pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_IOMAP);
16970  EXPORT_SYMBOL_GPL(__supported_pte_mask);
16971
16972  int force_personality32;
16973 @@ -164,7 +164,9 @@ void set_pte_vaddr_pud(pud_t *pud_page,
16974         pmd = fill_pmd(pud, vaddr);
16975         pte = fill_pte(pmd, vaddr);
16976
16977 +       pax_open_kernel();
16978         set_pte(pte, new_pte);
16979 +       pax_close_kernel();
16980
16981         /*
16982          * It's enough to flush this one mapping.
16983 @@ -223,14 +225,12 @@ static void __init __init_extra_mapping(
16984                 pgd = pgd_offset_k((unsigned long)__va(phys));
16985                 if (pgd_none(*pgd)) {
16986                         pud = (pud_t *) spp_getpage();
16987 -                       set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
16988 -                                               _PAGE_USER));
16989 +                       set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
16990                 }
16991                 pud = pud_offset(pgd, (unsigned long)__va(phys));
16992                 if (pud_none(*pud)) {
16993                         pmd = (pmd_t *) spp_getpage();
16994 -                       set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
16995 -                                               _PAGE_USER));
16996 +                       set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
16997                 }
16998                 pmd = pmd_offset(pud, phys);
16999                 BUG_ON(!pmd_none(*pmd));
17000 @@ -882,8 +882,8 @@ int kern_addr_valid(unsigned long addr)
17001  static struct vm_area_struct gate_vma = {
17002         .vm_start       = VSYSCALL_START,
17003         .vm_end         = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
17004 -       .vm_page_prot   = PAGE_READONLY_EXEC,
17005 -       .vm_flags       = VM_READ | VM_EXEC
17006 +       .vm_page_prot   = PAGE_READONLY,
17007 +       .vm_flags       = VM_READ
17008  };
17009
17010  struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
17011 @@ -917,7 +917,7 @@ int in_gate_area_no_task(unsigned long a
17012
17013  const char *arch_vma_name(struct vm_area_struct *vma)
17014  {
17015 -       if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
17016 +       if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
17017                 return "[vdso]";
17018         if (vma == &gate_vma)
17019                 return "[vsyscall]";
17020 diff -urNp linux-2.6.33/arch/x86/mm/init.c linux-2.6.33/arch/x86/mm/init.c
17021 --- linux-2.6.33/arch/x86/mm/init.c     2010-02-24 13:52:17.000000000 -0500
17022 +++ linux-2.6.33/arch/x86/mm/init.c     2010-03-07 12:23:35.953604355 -0500
17023 @@ -327,7 +327,13 @@ unsigned long __init_refok init_memory_m
17024   */
17025  int devmem_is_allowed(unsigned long pagenr)
17026  {
17027 -       if (pagenr <= 256)
17028 +       if (!pagenr)
17029 +               return 1;
17030 +#ifdef CONFIG_VM86
17031 +       if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
17032 +               return 1;
17033 +#endif
17034 +       if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
17035                 return 1;
17036         if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
17037                 return 0;
17038 @@ -375,6 +381,87 @@ void free_init_pages(char *what, unsigne
17039
17040  void free_initmem(void)
17041  {
17042 +
17043 +#ifdef CONFIG_PAX_KERNEXEC
17044 +       pgd_t *pgd;
17045 +       pud_t *pud;
17046 +       pmd_t *pmd;
17047 +
17048 +#ifdef CONFIG_X86_32
17049 +       /* PaX: limit KERNEL_CS to actual size */
17050 +       unsigned long addr, limit;
17051 +       struct desc_struct d;
17052 +       int cpu;
17053 +
17054 +       limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
17055 +       limit = (limit - 1UL) >> PAGE_SHIFT;
17056 +
17057 +       memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
17058 +       for (cpu = 0; cpu < NR_CPUS; cpu++) {
17059 +               pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
17060 +               write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
17061 +       }
17062 +
17063 +       /* PaX: make KERNEL_CS read-only */
17064 +       addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
17065 +       if (!paravirt_enabled())
17066 +               set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
17067 +/*
17068 +               for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
17069 +                       pgd = pgd_offset_k(addr);
17070 +                       pud = pud_offset(pgd, addr);
17071 +                       pmd = pmd_offset(pud, addr);
17072 +                       set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
17073 +               }
17074 +*/
17075 +#ifdef CONFIG_X86_PAE
17076 +       set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
17077 +       for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
17078 +               pgd = pgd_offset_k(addr);
17079 +               pud = pud_offset(pgd, addr);
17080 +               pmd = pmd_offset(pud, addr);
17081 +               set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
17082 +       }
17083 +#endif
17084 +
17085 +#ifdef CONFIG_MODULES
17086 +       set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
17087 +#endif
17088 +
17089 +#else
17090 +       unsigned long addr, end;
17091 +
17092 +       /* PaX: make kernel code/rodata read-only, rest non-executable */
17093 +       for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
17094 +               pgd = pgd_offset_k(addr);
17095 +               pud = pud_offset(pgd, addr);
17096 +               pmd = pmd_offset(pud, addr);
17097 +               if (!pmd_present(*pmd))
17098 +                       continue;
17099 +               if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
17100 +                       set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
17101 +               else
17102 +                       set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
17103 +       }
17104 +
17105 +       addr = (unsigned long)__va(__pa(__START_KERNEL_map));
17106 +       end = addr + KERNEL_IMAGE_SIZE;
17107 +       for (; addr < end; addr += PMD_SIZE) {
17108 +               pgd = pgd_offset_k(addr);
17109 +               pud = pud_offset(pgd, addr);
17110 +               pmd = pmd_offset(pud, addr);
17111 +               if (!pmd_present(*pmd))
17112 +                       continue;
17113 +               if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
17114 +                       set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
17115 +               else
17116 +                       set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
17117 +       }
17118 +#endif
17119 +
17120 +       flush_tlb_all();
17121 +#endif
17122 +
17123         free_init_pages("unused kernel memory",
17124                         (unsigned long)(&__init_begin),
17125                         (unsigned long)(&__init_end));
17126 diff -urNp linux-2.6.33/arch/x86/mm/iomap_32.c linux-2.6.33/arch/x86/mm/iomap_32.c
17127 --- linux-2.6.33/arch/x86/mm/iomap_32.c 2010-02-24 13:52:17.000000000 -0500
17128 +++ linux-2.6.33/arch/x86/mm/iomap_32.c 2010-03-07 12:23:35.953604355 -0500
17129 @@ -65,7 +65,11 @@ void *kmap_atomic_prot_pfn(unsigned long
17130         debug_kmap_atomic(type);
17131         idx = type + KM_TYPE_NR * smp_processor_id();
17132         vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
17133 +
17134 +       pax_open_kernel();
17135         set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
17136 +       pax_close_kernel();
17137 +
17138         arch_flush_lazy_mmu_mode();
17139
17140         return (void *)vaddr;
17141 diff -urNp linux-2.6.33/arch/x86/mm/ioremap.c linux-2.6.33/arch/x86/mm/ioremap.c
17142 --- linux-2.6.33/arch/x86/mm/ioremap.c  2010-02-24 13:52:17.000000000 -0500
17143 +++ linux-2.6.33/arch/x86/mm/ioremap.c  2010-03-07 12:23:35.953604355 -0500
17144 @@ -41,8 +41,8 @@ int page_is_ram(unsigned long pagenr)
17145          * Second special case: Some BIOSen report the PC BIOS
17146          * area (640->1Mb) as ram even though it is not.
17147          */
17148 -       if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
17149 -                   pagenr < (BIOS_END >> PAGE_SHIFT))
17150 +       if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
17151 +                   pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
17152                 return 0;
17153
17154         for (i = 0; i < e820.nr_map; i++) {
17155 @@ -137,13 +137,10 @@ static void __iomem *__ioremap_caller(re
17156         /*
17157          * Don't allow anybody to remap normal RAM that we're using..
17158          */
17159 -       for (pfn = phys_addr >> PAGE_SHIFT;
17160 -                               (pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
17161 -                               pfn++) {
17162 -
17163 +       for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
17164                 int is_ram = page_is_ram(pfn);
17165
17166 -               if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
17167 +               if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
17168                         return NULL;
17169                 WARN_ON_ONCE(is_ram);
17170         }
17171 @@ -383,7 +380,7 @@ static int __init early_ioremap_debug_se
17172  early_param("early_ioremap_debug", early_ioremap_debug_setup);
17173
17174  static __initdata int after_paging_init;
17175 -static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
17176 +static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
17177
17178  static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
17179  {
17180 @@ -415,8 +412,7 @@ void __init early_ioremap_init(void)
17181                 slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
17182
17183         pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
17184 -       memset(bm_pte, 0, sizeof(bm_pte));
17185 -       pmd_populate_kernel(&init_mm, pmd, bm_pte);
17186 +       pmd_populate_user(&init_mm, pmd, bm_pte);
17187
17188         /*
17189          * The boot-ioremap range spans multiple pmds, for which
17190 diff -urNp linux-2.6.33/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.33/arch/x86/mm/kmemcheck/kmemcheck.c
17191 --- linux-2.6.33/arch/x86/mm/kmemcheck/kmemcheck.c      2010-02-24 13:52:17.000000000 -0500
17192 +++ linux-2.6.33/arch/x86/mm/kmemcheck/kmemcheck.c      2010-03-07 12:23:35.953604355 -0500
17193 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
17194          * memory (e.g. tracked pages)? For now, we need this to avoid
17195          * invoking kmemcheck for PnP BIOS calls.
17196          */
17197 -       if (regs->flags & X86_VM_MASK)
17198 +       if (v8086_mode(regs))
17199                 return false;
17200 -       if (regs->cs != __KERNEL_CS)
17201 +       if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
17202                 return false;
17203
17204         pte = kmemcheck_pte_lookup(address);
17205 diff -urNp linux-2.6.33/arch/x86/mm/mmap.c linux-2.6.33/arch/x86/mm/mmap.c
17206 --- linux-2.6.33/arch/x86/mm/mmap.c     2010-02-24 13:52:17.000000000 -0500
17207 +++ linux-2.6.33/arch/x86/mm/mmap.c     2010-03-07 12:23:35.957616985 -0500
17208 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
17209   * Leave an at least ~128 MB hole with possible stack randomization.
17210   */
17211  #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
17212 -#define MAX_GAP (TASK_SIZE/6*5)
17213 +#define MAX_GAP (pax_task_size/6*5)
17214
17215  /*
17216   * True on X86_32 or when emulating IA32 on X86_64
17217 @@ -94,27 +94,40 @@ static unsigned long mmap_rnd(void)
17218         return rnd << PAGE_SHIFT;
17219  }
17220
17221 -static unsigned long mmap_base(void)
17222 +static unsigned long mmap_base(struct mm_struct *mm)
17223  {
17224         unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
17225 +       unsigned long pax_task_size = TASK_SIZE;
17226 +
17227 +#ifdef CONFIG_PAX_SEGMEXEC
17228 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
17229 +               pax_task_size = SEGMEXEC_TASK_SIZE;
17230 +#endif
17231
17232         if (gap < MIN_GAP)
17233                 gap = MIN_GAP;
17234         else if (gap > MAX_GAP)
17235                 gap = MAX_GAP;
17236
17237 -       return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
17238 +       return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
17239  }
17240
17241  /*
17242   * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
17243   * does, but not when emulating X86_32
17244   */
17245 -static unsigned long mmap_legacy_base(void)
17246 +static unsigned long mmap_legacy_base(struct mm_struct *mm)
17247  {
17248 -       if (mmap_is_ia32())
17249 +       if (mmap_is_ia32()) {
17250 +
17251 +#ifdef CONFIG_PAX_SEGMEXEC
17252 +               if (mm->pax_flags & MF_PAX_SEGMEXEC)
17253 +                       return SEGMEXEC_TASK_UNMAPPED_BASE;
17254 +               else
17255 +#endif
17256 +
17257                 return TASK_UNMAPPED_BASE;
17258 -       else
17259 +       } else
17260                 return TASK_UNMAPPED_BASE + mmap_rnd();
17261  }
17262
17263 @@ -125,11 +138,23 @@ static unsigned long mmap_legacy_base(vo
17264  void arch_pick_mmap_layout(struct mm_struct *mm)
17265  {
17266         if (mmap_is_legacy()) {
17267 -               mm->mmap_base = mmap_legacy_base();
17268 +               mm->mmap_base = mmap_legacy_base(mm);
17269 +
17270 +#ifdef CONFIG_PAX_RANDMMAP
17271 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
17272 +                       mm->mmap_base += mm->delta_mmap;
17273 +#endif
17274 +
17275                 mm->get_unmapped_area = arch_get_unmapped_area;
17276                 mm->unmap_area = arch_unmap_area;
17277         } else {
17278 -               mm->mmap_base = mmap_base();
17279 +               mm->mmap_base = mmap_base(mm);
17280 +
17281 +#ifdef CONFIG_PAX_RANDMMAP
17282 +               if (mm->pax_flags & MF_PAX_RANDMMAP)
17283 +                       mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
17284 +#endif
17285 +
17286                 mm->get_unmapped_area = arch_get_unmapped_area_topdown;
17287                 mm->unmap_area = arch_unmap_area_topdown;
17288         }
17289 diff -urNp linux-2.6.33/arch/x86/mm/numa_32.c linux-2.6.33/arch/x86/mm/numa_32.c
17290 --- linux-2.6.33/arch/x86/mm/numa_32.c  2010-02-24 13:52:17.000000000 -0500
17291 +++ linux-2.6.33/arch/x86/mm/numa_32.c  2010-03-07 12:23:35.957616985 -0500
17292 @@ -98,7 +98,6 @@ unsigned long node_memmap_size_bytes(int
17293  }
17294  #endif
17295
17296 -extern unsigned long find_max_low_pfn(void);
17297  extern unsigned long highend_pfn, highstart_pfn;
17298
17299  #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
17300 diff -urNp linux-2.6.33/arch/x86/mm/pageattr.c linux-2.6.33/arch/x86/mm/pageattr.c
17301 --- linux-2.6.33/arch/x86/mm/pageattr.c 2010-02-24 13:52:17.000000000 -0500
17302 +++ linux-2.6.33/arch/x86/mm/pageattr.c 2010-03-07 12:23:35.957616985 -0500
17303 @@ -268,9 +268,10 @@ static inline pgprot_t static_protection
17304          * Does not cover __inittext since that is gone later on. On
17305          * 64bit we do not enforce !NX on the low mapping
17306          */
17307 -       if (within(address, (unsigned long)_text, (unsigned long)_etext))
17308 +       if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
17309                 pgprot_val(forbidden) |= _PAGE_NX;
17310
17311 +#ifdef CONFIG_DEBUG_RODATA
17312         /*
17313          * The .rodata section needs to be read-only. Using the pfn
17314          * catches all aliases.
17315 @@ -278,6 +279,7 @@ static inline pgprot_t static_protection
17316         if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
17317                    __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
17318                 pgprot_val(forbidden) |= _PAGE_RW;
17319 +#endif
17320
17321  #if defined(CONFIG_X86_64) && defined(CONFIG_DEBUG_RODATA)
17322         /*
17323 @@ -347,7 +349,10 @@ EXPORT_SYMBOL_GPL(lookup_address);
17324  static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
17325  {
17326         /* change init_mm */
17327 +       pax_open_kernel();
17328         set_pte_atomic(kpte, pte);
17329 +       pax_close_kernel();
17330 +
17331  #ifdef CONFIG_X86_32
17332         if (!SHARED_KERNEL_PMD) {
17333                 struct page *page;
17334 diff -urNp linux-2.6.33/arch/x86/mm/pageattr-test.c linux-2.6.33/arch/x86/mm/pageattr-test.c
17335 --- linux-2.6.33/arch/x86/mm/pageattr-test.c    2010-02-24 13:52:17.000000000 -0500
17336 +++ linux-2.6.33/arch/x86/mm/pageattr-test.c    2010-03-07 12:23:35.957616985 -0500
17337 @@ -36,7 +36,7 @@ enum {
17338
17339  static int pte_testbit(pte_t pte)
17340  {
17341 -       return pte_flags(pte) & _PAGE_UNUSED1;
17342 +       return pte_flags(pte) & _PAGE_CPA_TEST;
17343  }
17344
17345  struct split_state {
17346 diff -urNp linux-2.6.33/arch/x86/mm/pat.c linux-2.6.33/arch/x86/mm/pat.c
17347 --- linux-2.6.33/arch/x86/mm/pat.c      2010-02-24 13:52:17.000000000 -0500
17348 +++ linux-2.6.33/arch/x86/mm/pat.c      2010-03-07 12:23:35.957616985 -0500
17349 @@ -259,7 +259,7 @@ chk_conflict(struct memtype *new, struct
17350
17351   conflict:
17352         printk(KERN_INFO "%s:%d conflicting memory types "
17353 -              "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
17354 +              "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
17355                new->end, cattr_name(new->type), cattr_name(entry->type));
17356         return -EBUSY;
17357  }
17358 @@ -555,7 +555,7 @@ unlock_ret:
17359
17360         if (err) {
17361                 printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
17362 -                       current->comm, current->pid, start, end);
17363 +                       current->comm, task_pid_nr(current), start, end);
17364         }
17365
17366         dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
17367 @@ -750,7 +750,7 @@ int kernel_map_sync_memtype(u64 base, un
17368                 printk(KERN_INFO
17369                         "%s:%d ioremap_change_attr failed %s "
17370                         "for %Lx-%Lx\n",
17371 -                       current->comm, current->pid,
17372 +                       current->comm, task_pid_nr(current),
17373                         cattr_name(flags),
17374                         base, (unsigned long long)(base + size));
17375                 return -EINVAL;
17376 @@ -808,7 +808,7 @@ static int reserve_pfn_range(u64 paddr,
17377                         free_memtype(paddr, paddr + size);
17378                         printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
17379                                 " for %Lx-%Lx, got %s\n",
17380 -                               current->comm, current->pid,
17381 +                               current->comm, task_pid_nr(current),
17382                                 cattr_name(want_flags),
17383                                 (unsigned long long)paddr,
17384                                 (unsigned long long)(paddr + size),
17385 diff -urNp linux-2.6.33/arch/x86/mm/pgtable_32.c linux-2.6.33/arch/x86/mm/pgtable_32.c
17386 --- linux-2.6.33/arch/x86/mm/pgtable_32.c       2010-02-24 13:52:17.000000000 -0500
17387 +++ linux-2.6.33/arch/x86/mm/pgtable_32.c       2010-03-07 12:23:35.957616985 -0500
17388 @@ -49,10 +49,13 @@ void set_pte_vaddr(unsigned long vaddr,
17389                 return;
17390         }
17391         pte = pte_offset_kernel(pmd, vaddr);
17392 +
17393 +       pax_open_kernel();
17394         if (pte_val(pteval))
17395                 set_pte_at(&init_mm, vaddr, pte, pteval);
17396         else
17397                 pte_clear(&init_mm, vaddr, pte);
17398 +       pax_close_kernel();
17399
17400         /*
17401          * It's enough to flush this one mapping.
17402 diff -urNp linux-2.6.33/arch/x86/mm/tlb.c linux-2.6.33/arch/x86/mm/tlb.c
17403 --- linux-2.6.33/arch/x86/mm/tlb.c      2010-02-24 13:52:17.000000000 -0500
17404 +++ linux-2.6.33/arch/x86/mm/tlb.c      2010-03-07 12:23:35.957616985 -0500
17405 @@ -13,7 +13,7 @@
17406  #include <asm/uv/uv.h>
17407
17408  DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
17409 -                       = { &init_mm, 0, };
17410 +                       = { &init_mm, 0 };
17411
17412  /*
17413   *     Smarter SMP flushing macros.
17414 diff -urNp linux-2.6.33/arch/x86/oprofile/backtrace.c linux-2.6.33/arch/x86/oprofile/backtrace.c
17415 --- linux-2.6.33/arch/x86/oprofile/backtrace.c  2010-02-24 13:52:17.000000000 -0500
17416 +++ linux-2.6.33/arch/x86/oprofile/backtrace.c  2010-03-07 12:23:35.957616985 -0500
17417 @@ -37,7 +37,7 @@ static void backtrace_address(void *data
17418         unsigned int *depth = data;
17419
17420         if ((*depth)--)
17421 -               oprofile_add_trace(addr);
17422 +               oprofile_add_trace(ktla_ktva(addr));
17423  }
17424
17425  static struct stacktrace_ops backtrace_ops = {
17426 @@ -58,7 +58,7 @@ static struct frame_head *dump_user_back
17427         struct frame_head bufhead[2];
17428
17429         /* Also check accessibility of one struct frame_head beyond */
17430 -       if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
17431 +       if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
17432                 return NULL;
17433         if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
17434                 return NULL;
17435 @@ -78,7 +78,7 @@ x86_backtrace(struct pt_regs * const reg
17436  {
17437         struct frame_head *head = (struct frame_head *)frame_pointer(regs);
17438
17439 -       if (!user_mode_vm(regs)) {
17440 +       if (!user_mode(regs)) {
17441                 unsigned long stack = kernel_stack_pointer(regs);
17442                 if (depth)
17443                         dump_trace(NULL, regs, (unsigned long *)stack, 0,
17444 diff -urNp linux-2.6.33/arch/x86/oprofile/op_model_p4.c linux-2.6.33/arch/x86/oprofile/op_model_p4.c
17445 --- linux-2.6.33/arch/x86/oprofile/op_model_p4.c        2010-02-24 13:52:17.000000000 -0500
17446 +++ linux-2.6.33/arch/x86/oprofile/op_model_p4.c        2010-03-07 12:23:35.957616985 -0500
17447 @@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
17448  #endif
17449  }
17450
17451 -static int inline addr_increment(void)
17452 +static inline int addr_increment(void)
17453  {
17454  #ifdef CONFIG_SMP
17455         return smp_num_siblings == 2 ? 2 : 1;
17456 diff -urNp linux-2.6.33/arch/x86/pci/common.c linux-2.6.33/arch/x86/pci/common.c
17457 --- linux-2.6.33/arch/x86/pci/common.c  2010-02-24 13:52:17.000000000 -0500
17458 +++ linux-2.6.33/arch/x86/pci/common.c  2010-03-07 12:23:35.957616985 -0500
17459 @@ -31,8 +31,8 @@ int noioapicreroute = 1;
17460  int pcibios_last_bus = -1;
17461  unsigned long pirq_table_addr;
17462  struct pci_bus *pci_root_bus;
17463 -struct pci_raw_ops *raw_pci_ops;
17464 -struct pci_raw_ops *raw_pci_ext_ops;
17465 +const struct pci_raw_ops *raw_pci_ops;
17466 +const struct pci_raw_ops *raw_pci_ext_ops;
17467
17468  int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
17469                                                 int reg, int len, u32 *val)
17470 @@ -370,7 +370,7 @@ static const struct dmi_system_id __devi
17471                         DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
17472                 },
17473         },
17474 -       {}
17475 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
17476  };
17477
17478  void __init dmi_check_pciprobe(void)
17479 diff -urNp linux-2.6.33/arch/x86/pci/direct.c linux-2.6.33/arch/x86/pci/direct.c
17480 --- linux-2.6.33/arch/x86/pci/direct.c  2010-02-24 13:52:17.000000000 -0500
17481 +++ linux-2.6.33/arch/x86/pci/direct.c  2010-03-07 12:23:35.957616985 -0500
17482 @@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int
17483
17484  #undef PCI_CONF1_ADDRESS
17485
17486 -struct pci_raw_ops pci_direct_conf1 = {
17487 +const struct pci_raw_ops pci_direct_conf1 = {
17488         .read =         pci_conf1_read,
17489         .write =        pci_conf1_write,
17490  };
17491 @@ -173,7 +173,7 @@ static int pci_conf2_write(unsigned int
17492
17493  #undef PCI_CONF2_ADDRESS
17494
17495 -struct pci_raw_ops pci_direct_conf2 = {
17496 +const struct pci_raw_ops pci_direct_conf2 = {
17497         .read =         pci_conf2_read,
17498         .write =        pci_conf2_write,
17499  };
17500 @@ -189,7 +189,7 @@ struct pci_raw_ops pci_direct_conf2 = {
17501   * This should be close to trivial, but it isn't, because there are buggy
17502   * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
17503   */
17504 -static int __init pci_sanity_check(struct pci_raw_ops *o)
17505 +static int __init pci_sanity_check(const struct pci_raw_ops *o)
17506  {
17507         u32 x = 0;
17508         int year, devfn;
17509 diff -urNp linux-2.6.33/arch/x86/pci/fixup.c linux-2.6.33/arch/x86/pci/fixup.c
17510 --- linux-2.6.33/arch/x86/pci/fixup.c   2010-02-24 13:52:17.000000000 -0500
17511 +++ linux-2.6.33/arch/x86/pci/fixup.c   2010-03-07 12:23:35.957616985 -0500
17512 @@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
17513                         DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
17514                 },
17515         },
17516 -       {}
17517 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
17518  };
17519
17520  /*
17521 @@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
17522                         DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
17523                 },
17524         },
17525 -       { }
17526 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
17527  };
17528
17529  static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
17530 diff -urNp linux-2.6.33/arch/x86/pci/irq.c linux-2.6.33/arch/x86/pci/irq.c
17531 --- linux-2.6.33/arch/x86/pci/irq.c     2010-02-24 13:52:17.000000000 -0500
17532 +++ linux-2.6.33/arch/x86/pci/irq.c     2010-03-07 12:23:35.957616985 -0500
17533 @@ -543,7 +543,7 @@ static __init int intel_router_probe(str
17534         static struct pci_device_id __initdata pirq_440gx[] = {
17535                 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
17536                 { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
17537 -               { },
17538 +               { PCI_DEVICE(0, 0) }
17539         };
17540
17541         /* 440GX has a proprietary PIRQ router -- don't use it */
17542 @@ -1107,7 +1107,7 @@ static struct dmi_system_id __initdata p
17543                         DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
17544                 },
17545         },
17546 -       { }
17547 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
17548  };
17549
17550  int __init pcibios_irq_init(void)
17551 diff -urNp linux-2.6.33/arch/x86/pci/mmconfig_32.c linux-2.6.33/arch/x86/pci/mmconfig_32.c
17552 --- linux-2.6.33/arch/x86/pci/mmconfig_32.c     2010-02-24 13:52:17.000000000 -0500
17553 +++ linux-2.6.33/arch/x86/pci/mmconfig_32.c     2010-03-07 12:23:35.957616985 -0500
17554 @@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int
17555         return 0;
17556  }
17557
17558 -static struct pci_raw_ops pci_mmcfg = {
17559 +static const struct pci_raw_ops pci_mmcfg = {
17560         .read =         pci_mmcfg_read,
17561         .write =        pci_mmcfg_write,
17562  };
17563 diff -urNp linux-2.6.33/arch/x86/pci/mmconfig_64.c linux-2.6.33/arch/x86/pci/mmconfig_64.c
17564 --- linux-2.6.33/arch/x86/pci/mmconfig_64.c     2010-02-24 13:52:17.000000000 -0500
17565 +++ linux-2.6.33/arch/x86/pci/mmconfig_64.c     2010-03-07 12:23:35.957616985 -0500
17566 @@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int
17567         return 0;
17568  }
17569
17570 -static struct pci_raw_ops pci_mmcfg = {
17571 +static const struct pci_raw_ops pci_mmcfg = {
17572         .read =         pci_mmcfg_read,
17573         .write =        pci_mmcfg_write,
17574  };
17575 diff -urNp linux-2.6.33/arch/x86/pci/numaq_32.c linux-2.6.33/arch/x86/pci/numaq_32.c
17576 --- linux-2.6.33/arch/x86/pci/numaq_32.c        2010-02-24 13:52:17.000000000 -0500
17577 +++ linux-2.6.33/arch/x86/pci/numaq_32.c        2010-03-07 12:23:35.957616985 -0500
17578 @@ -112,7 +112,7 @@ static int pci_conf1_mq_write(unsigned i
17579
17580  #undef PCI_CONF1_MQ_ADDRESS
17581
17582 -static struct pci_raw_ops pci_direct_conf1_mq = {
17583 +static const struct pci_raw_ops pci_direct_conf1_mq = {
17584         .read   = pci_conf1_mq_read,
17585         .write  = pci_conf1_mq_write
17586  };
17587 diff -urNp linux-2.6.33/arch/x86/pci/olpc.c linux-2.6.33/arch/x86/pci/olpc.c
17588 --- linux-2.6.33/arch/x86/pci/olpc.c    2010-02-24 13:52:17.000000000 -0500
17589 +++ linux-2.6.33/arch/x86/pci/olpc.c    2010-03-07 12:23:35.957616985 -0500
17590 @@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
17591         return 0;
17592  }
17593
17594 -static struct pci_raw_ops pci_olpc_conf = {
17595 +static const struct pci_raw_ops pci_olpc_conf = {
17596         .read = pci_olpc_read,
17597         .write = pci_olpc_write,
17598  };
17599 diff -urNp linux-2.6.33/arch/x86/pci/pcbios.c linux-2.6.33/arch/x86/pci/pcbios.c
17600 --- linux-2.6.33/arch/x86/pci/pcbios.c  2010-02-24 13:52:17.000000000 -0500
17601 +++ linux-2.6.33/arch/x86/pci/pcbios.c  2010-03-07 12:23:35.957616985 -0500
17602 @@ -56,50 +56,93 @@ union bios32 {
17603  static struct {
17604         unsigned long address;
17605         unsigned short segment;
17606 -} bios32_indirect = { 0, __KERNEL_CS };
17607 +} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
17608
17609  /*
17610   * Returns the entry point for the given service, NULL on error
17611   */
17612
17613 -static unsigned long bios32_service(unsigned long service)
17614 +static unsigned long __devinit bios32_service(unsigned long service)
17615  {
17616         unsigned char return_code;      /* %al */
17617         unsigned long address;          /* %ebx */
17618         unsigned long length;           /* %ecx */
17619         unsigned long entry;            /* %edx */
17620         unsigned long flags;
17621 +       struct desc_struct d, *gdt;
17622
17623         local_irq_save(flags);
17624 -       __asm__("lcall *(%%edi); cld"
17625 +
17626 +       gdt = get_cpu_gdt_table(smp_processor_id());
17627 +
17628 +       pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
17629 +       write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
17630 +       pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
17631 +       write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
17632 +
17633 +       __asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
17634                 : "=a" (return_code),
17635                   "=b" (address),
17636                   "=c" (length),
17637                   "=d" (entry)
17638                 : "0" (service),
17639                   "1" (0),
17640 -                 "D" (&bios32_indirect));
17641 +                 "D" (&bios32_indirect),
17642 +                 "r"(__PCIBIOS_DS)
17643 +               : "memory");
17644 +
17645 +       pax_open_kernel();
17646 +       gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
17647 +       gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
17648 +       gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
17649 +       gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
17650 +       pax_close_kernel();
17651 +
17652         local_irq_restore(flags);
17653
17654         switch (return_code) {
17655 -               case 0:
17656 -                       return address + entry;
17657 -               case 0x80:      /* Not present */
17658 -                       printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
17659 -                       return 0;
17660 -               default: /* Shouldn't happen */
17661 -                       printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
17662 -                               service, return_code);
17663 +       case 0: {
17664 +               int cpu;
17665 +               unsigned char flags;
17666 +
17667 +               printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
17668 +               if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
17669 +                       printk(KERN_WARNING "bios32_service: not valid\n");
17670                         return 0;
17671 +               }
17672 +               address = address + PAGE_OFFSET;
17673 +               length += 16UL; /* some BIOSs underreport this... */
17674 +               flags = 4;
17675 +               if (length >= 64*1024*1024) {
17676 +                       length >>= PAGE_SHIFT;
17677 +                       flags |= 8;
17678 +               }
17679 +
17680 +               for (cpu = 0; cpu < NR_CPUS; cpu++) {
17681 +                       gdt = get_cpu_gdt_table(cpu);
17682 +                       pack_descriptor(&d, address, length, 0x9b, flags);
17683 +                       write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
17684 +                       pack_descriptor(&d, address, length, 0x93, flags);
17685 +                       write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
17686 +               }
17687 +               return entry;
17688 +       }
17689 +       case 0x80:      /* Not present */
17690 +               printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
17691 +               return 0;
17692 +       default: /* Shouldn't happen */
17693 +               printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
17694 +                       service, return_code);
17695 +               return 0;
17696         }
17697  }
17698
17699  static struct {
17700         unsigned long address;
17701         unsigned short segment;
17702 -} pci_indirect = { 0, __KERNEL_CS };
17703 +} pci_indirect __read_only = { 0, __PCIBIOS_CS };
17704
17705 -static int pci_bios_present;
17706 +static int pci_bios_present __read_only;
17707
17708  static int __devinit check_pcibios(void)
17709  {
17710 @@ -108,11 +151,13 @@ static int __devinit check_pcibios(void)
17711         unsigned long flags, pcibios_entry;
17712
17713         if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
17714 -               pci_indirect.address = pcibios_entry + PAGE_OFFSET;
17715 +               pci_indirect.address = pcibios_entry;
17716
17717                 local_irq_save(flags);
17718 -               __asm__(
17719 -                       "lcall *(%%edi); cld\n\t"
17720 +               __asm__("movw %w6, %%ds\n\t"
17721 +                       "lcall *%%ss:(%%edi); cld\n\t"
17722 +                       "push %%ss\n\t"
17723 +                       "pop %%ds\n\t"
17724                         "jc 1f\n\t"
17725                         "xor %%ah, %%ah\n"
17726                         "1:"
17727 @@ -121,7 +166,8 @@ static int __devinit check_pcibios(void)
17728                           "=b" (ebx),
17729                           "=c" (ecx)
17730                         : "1" (PCIBIOS_PCI_BIOS_PRESENT),
17731 -                         "D" (&pci_indirect)
17732 +                         "D" (&pci_indirect),
17733 +                         "r" (__PCIBIOS_DS)
17734                         : "memory");
17735                 local_irq_restore(flags);
17736
17737 @@ -165,7 +211,10 @@ static int pci_bios_read(unsigned int se
17738
17739         switch (len) {
17740         case 1:
17741 -               __asm__("lcall *(%%esi); cld\n\t"
17742 +               __asm__("movw %w6, %%ds\n\t"
17743 +                       "lcall *%%ss:(%%esi); cld\n\t"
17744 +                       "push %%ss\n\t"
17745 +                       "pop %%ds\n\t"
17746                         "jc 1f\n\t"
17747                         "xor %%ah, %%ah\n"
17748                         "1:"
17749 @@ -174,7 +223,8 @@ static int pci_bios_read(unsigned int se
17750                         : "1" (PCIBIOS_READ_CONFIG_BYTE),
17751                           "b" (bx),
17752                           "D" ((long)reg),
17753 -                         "S" (&pci_indirect));
17754 +                         "S" (&pci_indirect),
17755 +                         "r" (__PCIBIOS_DS));
17756                 /*
17757                  * Zero-extend the result beyond 8 bits, do not trust the
17758                  * BIOS having done it:
17759 @@ -182,7 +232,10 @@ static int pci_bios_read(unsigned int se
17760                 *value &= 0xff;
17761                 break;
17762         case 2:
17763 -               __asm__("lcall *(%%esi); cld\n\t"
17764 +               __asm__("movw %w6, %%ds\n\t"
17765 +                       "lcall *%%ss:(%%esi); cld\n\t"
17766 +                       "push %%ss\n\t"
17767 +                       "pop %%ds\n\t"
17768                         "jc 1f\n\t"
17769                         "xor %%ah, %%ah\n"
17770                         "1:"
17771 @@ -191,7 +244,8 @@ static int pci_bios_read(unsigned int se
17772                         : "1" (PCIBIOS_READ_CONFIG_WORD),
17773                           "b" (bx),
17774                           "D" ((long)reg),
17775 -                         "S" (&pci_indirect));
17776 +                         "S" (&pci_indirect),
17777 +                         "r" (__PCIBIOS_DS));
17778                 /*
17779                  * Zero-extend the result beyond 16 bits, do not trust the
17780                  * BIOS having done it:
17781 @@ -199,7 +253,10 @@ static int pci_bios_read(unsigned int se
17782                 *value &= 0xffff;
17783                 break;
17784         case 4:
17785 -               __asm__("lcall *(%%esi); cld\n\t"
17786 +               __asm__("movw %w6, %%ds\n\t"
17787 +                       "lcall *%%ss:(%%esi); cld\n\t"
17788 +                       "push %%ss\n\t"
17789 +                       "pop %%ds\n\t"
17790                         "jc 1f\n\t"
17791                         "xor %%ah, %%ah\n"
17792                         "1:"
17793 @@ -208,7 +265,8 @@ static int pci_bios_read(unsigned int se
17794                         : "1" (PCIBIOS_READ_CONFIG_DWORD),
17795                           "b" (bx),
17796                           "D" ((long)reg),
17797 -                         "S" (&pci_indirect));
17798 +                         "S" (&pci_indirect),
17799 +                         "r" (__PCIBIOS_DS));
17800                 break;
17801         }
17802
17803 @@ -231,7 +289,10 @@ static int pci_bios_write(unsigned int s
17804
17805         switch (len) {
17806         case 1:
17807 -               __asm__("lcall *(%%esi); cld\n\t"
17808 +               __asm__("movw %w6, %%ds\n\t"
17809 +                       "lcall *%%ss:(%%esi); cld\n\t"
17810 +                       "push %%ss\n\t"
17811 +                       "pop %%ds\n\t"
17812                         "jc 1f\n\t"
17813                         "xor %%ah, %%ah\n"
17814                         "1:"
17815 @@ -240,10 +301,14 @@ static int pci_bios_write(unsigned int s
17816                           "c" (value),
17817                           "b" (bx),
17818                           "D" ((long)reg),
17819 -                         "S" (&pci_indirect));
17820 +                         "S" (&pci_indirect),
17821 +                         "r" (__PCIBIOS_DS));
17822                 break;
17823         case 2:
17824 -               __asm__("lcall *(%%esi); cld\n\t"
17825 +               __asm__("movw %w6, %%ds\n\t"
17826 +                       "lcall *%%ss:(%%esi); cld\n\t"
17827 +                       "push %%ss\n\t"
17828 +                       "pop %%ds\n\t"
17829                         "jc 1f\n\t"
17830                         "xor %%ah, %%ah\n"
17831                         "1:"
17832 @@ -252,10 +317,14 @@ static int pci_bios_write(unsigned int s
17833                           "c" (value),
17834                           "b" (bx),
17835                           "D" ((long)reg),
17836 -                         "S" (&pci_indirect));
17837 +                         "S" (&pci_indirect),
17838 +                         "r" (__PCIBIOS_DS));
17839                 break;
17840         case 4:
17841 -               __asm__("lcall *(%%esi); cld\n\t"
17842 +               __asm__("movw %w6, %%ds\n\t"
17843 +                       "lcall *%%ss:(%%esi); cld\n\t"
17844 +                       "push %%ss\n\t"
17845 +                       "pop %%ds\n\t"
17846                         "jc 1f\n\t"
17847                         "xor %%ah, %%ah\n"
17848                         "1:"
17849 @@ -264,7 +333,8 @@ static int pci_bios_write(unsigned int s
17850                           "c" (value),
17851                           "b" (bx),
17852                           "D" ((long)reg),
17853 -                         "S" (&pci_indirect));
17854 +                         "S" (&pci_indirect),
17855 +                         "r" (__PCIBIOS_DS));
17856                 break;
17857         }
17858
17859 @@ -278,7 +348,7 @@ static int pci_bios_write(unsigned int s
17860   * Function table for BIOS32 access
17861   */
17862
17863 -static struct pci_raw_ops pci_bios_access = {
17864 +static const struct pci_raw_ops pci_bios_access = {
17865         .read =         pci_bios_read,
17866         .write =        pci_bios_write
17867  };
17868 @@ -287,7 +357,7 @@ static struct pci_raw_ops pci_bios_acces
17869   * Try to find PCI BIOS.
17870   */
17871
17872 -static struct pci_raw_ops * __devinit pci_find_bios(void)
17873 +static const struct pci_raw_ops * __devinit pci_find_bios(void)
17874  {
17875         union bios32 *check;
17876         unsigned char sum;
17877 @@ -368,10 +438,13 @@ struct irq_routing_table * pcibios_get_i
17878
17879         DBG("PCI: Fetching IRQ routing table... ");
17880         __asm__("push %%es\n\t"
17881 +               "movw %w8, %%ds\n\t"
17882                 "push %%ds\n\t"
17883                 "pop  %%es\n\t"
17884 -               "lcall *(%%esi); cld\n\t"
17885 +               "lcall *%%ss:(%%esi); cld\n\t"
17886                 "pop %%es\n\t"
17887 +               "push %%ss\n\t"
17888 +               "pop %%ds\n"
17889                 "jc 1f\n\t"
17890                 "xor %%ah, %%ah\n"
17891                 "1:"
17892 @@ -382,7 +455,8 @@ struct irq_routing_table * pcibios_get_i
17893                   "1" (0),
17894                   "D" ((long) &opt),
17895                   "S" (&pci_indirect),
17896 -                 "m" (opt)
17897 +                 "m" (opt),
17898 +                 "r" (__PCIBIOS_DS)
17899                 : "memory");
17900         DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
17901         if (ret & 0xff00)
17902 @@ -406,7 +480,10 @@ int pcibios_set_irq_routing(struct pci_d
17903  {
17904         int ret;
17905
17906 -       __asm__("lcall *(%%esi); cld\n\t"
17907 +       __asm__("movw %w5, %%ds\n\t"
17908 +               "lcall *%%ss:(%%esi); cld\n\t"
17909 +               "push %%ss\n\t"
17910 +               "pop %%ds\n"
17911                 "jc 1f\n\t"
17912                 "xor %%ah, %%ah\n"
17913                 "1:"
17914 @@ -414,7 +491,8 @@ int pcibios_set_irq_routing(struct pci_d
17915                 : "0" (PCIBIOS_SET_PCI_HW_INT),
17916                   "b" ((dev->bus->number << 8) | dev->devfn),
17917                   "c" ((irq << 8) | (pin + 10)),
17918 -                 "S" (&pci_indirect));
17919 +                 "S" (&pci_indirect),
17920 +                 "r" (__PCIBIOS_DS));
17921         return !(ret & 0xff00);
17922  }
17923  EXPORT_SYMBOL(pcibios_set_irq_routing);
17924 diff -urNp linux-2.6.33/arch/x86/power/cpu.c linux-2.6.33/arch/x86/power/cpu.c
17925 --- linux-2.6.33/arch/x86/power/cpu.c   2010-02-24 13:52:17.000000000 -0500
17926 +++ linux-2.6.33/arch/x86/power/cpu.c   2010-03-07 12:23:35.957616985 -0500
17927 @@ -127,7 +127,7 @@ static void do_fpu_end(void)
17928  static void fix_processor_context(void)
17929  {
17930         int cpu = smp_processor_id();
17931 -       struct tss_struct *t = &per_cpu(init_tss, cpu);
17932 +       struct tss_struct *t = init_tss + cpu;
17933
17934         set_tss_desc(cpu, t);   /*
17935                                  * This just modifies memory; should not be
17936 @@ -137,7 +137,9 @@ static void fix_processor_context(void)
17937                                  */
17938
17939  #ifdef CONFIG_X86_64
17940 +       pax_open_kernel();
17941         get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
17942 +       pax_close_kernel();
17943
17944         syscall_init();                         /* This sets MSR_*STAR and related */
17945  #endif
17946 diff -urNp linux-2.6.33/arch/x86/vdso/Makefile linux-2.6.33/arch/x86/vdso/Makefile
17947 --- linux-2.6.33/arch/x86/vdso/Makefile 2010-02-24 13:52:17.000000000 -0500
17948 +++ linux-2.6.33/arch/x86/vdso/Makefile 2010-03-07 12:23:35.957616985 -0500
17949 @@ -122,7 +122,7 @@ quiet_cmd_vdso = VDSO    $@
17950                        $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
17951                        -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
17952
17953 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
17954 +VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
17955  GCOV_PROFILE := n
17956
17957  #
17958 diff -urNp linux-2.6.33/arch/x86/vdso/vclock_gettime.c linux-2.6.33/arch/x86/vdso/vclock_gettime.c
17959 --- linux-2.6.33/arch/x86/vdso/vclock_gettime.c 2010-02-24 13:52:17.000000000 -0500
17960 +++ linux-2.6.33/arch/x86/vdso/vclock_gettime.c 2010-03-07 12:23:35.961598666 -0500
17961 @@ -22,24 +22,48 @@
17962  #include <asm/hpet.h>
17963  #include <asm/unistd.h>
17964  #include <asm/io.h>
17965 +#include <asm/fixmap.h>
17966  #include "vextern.h"
17967
17968  #define gtod vdso_vsyscall_gtod_data
17969
17970 +notrace noinline long __vdso_fallback_time(long *t)
17971 +{
17972 +       long secs;
17973 +       asm volatile("syscall"
17974 +               : "=a" (secs)
17975 +               : "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
17976 +       return secs;
17977 +}
17978 +
17979  notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
17980  {
17981         long ret;
17982         asm("syscall" : "=a" (ret) :
17983 -           "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
17984 +           "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
17985         return ret;
17986  }
17987
17988 +notrace static inline cycle_t __vdso_vread_hpet(void)
17989 +{
17990 +       return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
17991 +}
17992 +
17993 +notrace static inline cycle_t __vdso_vread_tsc(void)
17994 +{
17995 +       cycle_t ret = (cycle_t)vget_cycles();
17996 +
17997 +       return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
17998 +}
17999 +
18000  notrace static inline long vgetns(void)
18001  {
18002         long v;
18003 -       cycles_t (*vread)(void);
18004 -       vread = gtod->clock.vread;
18005 -       v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
18006 +       if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
18007 +               v = __vdso_vread_tsc();
18008 +       else
18009 +               v = __vdso_vread_hpet();
18010 +       v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
18011         return (v * gtod->clock.mult) >> gtod->clock.shift;
18012  }
18013
18014 @@ -113,7 +137,9 @@ notrace static noinline int do_monotonic
18015
18016  notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
18017  {
18018 -       if (likely(gtod->sysctl_enabled))
18019 +       if (likely(gtod->sysctl_enabled &&
18020 +                  ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
18021 +                   (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
18022                 switch (clock) {
18023                 case CLOCK_REALTIME:
18024                         if (likely(gtod->clock.vread))
18025 @@ -133,10 +159,20 @@ notrace int __vdso_clock_gettime(clockid
18026  int clock_gettime(clockid_t, struct timespec *)
18027         __attribute__((weak, alias("__vdso_clock_gettime")));
18028
18029 -notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
18030 +notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
18031  {
18032         long ret;
18033 -       if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
18034 +       asm("syscall" : "=a" (ret) :
18035 +           "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
18036 +       return ret;
18037 +}
18038 +
18039 +notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
18040 +{
18041 +       if (likely(gtod->sysctl_enabled &&
18042 +                  ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
18043 +                   (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
18044 +       {
18045                 if (likely(tv != NULL)) {
18046                         BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
18047                                      offsetof(struct timespec, tv_nsec) ||
18048 @@ -151,9 +187,7 @@ notrace int __vdso_gettimeofday(struct t
18049                 }
18050                 return 0;
18051         }
18052 -       asm("syscall" : "=a" (ret) :
18053 -           "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
18054 -       return ret;
18055 +       return __vdso_fallback_gettimeofday(tv, tz);
18056  }
18057  int gettimeofday(struct timeval *, struct timezone *)
18058         __attribute__((weak, alias("__vdso_gettimeofday")));
18059 diff -urNp linux-2.6.33/arch/x86/vdso/vdso32-setup.c linux-2.6.33/arch/x86/vdso/vdso32-setup.c
18060 --- linux-2.6.33/arch/x86/vdso/vdso32-setup.c   2010-02-24 13:52:17.000000000 -0500
18061 +++ linux-2.6.33/arch/x86/vdso/vdso32-setup.c   2010-03-07 12:23:48.703416643 -0500
18062 @@ -25,6 +25,7 @@
18063  #include <asm/tlbflush.h>
18064  #include <asm/vdso.h>
18065  #include <asm/proto.h>
18066 +#include <asm/mman.h>
18067
18068  enum {
18069         VDSO_DISABLED = 0,
18070 @@ -226,7 +227,7 @@ static inline void map_compat_vdso(int m
18071  void enable_sep_cpu(void)
18072  {
18073         int cpu = get_cpu();
18074 -       struct tss_struct *tss = &per_cpu(init_tss, cpu);
18075 +       struct tss_struct *tss = init_tss + cpu;
18076
18077         if (!boot_cpu_has(X86_FEATURE_SEP)) {
18078                 put_cpu();
18079 @@ -249,7 +250,7 @@ static int __init gate_vma_init(void)
18080         gate_vma.vm_start = FIXADDR_USER_START;
18081         gate_vma.vm_end = FIXADDR_USER_END;
18082         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
18083 -       gate_vma.vm_page_prot = __P101;
18084 +       gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
18085         /*
18086          * Make sure the vDSO gets into every core dump.
18087          * Dumping its contents makes post-mortem fully interpretable later
18088 @@ -331,14 +332,14 @@ int arch_setup_additional_pages(struct l
18089         if (compat)
18090                 addr = VDSO_HIGH_BASE;
18091         else {
18092 -               addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
18093 +               addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
18094                 if (IS_ERR_VALUE(addr)) {
18095                         ret = addr;
18096                         goto up_fail;
18097                 }
18098         }
18099
18100 -       current->mm->context.vdso = (void *)addr;
18101 +       current->mm->context.vdso = addr;
18102
18103         if (compat_uses_vma || !compat) {
18104                 /*
18105 @@ -361,11 +362,11 @@ int arch_setup_additional_pages(struct l
18106         }
18107
18108         current_thread_info()->sysenter_return =
18109 -               VDSO32_SYMBOL(addr, SYSENTER_RETURN);
18110 +               (__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
18111
18112    up_fail:
18113         if (ret)
18114 -               current->mm->context.vdso = NULL;
18115 +               current->mm->context.vdso = 0;
18116
18117         up_write(&mm->mmap_sem);
18118
18119 @@ -412,8 +413,14 @@ __initcall(ia32_binfmt_init);
18120
18121  const char *arch_vma_name(struct vm_area_struct *vma)
18122  {
18123 -       if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
18124 +       if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
18125                 return "[vdso]";
18126 +
18127 +#ifdef CONFIG_PAX_SEGMEXEC
18128 +       if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
18129 +               return "[vdso]";
18130 +#endif
18131 +
18132         return NULL;
18133  }
18134
18135 @@ -422,7 +429,7 @@ struct vm_area_struct *get_gate_vma(stru
18136         struct mm_struct *mm = tsk->mm;
18137
18138         /* Check to see if this task was created in compat vdso mode */
18139 -       if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
18140 +       if (mm && mm->context.vdso == VDSO_HIGH_BASE)
18141                 return &gate_vma;
18142         return NULL;
18143  }
18144 diff -urNp linux-2.6.33/arch/x86/vdso/vdso.lds.S linux-2.6.33/arch/x86/vdso/vdso.lds.S
18145 --- linux-2.6.33/arch/x86/vdso/vdso.lds.S       2010-02-24 13:52:17.000000000 -0500
18146 +++ linux-2.6.33/arch/x86/vdso/vdso.lds.S       2010-03-07 12:23:35.961598666 -0500
18147 @@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
18148  #define VEXTERN(x)     VDSO64_ ## x = vdso_ ## x;
18149  #include "vextern.h"
18150  #undef VEXTERN
18151 +
18152 +#define VEXTERN(x)     VDSO64_ ## x = __vdso_ ## x;
18153 +VEXTERN(fallback_gettimeofday)
18154 +VEXTERN(fallback_time)
18155 +VEXTERN(getcpu)
18156 +#undef VEXTERN
18157 diff -urNp linux-2.6.33/arch/x86/vdso/vextern.h linux-2.6.33/arch/x86/vdso/vextern.h
18158 --- linux-2.6.33/arch/x86/vdso/vextern.h        2010-02-24 13:52:17.000000000 -0500
18159 +++ linux-2.6.33/arch/x86/vdso/vextern.h        2010-03-07 12:23:35.961598666 -0500
18160 @@ -11,6 +11,5 @@
18161     put into vextern.h and be referenced as a pointer with vdso prefix.
18162     The main kernel later fills in the values.   */
18163
18164 -VEXTERN(jiffies)
18165  VEXTERN(vgetcpu_mode)
18166  VEXTERN(vsyscall_gtod_data)
18167 diff -urNp linux-2.6.33/arch/x86/vdso/vma.c linux-2.6.33/arch/x86/vdso/vma.c
18168 --- linux-2.6.33/arch/x86/vdso/vma.c    2010-02-24 13:52:17.000000000 -0500
18169 +++ linux-2.6.33/arch/x86/vdso/vma.c    2010-03-07 12:23:35.961598666 -0500
18170 @@ -57,7 +57,7 @@ static int __init init_vdso_vars(void)
18171         if (!vbase)
18172                 goto oom;
18173
18174 -       if (memcmp(vbase, "\177ELF", 4)) {
18175 +       if (memcmp(vbase, ELFMAG, SELFMAG)) {
18176                 printk("VDSO: I'm broken; not ELF\n");
18177                 vdso_enabled = 0;
18178         }
18179 @@ -66,6 +66,7 @@ static int __init init_vdso_vars(void)
18180         *(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
18181  #include "vextern.h"
18182  #undef VEXTERN
18183 +       vunmap(vbase);
18184         return 0;
18185
18186   oom:
18187 @@ -116,7 +117,7 @@ int arch_setup_additional_pages(struct l
18188                 goto up_fail;
18189         }
18190
18191 -       current->mm->context.vdso = (void *)addr;
18192 +       current->mm->context.vdso = addr;
18193
18194         ret = install_special_mapping(mm, addr, vdso_size,
18195                                       VM_READ|VM_EXEC|
18196 @@ -124,7 +125,7 @@ int arch_setup_additional_pages(struct l
18197                                       VM_ALWAYSDUMP,
18198                                       vdso_pages);
18199         if (ret) {
18200 -               current->mm->context.vdso = NULL;
18201 +               current->mm->context.vdso = 0;
18202                 goto up_fail;
18203         }
18204
18205 @@ -132,10 +133,3 @@ up_fail:
18206         up_write(&mm->mmap_sem);
18207         return ret;
18208  }
18209 -
18210 -static __init int vdso_setup(char *s)
18211 -{
18212 -       vdso_enabled = simple_strtoul(s, NULL, 0);
18213 -       return 0;
18214 -}
18215 -__setup("vdso=", vdso_setup);
18216 diff -urNp linux-2.6.33/arch/x86/xen/enlighten.c linux-2.6.33/arch/x86/xen/enlighten.c
18217 --- linux-2.6.33/arch/x86/xen/enlighten.c       2010-02-24 13:52:17.000000000 -0500
18218 +++ linux-2.6.33/arch/x86/xen/enlighten.c       2010-03-07 12:23:35.961598666 -0500
18219 @@ -72,8 +72,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
18220
18221  struct shared_info xen_dummy_shared_info;
18222
18223 -void *xen_initial_gdt;
18224 -
18225  /*
18226   * Point at some empty memory to start with. We map the real shared_info
18227   * page as soon as fixmap is up and running.
18228 @@ -549,7 +547,7 @@ static void xen_write_idt_entry(gate_des
18229
18230         preempt_disable();
18231
18232 -       start = __get_cpu_var(idt_desc).address;
18233 +       start = (unsigned long)__get_cpu_var(idt_desc).address;
18234         end = start + __get_cpu_var(idt_desc).size + 1;
18235
18236         xen_mc_flush();
18237 @@ -1126,13 +1124,6 @@ asmlinkage void __init xen_start_kernel(
18238
18239         machine_ops = xen_machine_ops;
18240
18241 -       /*
18242 -        * The only reliable way to retain the initial address of the
18243 -        * percpu gdt_page is to remember it here, so we can go and
18244 -        * mark it RW later, when the initial percpu area is freed.
18245 -        */
18246 -       xen_initial_gdt = &per_cpu(gdt_page, 0);
18247 -
18248         xen_smp_init();
18249
18250         pgd = (pgd_t *)xen_start_info->pt_base;
18251 diff -urNp linux-2.6.33/arch/x86/xen/mmu.c linux-2.6.33/arch/x86/xen/mmu.c
18252 --- linux-2.6.33/arch/x86/xen/mmu.c     2010-02-24 13:52:17.000000000 -0500
18253 +++ linux-2.6.33/arch/x86/xen/mmu.c     2010-03-07 12:23:35.961598666 -0500
18254 @@ -1710,6 +1710,8 @@ __init pgd_t *xen_setup_kernel_pagetable
18255         convert_pfn_mfn(init_level4_pgt);
18256         convert_pfn_mfn(level3_ident_pgt);
18257         convert_pfn_mfn(level3_kernel_pgt);
18258 +       convert_pfn_mfn(level3_vmalloc_pgt);
18259 +       convert_pfn_mfn(level3_vmemmap_pgt);
18260
18261         l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
18262         l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
18263 @@ -1728,7 +1730,10 @@ __init pgd_t *xen_setup_kernel_pagetable
18264         set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
18265         set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
18266         set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
18267 +       set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
18268 +       set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
18269         set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
18270 +       set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
18271         set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
18272         set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
18273
18274 diff -urNp linux-2.6.33/arch/x86/xen/smp.c linux-2.6.33/arch/x86/xen/smp.c
18275 --- linux-2.6.33/arch/x86/xen/smp.c     2010-02-24 13:52:17.000000000 -0500
18276 +++ linux-2.6.33/arch/x86/xen/smp.c     2010-03-07 12:23:35.961598666 -0500
18277 @@ -168,11 +168,6 @@ static void __init xen_smp_prepare_boot_
18278  {
18279         BUG_ON(smp_processor_id() != 0);
18280         native_smp_prepare_boot_cpu();
18281 -
18282 -       /* We've switched to the "real" per-cpu gdt, so make sure the
18283 -          old memory can be recycled */
18284 -       make_lowmem_page_readwrite(xen_initial_gdt);
18285 -
18286         xen_setup_vcpu_info_placement();
18287  }
18288
18289 @@ -232,8 +227,8 @@ cpu_initialize_context(unsigned int cpu,
18290         gdt = get_cpu_gdt_table(cpu);
18291
18292         ctxt->flags = VGCF_IN_KERNEL;
18293 -       ctxt->user_regs.ds = __USER_DS;
18294 -       ctxt->user_regs.es = __USER_DS;
18295 +       ctxt->user_regs.ds = __KERNEL_DS;
18296 +       ctxt->user_regs.es = __KERNEL_DS;
18297         ctxt->user_regs.ss = __KERNEL_DS;
18298  #ifdef CONFIG_X86_32
18299         ctxt->user_regs.fs = __KERNEL_PERCPU;
18300 diff -urNp linux-2.6.33/arch/x86/xen/xen-ops.h linux-2.6.33/arch/x86/xen/xen-ops.h
18301 --- linux-2.6.33/arch/x86/xen/xen-ops.h 2010-02-24 13:52:17.000000000 -0500
18302 +++ linux-2.6.33/arch/x86/xen/xen-ops.h 2010-03-07 12:23:35.961598666 -0500
18303 @@ -10,8 +10,6 @@
18304  extern const char xen_hypervisor_callback[];
18305  extern const char xen_failsafe_callback[];
18306
18307 -extern void *xen_initial_gdt;
18308 -
18309  struct trap_info;
18310  void xen_copy_trap_info(struct trap_info *traps);
18311
18312 diff -urNp linux-2.6.33/block/blk-integrity.c linux-2.6.33/block/blk-integrity.c
18313 --- linux-2.6.33/block/blk-integrity.c  2010-02-24 13:52:17.000000000 -0500
18314 +++ linux-2.6.33/block/blk-integrity.c  2010-03-07 12:23:35.961598666 -0500
18315 @@ -278,7 +278,7 @@ static struct attribute *integrity_attrs
18316         NULL,
18317  };
18318
18319 -static struct sysfs_ops integrity_ops = {
18320 +static const struct sysfs_ops integrity_ops = {
18321         .show   = &integrity_attr_show,
18322         .store  = &integrity_attr_store,
18323  };
18324 diff -urNp linux-2.6.33/block/blk-iopoll.c linux-2.6.33/block/blk-iopoll.c
18325 --- linux-2.6.33/block/blk-iopoll.c     2010-02-24 13:52:17.000000000 -0500
18326 +++ linux-2.6.33/block/blk-iopoll.c     2010-03-07 12:23:35.961598666 -0500
18327 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
18328  }
18329  EXPORT_SYMBOL(blk_iopoll_complete);
18330
18331 -static void blk_iopoll_softirq(struct softirq_action *h)
18332 +static void blk_iopoll_softirq(void)
18333  {
18334         struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
18335         int rearm = 0, budget = blk_iopoll_budget;
18336 diff -urNp linux-2.6.33/block/blk-map.c linux-2.6.33/block/blk-map.c
18337 --- linux-2.6.33/block/blk-map.c        2010-02-24 13:52:17.000000000 -0500
18338 +++ linux-2.6.33/block/blk-map.c        2010-03-07 12:23:35.961598666 -0500
18339 @@ -54,7 +54,7 @@ static int __blk_rq_map_user(struct requ
18340          * direct dma. else, set up kernel bounce buffers
18341          */
18342         uaddr = (unsigned long) ubuf;
18343 -       if (blk_rq_aligned(q, ubuf, len) && !map_data)
18344 +       if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
18345                 bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
18346         else
18347                 bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
18348 @@ -297,7 +297,7 @@ int blk_rq_map_kern(struct request_queue
18349         if (!len || !kbuf)
18350                 return -EINVAL;
18351
18352 -       do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
18353 +       do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
18354         if (do_copy)
18355                 bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
18356         else
18357 diff -urNp linux-2.6.33/block/blk-softirq.c linux-2.6.33/block/blk-softirq.c
18358 --- linux-2.6.33/block/blk-softirq.c    2010-02-24 13:52:17.000000000 -0500
18359 +++ linux-2.6.33/block/blk-softirq.c    2010-03-07 12:23:35.961598666 -0500
18360 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head,
18361   * Softirq action handler - move entries to local list and loop over them
18362   * while passing them to the queue registered handler.
18363   */
18364 -static void blk_done_softirq(struct softirq_action *h)
18365 +static void blk_done_softirq(void)
18366  {
18367         struct list_head *cpu_list, local_list;
18368
18369 diff -urNp linux-2.6.33/block/blk-sysfs.c linux-2.6.33/block/blk-sysfs.c
18370 --- linux-2.6.33/block/blk-sysfs.c      2010-02-24 13:52:17.000000000 -0500
18371 +++ linux-2.6.33/block/blk-sysfs.c      2010-03-07 12:23:35.961598666 -0500
18372 @@ -447,7 +447,7 @@ static void blk_release_queue(struct kob
18373         kmem_cache_free(blk_requestq_cachep, q);
18374  }
18375
18376 -static struct sysfs_ops queue_sysfs_ops = {
18377 +static const struct sysfs_ops queue_sysfs_ops = {
18378         .show   = queue_attr_show,
18379         .store  = queue_attr_store,
18380  };
18381 diff -urNp linux-2.6.33/block/elevator.c linux-2.6.33/block/elevator.c
18382 --- linux-2.6.33/block/elevator.c       2010-02-24 13:52:17.000000000 -0500
18383 +++ linux-2.6.33/block/elevator.c       2010-03-07 12:23:35.961598666 -0500
18384 @@ -883,7 +883,7 @@ elv_attr_store(struct kobject *kobj, str
18385         return error;
18386  }
18387
18388 -static struct sysfs_ops elv_sysfs_ops = {
18389 +static const struct sysfs_ops elv_sysfs_ops = {
18390         .show   = elv_attr_show,
18391         .store  = elv_attr_store,
18392  };
18393 diff -urNp linux-2.6.33/crypto/lrw.c linux-2.6.33/crypto/lrw.c
18394 --- linux-2.6.33/crypto/lrw.c   2010-02-24 13:52:17.000000000 -0500
18395 +++ linux-2.6.33/crypto/lrw.c   2010-03-07 12:23:35.961598666 -0500
18396 @@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
18397         struct priv *ctx = crypto_tfm_ctx(parent);
18398         struct crypto_cipher *child = ctx->child;
18399         int err, i;
18400 -       be128 tmp = { 0 };
18401 +       be128 tmp = { 0, 0 };
18402         int bsize = crypto_cipher_blocksize(child);
18403
18404         crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
18405 diff -urNp linux-2.6.33/Documentation/dontdiff linux-2.6.33/Documentation/dontdiff
18406 --- linux-2.6.33/Documentation/dontdiff 2010-02-24 13:52:17.000000000 -0500
18407 +++ linux-2.6.33/Documentation/dontdiff 2010-03-07 12:23:35.961598666 -0500
18408 @@ -3,6 +3,7 @@
18409  *.bin
18410  *.cpio
18411  *.csp
18412 +*.dbg
18413  *.dsp
18414  *.dvi
18415  *.elf
18416 @@ -40,6 +41,7 @@
18417  *.ver
18418  *.xml
18419  *_MODULES
18420 +*_reg_safe.h
18421  *_vga16.c
18422  *~
18423  *.9
18424 @@ -49,11 +51,16 @@
18425  53c700_d.h
18426  CVS
18427  ChangeSet
18428 +GPATH
18429 +GRTAGS
18430 +GSYMS
18431 +GTAGS
18432  Image
18433  Kerntypes
18434  Module.markers
18435  Module.symvers
18436  PENDING
18437 +PERF*
18438  SCCS
18439  System.map*
18440  TAGS
18441 @@ -77,7 +84,9 @@ btfixupprep
18442  build
18443  bvmlinux
18444  bzImage*
18445 +capflags.c
18446  classlist.h*
18447 +common-cmds.h
18448  comp*.log
18449  compile.h*
18450  conf
18451 @@ -107,13 +116,14 @@ generated
18452  genheaders
18453  genksyms
18454  *_gray256.c
18455 +hash
18456  ihex2fw
18457  ikconfig.h*
18458  initramfs_data.cpio
18459 +initramfs_data.cpio.bz2
18460  initramfs_data.cpio.gz
18461  initramfs_list
18462  kallsyms
18463 -kconfig
18464  keywords.c
18465  ksym.c*
18466  ksym.h*
18467 @@ -137,10 +147,13 @@ mkboot
18468  mkbugboot
18469  mkcpustr
18470  mkdep
18471 +mkpiggy
18472  mkprep
18473 +mkregtable
18474  mktables
18475  mktree
18476  modpost
18477 +modules.builtin
18478  modules.order
18479  modversions.h*
18480  ncscope.*
18481 @@ -153,6 +166,7 @@ patches*
18482  pca200e.bin
18483  pca200e_ecd.bin2
18484  piggy.gz
18485 +piggy.S
18486  piggyback
18487  pnmtologo
18488  ppc_defs.h*
18489 @@ -167,6 +181,7 @@ setup
18490  setup.bin
18491  setup.elf
18492  sImage
18493 +slabinfo
18494  sm_tbl*
18495  split-include
18496  syscalltab.h
18497 @@ -190,14 +205,20 @@ version.h*
18498  vmlinux
18499  vmlinux-*
18500  vmlinux.aout
18501 +vmlinux.bin.all
18502 +vmlinux.bin.bz2
18503  vmlinux.lds
18504 +vmlinux.relocs
18505 +voffset.h
18506  vsyscall.lds
18507  vsyscall_32.lds
18508  wanxlfw.inc
18509  uImage
18510  unifdef
18511 +utsrelease.h
18512  wakeup.bin
18513  wakeup.elf
18514  wakeup.lds
18515  zImage*
18516  zconf.hash.c
18517 +zoffset.h
18518 diff -urNp linux-2.6.33/Documentation/filesystems/sysfs.txt linux-2.6.33/Documentation/filesystems/sysfs.txt
18519 --- linux-2.6.33/Documentation/filesystems/sysfs.txt    2010-02-24 13:52:17.000000000 -0500
18520 +++ linux-2.6.33/Documentation/filesystems/sysfs.txt    2010-03-07 12:23:35.961598666 -0500
18521 @@ -123,8 +123,8 @@ set of sysfs operations for forwarding r
18522  show and store methods of the attribute owners.
18523
18524  struct sysfs_ops {
18525 -        ssize_t (*show)(struct kobject *, struct attribute *, char *);
18526 -        ssize_t (*store)(struct kobject *, struct attribute *, const char *);
18527 +        ssize_t (* const show)(struct kobject *, struct attribute *, char *);
18528 +        ssize_t (* const store)(struct kobject *, struct attribute *, const char *);
18529  };
18530
18531  [ Subsystems should have already defined a struct kobj_type as a
18532 diff -urNp linux-2.6.33/Documentation/kernel-parameters.txt linux-2.6.33/Documentation/kernel-parameters.txt
18533 --- linux-2.6.33/Documentation/kernel-parameters.txt    2010-02-24 13:52:17.000000000 -0500
18534 +++ linux-2.6.33/Documentation/kernel-parameters.txt    2010-03-07 12:23:35.965718140 -0500
18535 @@ -1865,6 +1865,12 @@ and is between 256 and 4096 characters.
18536                         the specified number of seconds.  This is to be used if
18537                         your oopses keep scrolling off the screen.
18538
18539 +       pax_nouderef    [X86-32] disables UDEREF.  Most likely needed under certain
18540 +                       virtualization environments that don't cope well with the
18541 +                       expand down segment used by UDEREF on X86-32.
18542 +
18543 +       pax_softmode=   [X86-32] 0/1 to disable/enable PaX softmode on boot already.
18544 +
18545         pcbit=          [HW,ISDN]
18546
18547         pcd.            [PARIDE]
18548 diff -urNp linux-2.6.33/drivers/acpi/battery.c linux-2.6.33/drivers/acpi/battery.c
18549 --- linux-2.6.33/drivers/acpi/battery.c 2010-02-24 13:52:17.000000000 -0500
18550 +++ linux-2.6.33/drivers/acpi/battery.c 2010-03-07 12:23:35.965718140 -0500
18551 @@ -763,7 +763,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
18552         }
18553
18554  static struct battery_file {
18555 -       struct file_operations ops;
18556 +       const struct file_operations ops;
18557         mode_t mode;
18558         const char *name;
18559  } acpi_battery_file[] = {
18560 diff -urNp linux-2.6.33/drivers/acpi/blacklist.c linux-2.6.33/drivers/acpi/blacklist.c
18561 --- linux-2.6.33/drivers/acpi/blacklist.c       2010-02-24 13:52:17.000000000 -0500
18562 +++ linux-2.6.33/drivers/acpi/blacklist.c       2010-03-07 12:23:35.965718140 -0500
18563 @@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
18564         {"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
18565          "Incorrect _ADR", 1},
18566
18567 -       {""}
18568 +       {"", "", 0, NULL, all_versions, NULL, 0}
18569  };
18570
18571  #if    CONFIG_ACPI_BLACKLIST_YEAR
18572 diff -urNp linux-2.6.33/drivers/acpi/dock.c linux-2.6.33/drivers/acpi/dock.c
18573 --- linux-2.6.33/drivers/acpi/dock.c    2010-02-24 13:52:17.000000000 -0500
18574 +++ linux-2.6.33/drivers/acpi/dock.c    2010-03-07 12:23:35.965718140 -0500
18575 @@ -76,7 +76,7 @@ struct dock_dependent_device {
18576         struct list_head list;
18577         struct list_head hotplug_list;
18578         acpi_handle handle;
18579 -       struct acpi_dock_ops *ops;
18580 +       const struct acpi_dock_ops *ops;
18581         void *context;
18582  };
18583
18584 @@ -588,7 +588,7 @@ EXPORT_SYMBOL_GPL(unregister_dock_notifi
18585   * the dock driver after _DCK is executed.
18586   */
18587  int
18588 -register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
18589 +register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
18590                              void *context)
18591  {
18592         struct dock_dependent_device *dd;
18593 diff -urNp linux-2.6.33/drivers/acpi/osl.c linux-2.6.33/drivers/acpi/osl.c
18594 --- linux-2.6.33/drivers/acpi/osl.c     2010-02-24 13:52:17.000000000 -0500
18595 +++ linux-2.6.33/drivers/acpi/osl.c     2010-03-07 12:23:35.965718140 -0500
18596 @@ -523,6 +523,8 @@ acpi_os_read_memory(acpi_physical_addres
18597         void __iomem *virt_addr;
18598
18599         virt_addr = ioremap(phys_addr, width);
18600 +       if (!virt_addr)
18601 +               return AE_NO_MEMORY;
18602         if (!value)
18603                 value = &dummy;
18604
18605 @@ -551,6 +553,8 @@ acpi_os_write_memory(acpi_physical_addre
18606         void __iomem *virt_addr;
18607
18608         virt_addr = ioremap(phys_addr, width);
18609 +       if (!virt_addr)
18610 +               return AE_NO_MEMORY;
18611
18612         switch (width) {
18613         case 8:
18614 diff -urNp linux-2.6.33/drivers/acpi/processor_core.c linux-2.6.33/drivers/acpi/processor_core.c
18615 --- linux-2.6.33/drivers/acpi/processor_core.c  2010-02-24 13:52:17.000000000 -0500
18616 +++ linux-2.6.33/drivers/acpi/processor_core.c  2010-03-07 12:23:35.965718140 -0500
18617 @@ -734,7 +734,7 @@ static int __cpuinit acpi_processor_add(
18618                 return 0;
18619         }
18620
18621 -       BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
18622 +       BUG_ON(pr->id >= nr_cpu_ids);
18623
18624         /*
18625          * Buggy BIOS check
18626 diff -urNp linux-2.6.33/drivers/acpi/processor_idle.c linux-2.6.33/drivers/acpi/processor_idle.c
18627 --- linux-2.6.33/drivers/acpi/processor_idle.c  2010-02-24 13:52:17.000000000 -0500
18628 +++ linux-2.6.33/drivers/acpi/processor_idle.c  2010-03-07 12:23:35.965718140 -0500
18629 @@ -118,7 +118,7 @@ static struct dmi_system_id __cpuinitdat
18630           DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
18631           DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
18632          (void *)1},
18633 -       {},
18634 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
18635  };
18636
18637
18638 diff -urNp linux-2.6.33/drivers/acpi/sleep.c linux-2.6.33/drivers/acpi/sleep.c
18639 --- linux-2.6.33/drivers/acpi/sleep.c   2010-02-24 13:52:17.000000000 -0500
18640 +++ linux-2.6.33/drivers/acpi/sleep.c   2010-03-07 12:23:35.965718140 -0500
18641 @@ -302,7 +302,7 @@ static int acpi_suspend_state_valid(susp
18642         }
18643  }
18644
18645 -static struct platform_suspend_ops acpi_suspend_ops = {
18646 +static const struct platform_suspend_ops acpi_suspend_ops = {
18647         .valid = acpi_suspend_state_valid,
18648         .begin = acpi_suspend_begin,
18649         .prepare_late = acpi_pm_prepare,
18650 @@ -330,7 +330,7 @@ static int acpi_suspend_begin_old(suspen
18651   * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
18652   * been requested.
18653   */
18654 -static struct platform_suspend_ops acpi_suspend_ops_old = {
18655 +static const struct platform_suspend_ops acpi_suspend_ops_old = {
18656         .valid = acpi_suspend_state_valid,
18657         .begin = acpi_suspend_begin_old,
18658         .prepare_late = acpi_pm_disable_gpes,
18659 @@ -557,7 +557,7 @@ static void acpi_pm_enable_gpes(void)
18660         acpi_enable_all_runtime_gpes();
18661  }
18662
18663 -static struct platform_hibernation_ops acpi_hibernation_ops = {
18664 +static const struct platform_hibernation_ops acpi_hibernation_ops = {
18665         .begin = acpi_hibernation_begin,
18666         .end = acpi_pm_end,
18667         .pre_snapshot = acpi_hibernation_pre_snapshot,
18668 @@ -610,7 +610,7 @@ static int acpi_hibernation_pre_snapshot
18669   * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
18670   * been requested.
18671   */
18672 -static struct platform_hibernation_ops acpi_hibernation_ops_old = {
18673 +static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
18674         .begin = acpi_hibernation_begin_old,
18675         .end = acpi_pm_end,
18676         .pre_snapshot = acpi_hibernation_pre_snapshot_old,
18677 diff -urNp linux-2.6.33/drivers/acpi/video.c linux-2.6.33/drivers/acpi/video.c
18678 --- linux-2.6.33/drivers/acpi/video.c   2010-02-24 13:52:17.000000000 -0500
18679 +++ linux-2.6.33/drivers/acpi/video.c   2010-03-07 12:23:35.965718140 -0500
18680 @@ -366,7 +366,7 @@ static int acpi_video_set_brightness(str
18681                                 vd->brightness->levels[request_level]);
18682  }
18683
18684 -static struct backlight_ops acpi_backlight_ops = {
18685 +static const struct backlight_ops acpi_backlight_ops = {
18686         .get_brightness = acpi_video_get_brightness,
18687         .update_status  = acpi_video_set_brightness,
18688  };
18689 diff -urNp linux-2.6.33/drivers/ata/ahci.c linux-2.6.33/drivers/ata/ahci.c
18690 --- linux-2.6.33/drivers/ata/ahci.c     2010-02-24 13:52:17.000000000 -0500
18691 +++ linux-2.6.33/drivers/ata/ahci.c     2010-03-07 12:23:35.965718140 -0500
18692 @@ -387,7 +387,7 @@ static struct scsi_host_template ahci_sh
18693         .sdev_attrs             = ahci_sdev_attrs,
18694  };
18695
18696 -static struct ata_port_operations ahci_ops = {
18697 +static const struct ata_port_operations ahci_ops = {
18698         .inherits               = &sata_pmp_port_ops,
18699
18700         .qc_defer               = sata_pmp_qc_defer_cmd_switch,
18701 @@ -424,17 +424,17 @@ static struct ata_port_operations ahci_o
18702         .port_stop              = ahci_port_stop,
18703  };
18704
18705 -static struct ata_port_operations ahci_vt8251_ops = {
18706 +static const struct ata_port_operations ahci_vt8251_ops = {
18707         .inherits               = &ahci_ops,
18708         .hardreset              = ahci_vt8251_hardreset,
18709  };
18710
18711 -static struct ata_port_operations ahci_p5wdh_ops = {
18712 +static const struct ata_port_operations ahci_p5wdh_ops = {
18713         .inherits               = &ahci_ops,
18714         .hardreset              = ahci_p5wdh_hardreset,
18715  };
18716
18717 -static struct ata_port_operations ahci_sb600_ops = {
18718 +static const struct ata_port_operations ahci_sb600_ops = {
18719         .inherits               = &ahci_ops,
18720         .softreset              = ahci_sb600_softreset,
18721         .pmp_softreset          = ahci_sb600_softreset,
18722 @@ -681,7 +681,7 @@ static const struct pci_device_id ahci_p
18723         { PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
18724           PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
18725
18726 -       { }     /* terminate list */
18727 +       { 0, 0, 0, 0, 0, 0, 0 } /* terminate list */
18728  };
18729
18730
18731 diff -urNp linux-2.6.33/drivers/ata/ata_generic.c linux-2.6.33/drivers/ata/ata_generic.c
18732 --- linux-2.6.33/drivers/ata/ata_generic.c      2010-02-24 13:52:17.000000000 -0500
18733 +++ linux-2.6.33/drivers/ata/ata_generic.c      2010-03-07 12:23:35.965718140 -0500
18734 @@ -95,7 +95,7 @@ static struct scsi_host_template generic
18735         ATA_BMDMA_SHT(DRV_NAME),
18736  };
18737
18738 -static struct ata_port_operations generic_port_ops = {
18739 +static const struct ata_port_operations generic_port_ops = {
18740         .inherits       = &ata_bmdma_port_ops,
18741         .cable_detect   = ata_cable_unknown,
18742         .set_mode       = generic_set_mode,
18743 diff -urNp linux-2.6.33/drivers/ata/ata_piix.c linux-2.6.33/drivers/ata/ata_piix.c
18744 --- linux-2.6.33/drivers/ata/ata_piix.c 2010-02-24 13:52:17.000000000 -0500
18745 +++ linux-2.6.33/drivers/ata/ata_piix.c 2010-03-07 12:23:35.969642115 -0500
18746 @@ -291,7 +291,7 @@ static const struct pci_device_id piix_p
18747         { 0x8086, 0x3b2d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
18748         /* SATA Controller IDE (PCH) */
18749         { 0x8086, 0x3b2e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
18750 -       { }     /* terminate list */
18751 +       { 0, 0, 0, 0, 0, 0, 0 } /* terminate list */
18752  };
18753
18754  static struct pci_driver piix_pci_driver = {
18755 @@ -309,7 +309,7 @@ static struct scsi_host_template piix_sh
18756         ATA_BMDMA_SHT(DRV_NAME),
18757  };
18758
18759 -static struct ata_port_operations piix_pata_ops = {
18760 +static const struct ata_port_operations piix_pata_ops = {
18761         .inherits               = &ata_bmdma32_port_ops,
18762         .cable_detect           = ata_cable_40wire,
18763         .set_piomode            = piix_set_piomode,
18764 @@ -317,22 +317,22 @@ static struct ata_port_operations piix_p
18765         .prereset               = piix_pata_prereset,
18766  };
18767
18768 -static struct ata_port_operations piix_vmw_ops = {
18769 +static const struct ata_port_operations piix_vmw_ops = {
18770         .inherits               = &piix_pata_ops,
18771         .bmdma_status           = piix_vmw_bmdma_status,
18772  };
18773
18774 -static struct ata_port_operations ich_pata_ops = {
18775 +static const struct ata_port_operations ich_pata_ops = {
18776         .inherits               = &piix_pata_ops,
18777         .cable_detect           = ich_pata_cable_detect,
18778         .set_dmamode            = ich_set_dmamode,
18779  };
18780
18781 -static struct ata_port_operations piix_sata_ops = {
18782 +static const struct ata_port_operations piix_sata_ops = {
18783         .inherits               = &ata_bmdma32_port_ops,
18784  };
18785
18786 -static struct ata_port_operations piix_sidpr_sata_ops = {
18787 +static const struct ata_port_operations piix_sidpr_sata_ops = {
18788         .inherits               = &piix_sata_ops,
18789         .hardreset              = sata_std_hardreset,
18790         .scr_read               = piix_sidpr_scr_read,
18791 @@ -608,7 +608,7 @@ static const struct ich_laptop ich_lapto
18792         { 0x2653, 0x1043, 0x82D8 },     /* ICH6M on Asus Eee 701 */
18793         { 0x27df, 0x104d, 0x900e },     /* ICH7 on Sony TZ-90 */
18794         /* end marker */
18795 -       { 0, }
18796 +       { 0, 0, 0 }
18797  };
18798
18799  /**
18800 @@ -1086,7 +1086,7 @@ static int piix_broken_suspend(void)
18801                         },
18802                 },
18803
18804 -               { }     /* terminate list */
18805 +               { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }        /* terminate list */
18806         };
18807         static const char *oemstrs[] = {
18808                 "Tecra M3,",
18809 diff -urNp linux-2.6.33/drivers/ata/libata-acpi.c linux-2.6.33/drivers/ata/libata-acpi.c
18810 --- linux-2.6.33/drivers/ata/libata-acpi.c      2010-02-24 13:52:17.000000000 -0500
18811 +++ linux-2.6.33/drivers/ata/libata-acpi.c      2010-03-07 12:23:35.969642115 -0500
18812 @@ -223,12 +223,12 @@ static void ata_acpi_dev_uevent(acpi_han
18813         ata_acpi_uevent(dev->link->ap, dev, event);
18814  }
18815
18816 -static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
18817 +static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
18818         .handler = ata_acpi_dev_notify_dock,
18819         .uevent = ata_acpi_dev_uevent,
18820  };
18821
18822 -static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
18823 +static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
18824         .handler = ata_acpi_ap_notify_dock,
18825         .uevent = ata_acpi_ap_uevent,
18826  };
18827 diff -urNp linux-2.6.33/drivers/ata/libata-core.c linux-2.6.33/drivers/ata/libata-core.c
18828 --- linux-2.6.33/drivers/ata/libata-core.c      2010-02-24 13:52:17.000000000 -0500
18829 +++ linux-2.6.33/drivers/ata/libata-core.c      2010-03-07 12:23:35.969642115 -0500
18830 @@ -896,7 +896,7 @@ static const struct ata_xfer_ent {
18831         { ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
18832         { ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
18833         { ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
18834 -       { -1, },
18835 +       { -1, 0, 0 }
18836  };
18837
18838  /**
18839 @@ -3163,7 +3163,7 @@ static const struct ata_timing ata_timin
18840         { XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
18841         { XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
18842
18843 -       { 0xFF }
18844 +       { 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
18845  };
18846
18847  #define ENOUGH(v, unit)                (((v)-1)/(unit)+1)
18848 @@ -4385,7 +4385,7 @@ static const struct ata_blacklist_entry
18849         { "PIONEER DVD-RW  DVRTD08",    "1.00", ATA_HORKAGE_NOSETXFER },
18850
18851         /* End Marker */
18852 -       { }
18853 +       { NULL, NULL, 0 }
18854  };
18855
18856  static int strn_pattern_cmp(const char *patt, const char *name, int wildchar)
18857 @@ -5961,7 +5961,7 @@ static void ata_host_stop(struct device
18858   *     LOCKING:
18859   *     None.
18860   */
18861 -static void ata_finalize_port_ops(struct ata_port_operations *ops)
18862 +static void ata_finalize_port_ops(const struct ata_port_operations *ops)
18863  {
18864         static DEFINE_SPINLOCK(lock);
18865         const struct ata_port_operations *cur;
18866 @@ -5973,6 +5973,7 @@ static void ata_finalize_port_ops(struct
18867                 return;
18868
18869         spin_lock(&lock);
18870 +       pax_open_kernel();
18871
18872         for (cur = ops->inherits; cur; cur = cur->inherits) {
18873                 void **inherit = (void **)cur;
18874 @@ -5986,8 +5987,9 @@ static void ata_finalize_port_ops(struct
18875                 if (IS_ERR(*pp))
18876                         *pp = NULL;
18877
18878 -       ops->inherits = NULL;
18879 +       ((struct ata_port_operations *)ops)->inherits = NULL;
18880
18881 +       pax_close_kernel();
18882         spin_unlock(&lock);
18883  }
18884
18885 @@ -6084,7 +6086,7 @@ int ata_host_start(struct ata_host *host
18886   */
18887  /* KILLME - the only user left is ipr */
18888  void ata_host_init(struct ata_host *host, struct device *dev,
18889 -                  unsigned long flags, struct ata_port_operations *ops)
18890 +                  unsigned long flags, const struct ata_port_operations *ops)
18891  {
18892         spin_lock_init(&host->lock);
18893         host->dev = dev;
18894 @@ -6754,7 +6756,7 @@ static void ata_dummy_error_handler(stru
18895         /* truly dummy */
18896  }
18897
18898 -struct ata_port_operations ata_dummy_port_ops = {
18899 +const struct ata_port_operations ata_dummy_port_ops = {
18900         .qc_prep                = ata_noop_qc_prep,
18901         .qc_issue               = ata_dummy_qc_issue,
18902         .error_handler          = ata_dummy_error_handler,
18903 diff -urNp linux-2.6.33/drivers/ata/libata-eh.c linux-2.6.33/drivers/ata/libata-eh.c
18904 --- linux-2.6.33/drivers/ata/libata-eh.c        2010-02-24 13:52:17.000000000 -0500
18905 +++ linux-2.6.33/drivers/ata/libata-eh.c        2010-03-07 12:23:35.969642115 -0500
18906 @@ -3675,7 +3675,7 @@ void ata_do_eh(struct ata_port *ap, ata_
18907   */
18908  void ata_std_error_handler(struct ata_port *ap)
18909  {
18910 -       struct ata_port_operations *ops = ap->ops;
18911 +       const struct ata_port_operations *ops = ap->ops;
18912         ata_reset_fn_t hardreset = ops->hardreset;
18913
18914         /* ignore built-in hardreset if SCR access is not available */
18915 diff -urNp linux-2.6.33/drivers/ata/libata-pmp.c linux-2.6.33/drivers/ata/libata-pmp.c
18916 --- linux-2.6.33/drivers/ata/libata-pmp.c       2010-02-24 13:52:17.000000000 -0500
18917 +++ linux-2.6.33/drivers/ata/libata-pmp.c       2010-03-07 12:23:35.969642115 -0500
18918 @@ -841,7 +841,7 @@ static int sata_pmp_handle_link_fail(str
18919   */
18920  static int sata_pmp_eh_recover(struct ata_port *ap)
18921  {
18922 -       struct ata_port_operations *ops = ap->ops;
18923 +       const struct ata_port_operations *ops = ap->ops;
18924         int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
18925         struct ata_link *pmp_link = &ap->link;
18926         struct ata_device *pmp_dev = pmp_link->device;
18927 diff -urNp linux-2.6.33/drivers/ata/pata_acpi.c linux-2.6.33/drivers/ata/pata_acpi.c
18928 --- linux-2.6.33/drivers/ata/pata_acpi.c        2010-02-24 13:52:17.000000000 -0500
18929 +++ linux-2.6.33/drivers/ata/pata_acpi.c        2010-03-07 12:23:35.969642115 -0500
18930 @@ -215,7 +215,7 @@ static struct scsi_host_template pacpi_s
18931         ATA_BMDMA_SHT(DRV_NAME),
18932  };
18933
18934 -static struct ata_port_operations pacpi_ops = {
18935 +static const struct ata_port_operations pacpi_ops = {
18936         .inherits               = &ata_bmdma_port_ops,
18937         .qc_issue               = pacpi_qc_issue,
18938         .cable_detect           = pacpi_cable_detect,
18939 diff -urNp linux-2.6.33/drivers/ata/pata_ali.c linux-2.6.33/drivers/ata/pata_ali.c
18940 --- linux-2.6.33/drivers/ata/pata_ali.c 2010-02-24 13:52:17.000000000 -0500
18941 +++ linux-2.6.33/drivers/ata/pata_ali.c 2010-03-07 12:23:35.969642115 -0500
18942 @@ -365,7 +365,7 @@ static struct scsi_host_template ali_sht
18943   *     Port operations for PIO only ALi
18944   */
18945
18946 -static struct ata_port_operations ali_early_port_ops = {
18947 +static const struct ata_port_operations ali_early_port_ops = {
18948         .inherits       = &ata_sff_port_ops,
18949         .cable_detect   = ata_cable_40wire,
18950         .set_piomode    = ali_set_piomode,
18951 @@ -382,7 +382,7 @@ static const struct ata_port_operations
18952   *     Port operations for DMA capable ALi without cable
18953   *     detect
18954   */
18955 -static struct ata_port_operations ali_20_port_ops = {
18956 +static const struct ata_port_operations ali_20_port_ops = {
18957         .inherits       = &ali_dma_base_ops,
18958         .cable_detect   = ata_cable_40wire,
18959         .mode_filter    = ali_20_filter,
18960 @@ -393,7 +393,7 @@ static struct ata_port_operations ali_20
18961  /*
18962   *     Port operations for DMA capable ALi with cable detect
18963   */
18964 -static struct ata_port_operations ali_c2_port_ops = {
18965 +static const struct ata_port_operations ali_c2_port_ops = {
18966         .inherits       = &ali_dma_base_ops,
18967         .check_atapi_dma = ali_check_atapi_dma,
18968         .cable_detect   = ali_c2_cable_detect,
18969 @@ -404,7 +404,7 @@ static struct ata_port_operations ali_c2
18970  /*
18971   *     Port operations for DMA capable ALi with cable detect
18972   */
18973 -static struct ata_port_operations ali_c4_port_ops = {
18974 +static const struct ata_port_operations ali_c4_port_ops = {
18975         .inherits       = &ali_dma_base_ops,
18976         .check_atapi_dma = ali_check_atapi_dma,
18977         .cable_detect   = ali_c2_cable_detect,
18978 @@ -414,7 +414,7 @@ static struct ata_port_operations ali_c4
18979  /*
18980   *     Port operations for DMA capable ALi with cable detect and LBA48
18981   */
18982 -static struct ata_port_operations ali_c5_port_ops = {
18983 +static const struct ata_port_operations ali_c5_port_ops = {
18984         .inherits       = &ali_dma_base_ops,
18985         .check_atapi_dma = ali_check_atapi_dma,
18986         .dev_config     = ali_warn_atapi_dma,
18987 diff -urNp linux-2.6.33/drivers/ata/pata_amd.c linux-2.6.33/drivers/ata/pata_amd.c
18988 --- linux-2.6.33/drivers/ata/pata_amd.c 2010-02-24 13:52:17.000000000 -0500
18989 +++ linux-2.6.33/drivers/ata/pata_amd.c 2010-03-07 12:23:35.969642115 -0500
18990 @@ -397,28 +397,28 @@ static const struct ata_port_operations
18991         .prereset       = amd_pre_reset,
18992  };
18993
18994 -static struct ata_port_operations amd33_port_ops = {
18995 +static const struct ata_port_operations amd33_port_ops = {
18996         .inherits       = &amd_base_port_ops,
18997         .cable_detect   = ata_cable_40wire,
18998         .set_piomode    = amd33_set_piomode,
18999         .set_dmamode    = amd33_set_dmamode,
19000  };
19001
19002 -static struct ata_port_operations amd66_port_ops = {
19003 +static const struct ata_port_operations amd66_port_ops = {
19004         .inherits       = &amd_base_port_ops,
19005         .cable_detect   = ata_cable_unknown,
19006         .set_piomode    = amd66_set_piomode,
19007         .set_dmamode    = amd66_set_dmamode,
19008  };
19009
19010 -static struct ata_port_operations amd100_port_ops = {
19011 +static const struct ata_port_operations amd100_port_ops = {
19012         .inherits       = &amd_base_port_ops,
19013         .cable_detect   = ata_cable_unknown,
19014         .set_piomode    = amd100_set_piomode,
19015         .set_dmamode    = amd100_set_dmamode,
19016  };
19017
19018 -static struct ata_port_operations amd133_port_ops = {
19019 +static const struct ata_port_operations amd133_port_ops = {
19020         .inherits       = &amd_base_port_ops,
19021         .cable_detect   = amd_cable_detect,
19022         .set_piomode    = amd133_set_piomode,
19023 @@ -433,13 +433,13 @@ static const struct ata_port_operations
19024         .host_stop      = nv_host_stop,
19025  };
19026
19027 -static struct ata_port_operations nv100_port_ops = {
19028 +static const struct ata_port_operations nv100_port_ops = {
19029         .inherits       = &nv_base_port_ops,
19030         .set_piomode    = nv100_set_piomode,
19031         .set_dmamode    = nv100_set_dmamode,
19032  };
19033
19034 -static struct ata_port_operations nv133_port_ops = {
19035 +static const struct ata_port_operations nv133_port_ops = {
19036         .inherits       = &nv_base_port_ops,
19037         .set_piomode    = nv133_set_piomode,
19038         .set_dmamode    = nv133_set_dmamode,
19039 diff -urNp linux-2.6.33/drivers/ata/pata_artop.c linux-2.6.33/drivers/ata/pata_artop.c
19040 --- linux-2.6.33/drivers/ata/pata_artop.c       2010-02-24 13:52:17.000000000 -0500
19041 +++ linux-2.6.33/drivers/ata/pata_artop.c       2010-03-07 12:23:35.969642115 -0500
19042 @@ -311,7 +311,7 @@ static struct scsi_host_template artop_s
19043         ATA_BMDMA_SHT(DRV_NAME),
19044  };
19045
19046 -static struct ata_port_operations artop6210_ops = {
19047 +static const struct ata_port_operations artop6210_ops = {
19048         .inherits               = &ata_bmdma_port_ops,
19049         .cable_detect           = ata_cable_40wire,
19050         .set_piomode            = artop6210_set_piomode,
19051 @@ -320,7 +320,7 @@ static struct ata_port_operations artop6
19052         .qc_defer               = artop6210_qc_defer,
19053  };
19054
19055 -static struct ata_port_operations artop6260_ops = {
19056 +static const struct ata_port_operations artop6260_ops = {
19057         .inherits               = &ata_bmdma_port_ops,
19058         .cable_detect           = artop6260_cable_detect,
19059         .set_piomode            = artop6260_set_piomode,
19060 diff -urNp linux-2.6.33/drivers/ata/pata_at32.c linux-2.6.33/drivers/ata/pata_at32.c
19061 --- linux-2.6.33/drivers/ata/pata_at32.c        2010-02-24 13:52:17.000000000 -0500
19062 +++ linux-2.6.33/drivers/ata/pata_at32.c        2010-03-07 12:23:35.969642115 -0500
19063 @@ -172,7 +172,7 @@ static struct scsi_host_template at32_sh
19064         ATA_PIO_SHT(DRV_NAME),
19065  };
19066
19067 -static struct ata_port_operations at32_port_ops = {
19068 +static const struct ata_port_operations at32_port_ops = {
19069         .inherits               = &ata_sff_port_ops,
19070         .cable_detect           = ata_cable_40wire,
19071         .set_piomode            = pata_at32_set_piomode,
19072 diff -urNp linux-2.6.33/drivers/ata/pata_at91.c linux-2.6.33/drivers/ata/pata_at91.c
19073 --- linux-2.6.33/drivers/ata/pata_at91.c        2010-02-24 13:52:17.000000000 -0500
19074 +++ linux-2.6.33/drivers/ata/pata_at91.c        2010-03-07 12:23:35.969642115 -0500
19075 @@ -195,7 +195,7 @@ static struct scsi_host_template pata_at
19076         ATA_PIO_SHT(DRV_NAME),
19077  };
19078
19079 -static struct ata_port_operations pata_at91_port_ops = {
19080 +static const struct ata_port_operations pata_at91_port_ops = {
19081         .inherits       = &ata_sff_port_ops,
19082
19083         .sff_data_xfer  = pata_at91_data_xfer_noirq,
19084 diff -urNp linux-2.6.33/drivers/ata/pata_atiixp.c linux-2.6.33/drivers/ata/pata_atiixp.c
19085 --- linux-2.6.33/drivers/ata/pata_atiixp.c      2010-02-24 13:52:17.000000000 -0500
19086 +++ linux-2.6.33/drivers/ata/pata_atiixp.c      2010-03-07 12:23:35.969642115 -0500
19087 @@ -205,7 +205,7 @@ static struct scsi_host_template atiixp_
19088         .sg_tablesize           = LIBATA_DUMB_MAX_PRD,
19089  };
19090
19091 -static struct ata_port_operations atiixp_port_ops = {
19092 +static const struct ata_port_operations atiixp_port_ops = {
19093         .inherits       = &ata_bmdma_port_ops,
19094
19095         .qc_prep        = ata_sff_dumb_qc_prep,
19096 diff -urNp linux-2.6.33/drivers/ata/pata_atp867x.c linux-2.6.33/drivers/ata/pata_atp867x.c
19097 --- linux-2.6.33/drivers/ata/pata_atp867x.c     2010-02-24 13:52:17.000000000 -0500
19098 +++ linux-2.6.33/drivers/ata/pata_atp867x.c     2010-03-07 12:23:35.973706141 -0500
19099 @@ -274,7 +274,7 @@ static struct scsi_host_template atp867x
19100         ATA_BMDMA_SHT(DRV_NAME),
19101  };
19102
19103 -static struct ata_port_operations atp867x_ops = {
19104 +static const struct ata_port_operations atp867x_ops = {
19105         .inherits               = &ata_bmdma_port_ops,
19106         .cable_detect           = atp867x_cable_detect,
19107         .set_piomode            = atp867x_set_piomode,
19108 diff -urNp linux-2.6.33/drivers/ata/pata_bf54x.c linux-2.6.33/drivers/ata/pata_bf54x.c
19109 --- linux-2.6.33/drivers/ata/pata_bf54x.c       2010-02-24 13:52:17.000000000 -0500
19110 +++ linux-2.6.33/drivers/ata/pata_bf54x.c       2010-03-07 12:23:35.973706141 -0500
19111 @@ -1464,7 +1464,7 @@ static struct scsi_host_template bfin_sh
19112         .dma_boundary           = ATA_DMA_BOUNDARY,
19113  };
19114
19115 -static struct ata_port_operations bfin_pata_ops = {
19116 +static const struct ata_port_operations bfin_pata_ops = {
19117         .inherits               = &ata_sff_port_ops,
19118
19119         .set_piomode            = bfin_set_piomode,
19120 diff -urNp linux-2.6.33/drivers/ata/pata_cmd640.c linux-2.6.33/drivers/ata/pata_cmd640.c
19121 --- linux-2.6.33/drivers/ata/pata_cmd640.c      2010-02-24 13:52:17.000000000 -0500
19122 +++ linux-2.6.33/drivers/ata/pata_cmd640.c      2010-03-07 12:23:35.973706141 -0500
19123 @@ -168,7 +168,7 @@ static struct scsi_host_template cmd640_
19124         ATA_BMDMA_SHT(DRV_NAME),
19125  };
19126
19127 -static struct ata_port_operations cmd640_port_ops = {
19128 +static const struct ata_port_operations cmd640_port_ops = {
19129         .inherits       = &ata_bmdma_port_ops,
19130         /* In theory xfer_noirq is not needed once we kill the prefetcher */
19131         .sff_data_xfer  = ata_sff_data_xfer_noirq,
19132 diff -urNp linux-2.6.33/drivers/ata/pata_cmd64x.c linux-2.6.33/drivers/ata/pata_cmd64x.c
19133 --- linux-2.6.33/drivers/ata/pata_cmd64x.c      2010-02-24 13:52:17.000000000 -0500
19134 +++ linux-2.6.33/drivers/ata/pata_cmd64x.c      2010-03-07 12:23:35.973706141 -0500
19135 @@ -275,18 +275,18 @@ static const struct ata_port_operations
19136         .set_dmamode    = cmd64x_set_dmamode,
19137  };
19138
19139 -static struct ata_port_operations cmd64x_port_ops = {
19140 +static const struct ata_port_operations cmd64x_port_ops = {
19141         .inherits       = &cmd64x_base_ops,
19142         .cable_detect   = ata_cable_40wire,
19143  };
19144
19145 -static struct ata_port_operations cmd646r1_port_ops = {
19146 +static const struct ata_port_operations cmd646r1_port_ops = {
19147         .inherits       = &cmd64x_base_ops,
19148         .bmdma_stop     = cmd646r1_bmdma_stop,
19149         .cable_detect   = ata_cable_40wire,
19150  };
19151
19152 -static struct ata_port_operations cmd648_port_ops = {
19153 +static const struct ata_port_operations cmd648_port_ops = {
19154         .inherits       = &cmd64x_base_ops,
19155         .bmdma_stop     = cmd648_bmdma_stop,
19156         .cable_detect   = cmd648_cable_detect,
19157 diff -urNp linux-2.6.33/drivers/ata/pata_cs5520.c linux-2.6.33/drivers/ata/pata_cs5520.c
19158 --- linux-2.6.33/drivers/ata/pata_cs5520.c      2010-02-24 13:52:17.000000000 -0500
19159 +++ linux-2.6.33/drivers/ata/pata_cs5520.c      2010-03-07 12:23:35.973706141 -0500
19160 @@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
19161         .sg_tablesize           = LIBATA_DUMB_MAX_PRD,
19162  };
19163
19164 -static struct ata_port_operations cs5520_port_ops = {
19165 +static const struct ata_port_operations cs5520_port_ops = {
19166         .inherits               = &ata_bmdma_port_ops,
19167         .qc_prep                = ata_sff_dumb_qc_prep,
19168         .cable_detect           = ata_cable_40wire,
19169 diff -urNp linux-2.6.33/drivers/ata/pata_cs5530.c linux-2.6.33/drivers/ata/pata_cs5530.c
19170 --- linux-2.6.33/drivers/ata/pata_cs5530.c      2010-02-24 13:52:17.000000000 -0500
19171 +++ linux-2.6.33/drivers/ata/pata_cs5530.c      2010-03-07 12:23:35.973706141 -0500
19172 @@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
19173         .sg_tablesize   = LIBATA_DUMB_MAX_PRD,
19174  };
19175
19176 -static struct ata_port_operations cs5530_port_ops = {
19177 +static const struct ata_port_operations cs5530_port_ops = {
19178         .inherits       = &ata_bmdma_port_ops,
19179
19180         .qc_prep        = ata_sff_dumb_qc_prep,
19181 diff -urNp linux-2.6.33/drivers/ata/pata_cs5535.c linux-2.6.33/drivers/ata/pata_cs5535.c
19182 --- linux-2.6.33/drivers/ata/pata_cs5535.c      2010-02-24 13:52:17.000000000 -0500
19183 +++ linux-2.6.33/drivers/ata/pata_cs5535.c      2010-03-07 12:23:35.973706141 -0500
19184 @@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
19185         ATA_BMDMA_SHT(DRV_NAME),
19186  };
19187
19188 -static struct ata_port_operations cs5535_port_ops = {
19189 +static const struct ata_port_operations cs5535_port_ops = {
19190         .inherits       = &ata_bmdma_port_ops,
19191         .cable_detect   = cs5535_cable_detect,
19192         .set_piomode    = cs5535_set_piomode,
19193 diff -urNp linux-2.6.33/drivers/ata/pata_cs5536.c linux-2.6.33/drivers/ata/pata_cs5536.c
19194 --- linux-2.6.33/drivers/ata/pata_cs5536.c      2010-02-24 13:52:17.000000000 -0500
19195 +++ linux-2.6.33/drivers/ata/pata_cs5536.c      2010-03-07 12:23:35.973706141 -0500
19196 @@ -223,7 +223,7 @@ static struct scsi_host_template cs5536_
19197         ATA_BMDMA_SHT(DRV_NAME),
19198  };
19199
19200 -static struct ata_port_operations cs5536_port_ops = {
19201 +static const struct ata_port_operations cs5536_port_ops = {
19202         .inherits               = &ata_bmdma32_port_ops,
19203         .cable_detect           = cs5536_cable_detect,
19204         .set_piomode            = cs5536_set_piomode,
19205 diff -urNp linux-2.6.33/drivers/ata/pata_cypress.c linux-2.6.33/drivers/ata/pata_cypress.c
19206 --- linux-2.6.33/drivers/ata/pata_cypress.c     2010-02-24 13:52:17.000000000 -0500
19207 +++ linux-2.6.33/drivers/ata/pata_cypress.c     2010-03-07 12:23:35.973706141 -0500
19208 @@ -113,7 +113,7 @@ static struct scsi_host_template cy82c69
19209         ATA_BMDMA_SHT(DRV_NAME),
19210  };
19211
19212 -static struct ata_port_operations cy82c693_port_ops = {
19213 +static const struct ata_port_operations cy82c693_port_ops = {
19214         .inherits       = &ata_bmdma_port_ops,
19215         .cable_detect   = ata_cable_40wire,
19216         .set_piomode    = cy82c693_set_piomode,
19217 diff -urNp linux-2.6.33/drivers/ata/pata_efar.c linux-2.6.33/drivers/ata/pata_efar.c
19218 --- linux-2.6.33/drivers/ata/pata_efar.c        2010-02-24 13:52:17.000000000 -0500
19219 +++ linux-2.6.33/drivers/ata/pata_efar.c        2010-03-07 12:23:35.973706141 -0500
19220 @@ -223,7 +223,7 @@ static struct scsi_host_template efar_sh
19221         ATA_BMDMA_SHT(DRV_NAME),
19222  };
19223
19224 -static struct ata_port_operations efar_ops = {
19225 +static const struct ata_port_operations efar_ops = {
19226         .inherits               = &ata_bmdma_port_ops,
19227         .cable_detect           = efar_cable_detect,
19228         .set_piomode            = efar_set_piomode,
19229 diff -urNp linux-2.6.33/drivers/ata/pata_hpt366.c linux-2.6.33/drivers/ata/pata_hpt366.c
19230 --- linux-2.6.33/drivers/ata/pata_hpt366.c      2010-02-24 13:52:17.000000000 -0500
19231 +++ linux-2.6.33/drivers/ata/pata_hpt366.c      2010-03-07 12:23:35.973706141 -0500
19232 @@ -280,7 +280,7 @@ static struct scsi_host_template hpt36x_
19233   *     Configuration for HPT366/68
19234   */
19235
19236 -static struct ata_port_operations hpt366_port_ops = {
19237 +static const struct ata_port_operations hpt366_port_ops = {
19238         .inherits       = &ata_bmdma_port_ops,
19239         .cable_detect   = hpt36x_cable_detect,
19240         .mode_filter    = hpt366_filter,
19241 diff -urNp linux-2.6.33/drivers/ata/pata_hpt37x.c linux-2.6.33/drivers/ata/pata_hpt37x.c
19242 --- linux-2.6.33/drivers/ata/pata_hpt37x.c      2010-02-24 13:52:17.000000000 -0500
19243 +++ linux-2.6.33/drivers/ata/pata_hpt37x.c      2010-03-07 12:23:35.973706141 -0500
19244 @@ -583,7 +583,7 @@ static struct scsi_host_template hpt37x_
19245   *     Configuration for HPT370
19246   */
19247
19248 -static struct ata_port_operations hpt370_port_ops = {
19249 +static const struct ata_port_operations hpt370_port_ops = {
19250         .inherits       = &ata_bmdma_port_ops,
19251
19252         .bmdma_stop     = hpt370_bmdma_stop,
19253 @@ -599,7 +599,7 @@ static struct ata_port_operations hpt370
19254   *     Configuration for HPT370A. Close to 370 but less filters
19255   */
19256
19257 -static struct ata_port_operations hpt370a_port_ops = {
19258 +static const struct ata_port_operations hpt370a_port_ops = {
19259         .inherits       = &hpt370_port_ops,
19260         .mode_filter    = hpt370a_filter,
19261  };
19262 @@ -609,7 +609,7 @@ static struct ata_port_operations hpt370
19263   *     and DMA mode setting functionality.
19264   */
19265
19266 -static struct ata_port_operations hpt372_port_ops = {
19267 +static const struct ata_port_operations hpt372_port_ops = {
19268         .inherits       = &ata_bmdma_port_ops,
19269
19270         .bmdma_stop     = hpt37x_bmdma_stop,
19271 @@ -625,7 +625,7 @@ static struct ata_port_operations hpt372
19272   *     but we have a different cable detection procedure for function 1.
19273   */
19274
19275 -static struct ata_port_operations hpt374_fn1_port_ops = {
19276 +static const struct ata_port_operations hpt374_fn1_port_ops = {
19277         .inherits       = &hpt372_port_ops,
19278         .cable_detect   = hpt374_fn1_cable_detect,
19279         .prereset       = hpt37x_pre_reset,
19280 diff -urNp linux-2.6.33/drivers/ata/pata_hpt3x2n.c linux-2.6.33/drivers/ata/pata_hpt3x2n.c
19281 --- linux-2.6.33/drivers/ata/pata_hpt3x2n.c     2010-02-24 13:52:17.000000000 -0500
19282 +++ linux-2.6.33/drivers/ata/pata_hpt3x2n.c     2010-03-07 12:23:35.973706141 -0500
19283 @@ -339,7 +339,7 @@ static struct scsi_host_template hpt3x2n
19284   *     Configuration for HPT3x2n.
19285   */
19286
19287 -static struct ata_port_operations hpt3x2n_port_ops = {
19288 +static const struct ata_port_operations hpt3x2n_port_ops = {
19289         .inherits       = &ata_bmdma_port_ops,
19290
19291         .bmdma_stop     = hpt3x2n_bmdma_stop,
19292 diff -urNp linux-2.6.33/drivers/ata/pata_hpt3x3.c linux-2.6.33/drivers/ata/pata_hpt3x3.c
19293 --- linux-2.6.33/drivers/ata/pata_hpt3x3.c      2010-02-24 13:52:17.000000000 -0500
19294 +++ linux-2.6.33/drivers/ata/pata_hpt3x3.c      2010-03-07 12:23:35.973706141 -0500
19295 @@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
19296         ATA_BMDMA_SHT(DRV_NAME),
19297  };
19298
19299 -static struct ata_port_operations hpt3x3_port_ops = {
19300 +static const struct ata_port_operations hpt3x3_port_ops = {
19301         .inherits       = &ata_bmdma_port_ops,
19302         .cable_detect   = ata_cable_40wire,
19303         .set_piomode    = hpt3x3_set_piomode,
19304 diff -urNp linux-2.6.33/drivers/ata/pata_icside.c linux-2.6.33/drivers/ata/pata_icside.c
19305 --- linux-2.6.33/drivers/ata/pata_icside.c      2010-02-24 13:52:17.000000000 -0500
19306 +++ linux-2.6.33/drivers/ata/pata_icside.c      2010-03-07 12:23:35.973706141 -0500
19307 @@ -319,7 +319,7 @@ static void pata_icside_postreset(struct
19308         }
19309  }
19310
19311 -static struct ata_port_operations pata_icside_port_ops = {
19312 +static const struct ata_port_operations pata_icside_port_ops = {
19313         .inherits               = &ata_sff_port_ops,
19314         /* no need to build any PRD tables for DMA */
19315         .qc_prep                = ata_noop_qc_prep,
19316 diff -urNp linux-2.6.33/drivers/ata/pata_isapnp.c linux-2.6.33/drivers/ata/pata_isapnp.c
19317 --- linux-2.6.33/drivers/ata/pata_isapnp.c      2010-02-24 13:52:17.000000000 -0500
19318 +++ linux-2.6.33/drivers/ata/pata_isapnp.c      2010-03-07 12:23:35.973706141 -0500
19319 @@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
19320         ATA_PIO_SHT(DRV_NAME),
19321  };
19322
19323 -static struct ata_port_operations isapnp_port_ops = {
19324 +static const struct ata_port_operations isapnp_port_ops = {
19325         .inherits       = &ata_sff_port_ops,
19326         .cable_detect   = ata_cable_40wire,
19327  };
19328
19329 -static struct ata_port_operations isapnp_noalt_port_ops = {
19330 +static const struct ata_port_operations isapnp_noalt_port_ops = {
19331         .inherits       = &ata_sff_port_ops,
19332         .cable_detect   = ata_cable_40wire,
19333         /* No altstatus so we don't want to use the lost interrupt poll */
19334 diff -urNp linux-2.6.33/drivers/ata/pata_it8213.c linux-2.6.33/drivers/ata/pata_it8213.c
19335 --- linux-2.6.33/drivers/ata/pata_it8213.c      2010-02-24 13:52:17.000000000 -0500
19336 +++ linux-2.6.33/drivers/ata/pata_it8213.c      2010-03-07 12:23:35.973706141 -0500
19337 @@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
19338  };
19339
19340
19341 -static struct ata_port_operations it8213_ops = {
19342 +static const struct ata_port_operations it8213_ops = {
19343         .inherits               = &ata_bmdma_port_ops,
19344         .cable_detect           = it8213_cable_detect,
19345         .set_piomode            = it8213_set_piomode,
19346 diff -urNp linux-2.6.33/drivers/ata/pata_it821x.c linux-2.6.33/drivers/ata/pata_it821x.c
19347 --- linux-2.6.33/drivers/ata/pata_it821x.c      2010-02-24 13:52:17.000000000 -0500
19348 +++ linux-2.6.33/drivers/ata/pata_it821x.c      2010-03-07 12:23:35.973706141 -0500
19349 @@ -800,7 +800,7 @@ static struct scsi_host_template it821x_
19350         ATA_BMDMA_SHT(DRV_NAME),
19351  };
19352
19353 -static struct ata_port_operations it821x_smart_port_ops = {
19354 +static const struct ata_port_operations it821x_smart_port_ops = {
19355         .inherits       = &ata_bmdma_port_ops,
19356
19357         .check_atapi_dma= it821x_check_atapi_dma,
19358 @@ -814,7 +814,7 @@ static struct ata_port_operations it821x
19359         .port_start     = it821x_port_start,
19360  };
19361
19362 -static struct ata_port_operations it821x_passthru_port_ops = {
19363 +static const struct ata_port_operations it821x_passthru_port_ops = {
19364         .inherits       = &ata_bmdma_port_ops,
19365
19366         .check_atapi_dma= it821x_check_atapi_dma,
19367 @@ -830,7 +830,7 @@ static struct ata_port_operations it821x
19368         .port_start     = it821x_port_start,
19369  };
19370
19371 -static struct ata_port_operations it821x_rdc_port_ops = {
19372 +static const struct ata_port_operations it821x_rdc_port_ops = {
19373         .inherits       = &ata_bmdma_port_ops,
19374
19375         .check_atapi_dma= it821x_check_atapi_dma,
19376 diff -urNp linux-2.6.33/drivers/ata/pata_ixp4xx_cf.c linux-2.6.33/drivers/ata/pata_ixp4xx_cf.c
19377 --- linux-2.6.33/drivers/ata/pata_ixp4xx_cf.c   2010-02-24 13:52:17.000000000 -0500
19378 +++ linux-2.6.33/drivers/ata/pata_ixp4xx_cf.c   2010-03-07 12:23:35.973706141 -0500
19379 @@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
19380         ATA_PIO_SHT(DRV_NAME),
19381  };
19382
19383 -static struct ata_port_operations ixp4xx_port_ops = {
19384 +static const struct ata_port_operations ixp4xx_port_ops = {
19385         .inherits               = &ata_sff_port_ops,
19386         .sff_data_xfer          = ixp4xx_mmio_data_xfer,
19387         .cable_detect           = ata_cable_40wire,
19388 diff -urNp linux-2.6.33/drivers/ata/pata_jmicron.c linux-2.6.33/drivers/ata/pata_jmicron.c
19389 --- linux-2.6.33/drivers/ata/pata_jmicron.c     2010-02-24 13:52:17.000000000 -0500
19390 +++ linux-2.6.33/drivers/ata/pata_jmicron.c     2010-03-07 12:23:35.973706141 -0500
19391 @@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
19392         ATA_BMDMA_SHT(DRV_NAME),
19393  };
19394
19395 -static struct ata_port_operations jmicron_ops = {
19396 +static const struct ata_port_operations jmicron_ops = {
19397         .inherits               = &ata_bmdma_port_ops,
19398         .prereset               = jmicron_pre_reset,
19399  };
19400 diff -urNp linux-2.6.33/drivers/ata/pata_legacy.c linux-2.6.33/drivers/ata/pata_legacy.c
19401 --- linux-2.6.33/drivers/ata/pata_legacy.c      2010-02-24 13:52:17.000000000 -0500
19402 +++ linux-2.6.33/drivers/ata/pata_legacy.c      2010-03-07 12:23:35.973706141 -0500
19403 @@ -113,7 +113,7 @@ struct legacy_probe {
19404
19405  struct legacy_controller {
19406         const char *name;
19407 -       struct ata_port_operations *ops;
19408 +       const struct ata_port_operations *ops;
19409         unsigned int pio_mask;
19410         unsigned int flags;
19411         unsigned int pflags;
19412 @@ -230,12 +230,12 @@ static const struct ata_port_operations
19413   *     pio_mask as well.
19414   */
19415
19416 -static struct ata_port_operations simple_port_ops = {
19417 +static const struct ata_port_operations simple_port_ops = {
19418         .inherits       = &legacy_base_port_ops,
19419         .sff_data_xfer  = ata_sff_data_xfer_noirq,
19420  };
19421
19422 -static struct ata_port_operations legacy_port_ops = {
19423 +static const struct ata_port_operations legacy_port_ops = {
19424         .inherits       = &legacy_base_port_ops,
19425         .sff_data_xfer  = ata_sff_data_xfer_noirq,
19426         .set_mode       = legacy_set_mode,
19427 @@ -331,7 +331,7 @@ static unsigned int pdc_data_xfer_vlb(st
19428         return buflen;
19429  }
19430
19431 -static struct ata_port_operations pdc20230_port_ops = {
19432 +static const struct ata_port_operations pdc20230_port_ops = {
19433         .inherits       = &legacy_base_port_ops,
19434         .set_piomode    = pdc20230_set_piomode,
19435         .sff_data_xfer  = pdc_data_xfer_vlb,
19436 @@ -364,7 +364,7 @@ static void ht6560a_set_piomode(struct a
19437         ioread8(ap->ioaddr.status_addr);
19438  }
19439
19440 -static struct ata_port_operations ht6560a_port_ops = {
19441 +static const struct ata_port_operations ht6560a_port_ops = {
19442         .inherits       = &legacy_base_port_ops,
19443         .set_piomode    = ht6560a_set_piomode,
19444  };
19445 @@ -407,7 +407,7 @@ static void ht6560b_set_piomode(struct a
19446         ioread8(ap->ioaddr.status_addr);
19447  }
19448
19449 -static struct ata_port_operations ht6560b_port_ops = {
19450 +static const struct ata_port_operations ht6560b_port_ops = {
19451         .inherits       = &legacy_base_port_ops,
19452         .set_piomode    = ht6560b_set_piomode,
19453  };
19454 @@ -506,7 +506,7 @@ static void opti82c611a_set_piomode(stru
19455  }
19456
19457
19458 -static struct ata_port_operations opti82c611a_port_ops = {
19459 +static const struct ata_port_operations opti82c611a_port_ops = {
19460         .inherits       = &legacy_base_port_ops,
19461         .set_piomode    = opti82c611a_set_piomode,
19462  };
19463 @@ -616,7 +616,7 @@ static unsigned int opti82c46x_qc_issue(
19464         return ata_sff_qc_issue(qc);
19465  }
19466
19467 -static struct ata_port_operations opti82c46x_port_ops = {
19468 +static const struct ata_port_operations opti82c46x_port_ops = {
19469         .inherits       = &legacy_base_port_ops,
19470         .set_piomode    = opti82c46x_set_piomode,
19471         .qc_issue       = opti82c46x_qc_issue,
19472 @@ -778,20 +778,20 @@ static int qdi_port(struct platform_devi
19473         return 0;
19474  }
19475
19476 -static struct ata_port_operations qdi6500_port_ops = {
19477 +static const struct ata_port_operations qdi6500_port_ops = {
19478         .inherits       = &legacy_base_port_ops,
19479         .set_piomode    = qdi6500_set_piomode,
19480         .qc_issue       = qdi_qc_issue,
19481         .sff_data_xfer  = vlb32_data_xfer,
19482  };
19483
19484 -static struct ata_port_operations qdi6580_port_ops = {
19485 +static const struct ata_port_operations qdi6580_port_ops = {
19486         .inherits       = &legacy_base_port_ops,
19487         .set_piomode    = qdi6580_set_piomode,
19488         .sff_data_xfer  = vlb32_data_xfer,
19489  };
19490
19491 -static struct ata_port_operations qdi6580dp_port_ops = {
19492 +static const struct ata_port_operations qdi6580dp_port_ops = {
19493         .inherits       = &legacy_base_port_ops,
19494         .set_piomode    = qdi6580dp_set_piomode,
19495         .qc_issue       = qdi_qc_issue,
19496 @@ -863,7 +863,7 @@ static int winbond_port(struct platform_
19497         return 0;
19498  }
19499
19500 -static struct ata_port_operations winbond_port_ops = {
19501 +static const struct ata_port_operations winbond_port_ops = {
19502         .inherits       = &legacy_base_port_ops,
19503         .set_piomode    = winbond_set_piomode,
19504         .sff_data_xfer  = vlb32_data_xfer,
19505 @@ -986,7 +986,7 @@ static __init int legacy_init_one(struct
19506         int pio_modes = controller->pio_mask;
19507         unsigned long io = probe->port;
19508         u32 mask = (1 << probe->slot);
19509 -       struct ata_port_operations *ops = controller->ops;
19510 +       const struct ata_port_operations *ops = controller->ops;
19511         struct legacy_data *ld = &legacy_data[probe->slot];
19512         struct ata_host *host = NULL;
19513         struct ata_port *ap;
19514 diff -urNp linux-2.6.33/drivers/ata/pata_macio.c linux-2.6.33/drivers/ata/pata_macio.c
19515 --- linux-2.6.33/drivers/ata/pata_macio.c       2010-02-24 13:52:17.000000000 -0500
19516 +++ linux-2.6.33/drivers/ata/pata_macio.c       2010-03-07 12:23:35.977706017 -0500
19517 @@ -915,7 +915,7 @@ static struct scsi_host_template pata_ma
19518         .slave_configure        = pata_macio_slave_config,
19519  };
19520
19521 -static struct ata_port_operations pata_macio_ops = {
19522 +static const struct ata_port_operations pata_macio_ops = {
19523         .inherits               = &ata_sff_port_ops,
19524
19525         .freeze                 = pata_macio_freeze,
19526 diff -urNp linux-2.6.33/drivers/ata/pata_marvell.c linux-2.6.33/drivers/ata/pata_marvell.c
19527 --- linux-2.6.33/drivers/ata/pata_marvell.c     2010-02-24 13:52:17.000000000 -0500
19528 +++ linux-2.6.33/drivers/ata/pata_marvell.c     2010-03-07 12:23:35.977706017 -0500
19529 @@ -100,7 +100,7 @@ static struct scsi_host_template marvell
19530         ATA_BMDMA_SHT(DRV_NAME),
19531  };
19532
19533 -static struct ata_port_operations marvell_ops = {
19534 +static const struct ata_port_operations marvell_ops = {
19535         .inherits               = &ata_bmdma_port_ops,
19536         .cable_detect           = marvell_cable_detect,
19537         .prereset               = marvell_pre_reset,
19538 diff -urNp linux-2.6.33/drivers/ata/pata_mpc52xx.c linux-2.6.33/drivers/ata/pata_mpc52xx.c
19539 --- linux-2.6.33/drivers/ata/pata_mpc52xx.c     2010-02-24 13:52:17.000000000 -0500
19540 +++ linux-2.6.33/drivers/ata/pata_mpc52xx.c     2010-03-07 12:23:35.977706017 -0500
19541 @@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
19542         ATA_PIO_SHT(DRV_NAME),
19543  };
19544
19545 -static struct ata_port_operations mpc52xx_ata_port_ops = {
19546 +static const struct ata_port_operations mpc52xx_ata_port_ops = {
19547         .inherits               = &ata_sff_port_ops,
19548         .sff_dev_select         = mpc52xx_ata_dev_select,
19549         .set_piomode            = mpc52xx_ata_set_piomode,
19550 diff -urNp linux-2.6.33/drivers/ata/pata_mpiix.c linux-2.6.33/drivers/ata/pata_mpiix.c
19551 --- linux-2.6.33/drivers/ata/pata_mpiix.c       2010-02-24 13:52:17.000000000 -0500
19552 +++ linux-2.6.33/drivers/ata/pata_mpiix.c       2010-03-07 12:23:35.977706017 -0500
19553 @@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
19554         ATA_PIO_SHT(DRV_NAME),
19555  };
19556
19557 -static struct ata_port_operations mpiix_port_ops = {
19558 +static const struct ata_port_operations mpiix_port_ops = {
19559         .inherits       = &ata_sff_port_ops,
19560         .qc_issue       = mpiix_qc_issue,
19561         .cable_detect   = ata_cable_40wire,
19562 diff -urNp linux-2.6.33/drivers/ata/pata_netcell.c linux-2.6.33/drivers/ata/pata_netcell.c
19563 --- linux-2.6.33/drivers/ata/pata_netcell.c     2010-02-24 13:52:17.000000000 -0500
19564 +++ linux-2.6.33/drivers/ata/pata_netcell.c     2010-03-07 12:23:35.977706017 -0500
19565 @@ -34,7 +34,7 @@ static struct scsi_host_template netcell
19566         ATA_BMDMA_SHT(DRV_NAME),
19567  };
19568
19569 -static struct ata_port_operations netcell_ops = {
19570 +static const struct ata_port_operations netcell_ops = {
19571         .inherits       = &ata_bmdma_port_ops,
19572         .cable_detect   = ata_cable_80wire,
19573         .read_id        = netcell_read_id,
19574 diff -urNp linux-2.6.33/drivers/ata/pata_ninja32.c linux-2.6.33/drivers/ata/pata_ninja32.c
19575 --- linux-2.6.33/drivers/ata/pata_ninja32.c     2010-02-24 13:52:17.000000000 -0500
19576 +++ linux-2.6.33/drivers/ata/pata_ninja32.c     2010-03-07 12:23:35.977706017 -0500
19577 @@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
19578         ATA_BMDMA_SHT(DRV_NAME),
19579  };
19580
19581 -static struct ata_port_operations ninja32_port_ops = {
19582 +static const struct ata_port_operations ninja32_port_ops = {
19583         .inherits       = &ata_bmdma_port_ops,
19584         .sff_dev_select = ninja32_dev_select,
19585         .cable_detect   = ata_cable_40wire,
19586 diff -urNp linux-2.6.33/drivers/ata/pata_ns87410.c linux-2.6.33/drivers/ata/pata_ns87410.c
19587 --- linux-2.6.33/drivers/ata/pata_ns87410.c     2010-02-24 13:52:17.000000000 -0500
19588 +++ linux-2.6.33/drivers/ata/pata_ns87410.c     2010-03-07 12:23:35.977706017 -0500
19589 @@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
19590         ATA_PIO_SHT(DRV_NAME),
19591  };
19592
19593 -static struct ata_port_operations ns87410_port_ops = {
19594 +static const struct ata_port_operations ns87410_port_ops = {
19595         .inherits       = &ata_sff_port_ops,
19596         .qc_issue       = ns87410_qc_issue,
19597         .cable_detect   = ata_cable_40wire,
19598 diff -urNp linux-2.6.33/drivers/ata/pata_ns87415.c linux-2.6.33/drivers/ata/pata_ns87415.c
19599 --- linux-2.6.33/drivers/ata/pata_ns87415.c     2010-02-24 13:52:17.000000000 -0500
19600 +++ linux-2.6.33/drivers/ata/pata_ns87415.c     2010-03-07 12:23:35.977706017 -0500
19601 @@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
19602  }
19603  #endif         /* 87560 SuperIO Support */
19604
19605 -static struct ata_port_operations ns87415_pata_ops = {
19606 +static const struct ata_port_operations ns87415_pata_ops = {
19607         .inherits               = &ata_bmdma_port_ops,
19608
19609         .check_atapi_dma        = ns87415_check_atapi_dma,
19610 @@ -313,7 +313,7 @@ static struct ata_port_operations ns8741
19611  };
19612
19613  #if defined(CONFIG_SUPERIO)
19614 -static struct ata_port_operations ns87560_pata_ops = {
19615 +static const struct ata_port_operations ns87560_pata_ops = {
19616         .inherits               = &ns87415_pata_ops,
19617         .sff_tf_read            = ns87560_tf_read,
19618         .sff_check_status       = ns87560_check_status,
19619 diff -urNp linux-2.6.33/drivers/ata/pata_octeon_cf.c linux-2.6.33/drivers/ata/pata_octeon_cf.c
19620 --- linux-2.6.33/drivers/ata/pata_octeon_cf.c   2010-02-24 13:52:17.000000000 -0500
19621 +++ linux-2.6.33/drivers/ata/pata_octeon_cf.c   2010-03-07 12:23:35.977706017 -0500
19622 @@ -801,6 +801,7 @@ static unsigned int octeon_cf_qc_issue(s
19623         return 0;
19624  }
19625
19626 +/* cannot be const */
19627  static struct ata_port_operations octeon_cf_ops = {
19628         .inherits               = &ata_sff_port_ops,
19629         .check_atapi_dma        = octeon_cf_check_atapi_dma,
19630 diff -urNp linux-2.6.33/drivers/ata/pata_oldpiix.c linux-2.6.33/drivers/ata/pata_oldpiix.c
19631 --- linux-2.6.33/drivers/ata/pata_oldpiix.c     2010-02-24 13:52:17.000000000 -0500
19632 +++ linux-2.6.33/drivers/ata/pata_oldpiix.c     2010-03-07 12:23:35.977706017 -0500
19633 @@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
19634         ATA_BMDMA_SHT(DRV_NAME),
19635  };
19636
19637 -static struct ata_port_operations oldpiix_pata_ops = {
19638 +static const struct ata_port_operations oldpiix_pata_ops = {
19639         .inherits               = &ata_bmdma_port_ops,
19640         .qc_issue               = oldpiix_qc_issue,
19641         .cable_detect           = ata_cable_40wire,
19642 diff -urNp linux-2.6.33/drivers/ata/pata_opti.c linux-2.6.33/drivers/ata/pata_opti.c
19643 --- linux-2.6.33/drivers/ata/pata_opti.c        2010-02-24 13:52:17.000000000 -0500
19644 +++ linux-2.6.33/drivers/ata/pata_opti.c        2010-03-07 12:23:35.977706017 -0500
19645 @@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
19646         ATA_PIO_SHT(DRV_NAME),
19647  };
19648
19649 -static struct ata_port_operations opti_port_ops = {
19650 +static const struct ata_port_operations opti_port_ops = {
19651         .inherits       = &ata_sff_port_ops,
19652         .cable_detect   = ata_cable_40wire,
19653         .set_piomode    = opti_set_piomode,
19654 diff -urNp linux-2.6.33/drivers/ata/pata_optidma.c linux-2.6.33/drivers/ata/pata_optidma.c
19655 --- linux-2.6.33/drivers/ata/pata_optidma.c     2010-02-24 13:52:17.000000000 -0500
19656 +++ linux-2.6.33/drivers/ata/pata_optidma.c     2010-03-07 12:23:35.977706017 -0500
19657 @@ -337,7 +337,7 @@ static struct scsi_host_template optidma
19658         ATA_BMDMA_SHT(DRV_NAME),
19659  };
19660
19661 -static struct ata_port_operations optidma_port_ops = {
19662 +static const struct ata_port_operations optidma_port_ops = {
19663         .inherits       = &ata_bmdma_port_ops,
19664         .cable_detect   = ata_cable_40wire,
19665         .set_piomode    = optidma_set_pio_mode,
19666 @@ -346,7 +346,7 @@ static struct ata_port_operations optidm
19667         .prereset       = optidma_pre_reset,
19668  };
19669
19670 -static struct ata_port_operations optiplus_port_ops = {
19671 +static const struct ata_port_operations optiplus_port_ops = {
19672         .inherits       = &optidma_port_ops,
19673         .set_piomode    = optiplus_set_pio_mode,
19674         .set_dmamode    = optiplus_set_dma_mode,
19675 diff -urNp linux-2.6.33/drivers/ata/pata_palmld.c linux-2.6.33/drivers/ata/pata_palmld.c
19676 --- linux-2.6.33/drivers/ata/pata_palmld.c      2010-02-24 13:52:17.000000000 -0500
19677 +++ linux-2.6.33/drivers/ata/pata_palmld.c      2010-03-07 12:23:35.977706017 -0500
19678 @@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
19679         ATA_PIO_SHT(DRV_NAME),
19680  };
19681
19682 -static struct ata_port_operations palmld_port_ops = {
19683 +static const struct ata_port_operations palmld_port_ops = {
19684         .inherits               = &ata_sff_port_ops,
19685         .sff_data_xfer          = ata_sff_data_xfer_noirq,
19686         .cable_detect           = ata_cable_40wire,
19687 diff -urNp linux-2.6.33/drivers/ata/pata_pcmcia.c linux-2.6.33/drivers/ata/pata_pcmcia.c
19688 --- linux-2.6.33/drivers/ata/pata_pcmcia.c      2010-02-24 13:52:17.000000000 -0500
19689 +++ linux-2.6.33/drivers/ata/pata_pcmcia.c      2010-03-07 12:23:35.977706017 -0500
19690 @@ -162,14 +162,14 @@ static struct scsi_host_template pcmcia_
19691         ATA_PIO_SHT(DRV_NAME),
19692  };
19693
19694 -static struct ata_port_operations pcmcia_port_ops = {
19695 +static const struct ata_port_operations pcmcia_port_ops = {
19696         .inherits       = &ata_sff_port_ops,
19697         .sff_data_xfer  = ata_sff_data_xfer_noirq,
19698         .cable_detect   = ata_cable_40wire,
19699         .set_mode       = pcmcia_set_mode,
19700  };
19701
19702 -static struct ata_port_operations pcmcia_8bit_port_ops = {
19703 +static const struct ata_port_operations pcmcia_8bit_port_ops = {
19704         .inherits       = &ata_sff_port_ops,
19705         .sff_data_xfer  = ata_data_xfer_8bit,
19706         .cable_detect   = ata_cable_40wire,
19707 @@ -253,7 +253,7 @@ static int pcmcia_init_one(struct pcmcia
19708         unsigned long io_base, ctl_base;
19709         void __iomem *io_addr, *ctl_addr;
19710         int n_ports = 1;
19711 -       struct ata_port_operations *ops = &pcmcia_port_ops;
19712 +       const struct ata_port_operations *ops = &pcmcia_port_ops;
19713
19714         info = kzalloc(sizeof(*info), GFP_KERNEL);
19715         if (info == NULL)
19716 diff -urNp linux-2.6.33/drivers/ata/pata_pdc2027x.c linux-2.6.33/drivers/ata/pata_pdc2027x.c
19717 --- linux-2.6.33/drivers/ata/pata_pdc2027x.c    2010-02-24 13:52:17.000000000 -0500
19718 +++ linux-2.6.33/drivers/ata/pata_pdc2027x.c    2010-03-07 12:23:35.977706017 -0500
19719 @@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
19720         ATA_BMDMA_SHT(DRV_NAME),
19721  };
19722
19723 -static struct ata_port_operations pdc2027x_pata100_ops = {
19724 +static const struct ata_port_operations pdc2027x_pata100_ops = {
19725         .inherits               = &ata_bmdma_port_ops,
19726         .check_atapi_dma        = pdc2027x_check_atapi_dma,
19727         .cable_detect           = pdc2027x_cable_detect,
19728         .prereset               = pdc2027x_prereset,
19729  };
19730
19731 -static struct ata_port_operations pdc2027x_pata133_ops = {
19732 +static const struct ata_port_operations pdc2027x_pata133_ops = {
19733         .inherits               = &pdc2027x_pata100_ops,
19734         .mode_filter            = pdc2027x_mode_filter,
19735         .set_piomode            = pdc2027x_set_piomode,
19736 diff -urNp linux-2.6.33/drivers/ata/pata_pdc202xx_old.c linux-2.6.33/drivers/ata/pata_pdc202xx_old.c
19737 --- linux-2.6.33/drivers/ata/pata_pdc202xx_old.c        2010-02-24 13:52:17.000000000 -0500
19738 +++ linux-2.6.33/drivers/ata/pata_pdc202xx_old.c        2010-03-07 12:23:35.977706017 -0500
19739 @@ -265,7 +265,7 @@ static struct scsi_host_template pdc202x
19740         ATA_BMDMA_SHT(DRV_NAME),
19741  };
19742
19743 -static struct ata_port_operations pdc2024x_port_ops = {
19744 +static const struct ata_port_operations pdc2024x_port_ops = {
19745         .inherits               = &ata_bmdma_port_ops,
19746
19747         .cable_detect           = ata_cable_40wire,
19748 @@ -273,7 +273,7 @@ static struct ata_port_operations pdc202
19749         .set_dmamode            = pdc202xx_set_dmamode,
19750  };
19751
19752 -static struct ata_port_operations pdc2026x_port_ops = {
19753 +static const struct ata_port_operations pdc2026x_port_ops = {
19754         .inherits               = &pdc2024x_port_ops,
19755
19756         .check_atapi_dma        = pdc2026x_check_atapi_dma,
19757 diff -urNp linux-2.6.33/drivers/ata/pata_piccolo.c linux-2.6.33/drivers/ata/pata_piccolo.c
19758 --- linux-2.6.33/drivers/ata/pata_piccolo.c     2010-02-24 13:52:17.000000000 -0500
19759 +++ linux-2.6.33/drivers/ata/pata_piccolo.c     2010-03-07 12:23:35.977706017 -0500
19760 @@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
19761         ATA_BMDMA_SHT(DRV_NAME),
19762  };
19763
19764 -static struct ata_port_operations tosh_port_ops = {
19765 +static const struct ata_port_operations tosh_port_ops = {
19766         .inherits       = &ata_bmdma_port_ops,
19767         .cable_detect   = ata_cable_unknown,
19768         .set_piomode    = tosh_set_piomode,
19769 diff -urNp linux-2.6.33/drivers/ata/pata_platform.c linux-2.6.33/drivers/ata/pata_platform.c
19770 --- linux-2.6.33/drivers/ata/pata_platform.c    2010-02-24 13:52:17.000000000 -0500
19771 +++ linux-2.6.33/drivers/ata/pata_platform.c    2010-03-07 12:23:35.977706017 -0500
19772 @@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
19773         ATA_PIO_SHT(DRV_NAME),
19774  };
19775
19776 -static struct ata_port_operations pata_platform_port_ops = {
19777 +static const struct ata_port_operations pata_platform_port_ops = {
19778         .inherits               = &ata_sff_port_ops,
19779         .sff_data_xfer          = ata_sff_data_xfer_noirq,
19780         .cable_detect           = ata_cable_unknown,
19781 diff -urNp linux-2.6.33/drivers/ata/pata_qdi.c linux-2.6.33/drivers/ata/pata_qdi.c
19782 --- linux-2.6.33/drivers/ata/pata_qdi.c 2010-02-24 13:52:17.000000000 -0500
19783 +++ linux-2.6.33/drivers/ata/pata_qdi.c 2010-03-07 12:23:35.977706017 -0500
19784 @@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
19785         ATA_PIO_SHT(DRV_NAME),
19786  };
19787
19788 -static struct ata_port_operations qdi6500_port_ops = {
19789 +static const struct ata_port_operations qdi6500_port_ops = {
19790         .inherits       = &ata_sff_port_ops,
19791         .qc_issue       = qdi_qc_issue,
19792         .sff_data_xfer  = qdi_data_xfer,
19793 @@ -165,7 +165,7 @@ static struct ata_port_operations qdi650
19794         .set_piomode    = qdi6500_set_piomode,
19795  };
19796
19797 -static struct ata_port_operations qdi6580_port_ops = {
19798 +static const struct ata_port_operations qdi6580_port_ops = {
19799         .inherits       = &qdi6500_port_ops,
19800         .set_piomode    = qdi6580_set_piomode,
19801  };
19802 diff -urNp linux-2.6.33/drivers/ata/pata_radisys.c linux-2.6.33/drivers/ata/pata_radisys.c
19803 --- linux-2.6.33/drivers/ata/pata_radisys.c     2010-02-24 13:52:17.000000000 -0500
19804 +++ linux-2.6.33/drivers/ata/pata_radisys.c     2010-03-07 12:23:35.977706017 -0500
19805 @@ -187,7 +187,7 @@ static struct scsi_host_template radisys
19806         ATA_BMDMA_SHT(DRV_NAME),
19807  };
19808
19809 -static struct ata_port_operations radisys_pata_ops = {
19810 +static const struct ata_port_operations radisys_pata_ops = {
19811         .inherits               = &ata_bmdma_port_ops,
19812         .qc_issue               = radisys_qc_issue,
19813         .cable_detect           = ata_cable_unknown,
19814 diff -urNp linux-2.6.33/drivers/ata/pata_rb532_cf.c linux-2.6.33/drivers/ata/pata_rb532_cf.c
19815 --- linux-2.6.33/drivers/ata/pata_rb532_cf.c    2010-02-24 13:52:17.000000000 -0500
19816 +++ linux-2.6.33/drivers/ata/pata_rb532_cf.c    2010-03-07 12:23:35.977706017 -0500
19817 @@ -68,7 +68,7 @@ static irqreturn_t rb532_pata_irq_handle
19818         return IRQ_HANDLED;
19819  }
19820
19821 -static struct ata_port_operations rb532_pata_port_ops = {
19822 +static const struct ata_port_operations rb532_pata_port_ops = {
19823         .inherits               = &ata_sff_port_ops,
19824         .sff_data_xfer          = ata_sff_data_xfer32,
19825  };
19826 diff -urNp linux-2.6.33/drivers/ata/pata_rdc.c linux-2.6.33/drivers/ata/pata_rdc.c
19827 --- linux-2.6.33/drivers/ata/pata_rdc.c 2010-02-24 13:52:17.000000000 -0500
19828 +++ linux-2.6.33/drivers/ata/pata_rdc.c 2010-03-07 12:23:35.977706017 -0500
19829 @@ -272,7 +272,7 @@ static void rdc_set_dmamode(struct ata_p
19830         pci_write_config_byte(dev, 0x48, udma_enable);
19831  }
19832
19833 -static struct ata_port_operations rdc_pata_ops = {
19834 +static const struct ata_port_operations rdc_pata_ops = {
19835         .inherits               = &ata_bmdma32_port_ops,
19836         .cable_detect           = rdc_pata_cable_detect,
19837         .set_piomode            = rdc_set_piomode,
19838 diff -urNp linux-2.6.33/drivers/ata/pata_rz1000.c linux-2.6.33/drivers/ata/pata_rz1000.c
19839 --- linux-2.6.33/drivers/ata/pata_rz1000.c      2010-02-24 13:52:17.000000000 -0500
19840 +++ linux-2.6.33/drivers/ata/pata_rz1000.c      2010-03-07 12:23:35.977706017 -0500
19841 @@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
19842         ATA_PIO_SHT(DRV_NAME),
19843  };
19844
19845 -static struct ata_port_operations rz1000_port_ops = {
19846 +static const struct ata_port_operations rz1000_port_ops = {
19847         .inherits       = &ata_sff_port_ops,
19848         .cable_detect   = ata_cable_40wire,
19849         .set_mode       = rz1000_set_mode,
19850 diff -urNp linux-2.6.33/drivers/ata/pata_sc1200.c linux-2.6.33/drivers/ata/pata_sc1200.c
19851 --- linux-2.6.33/drivers/ata/pata_sc1200.c      2010-02-24 13:52:17.000000000 -0500
19852 +++ linux-2.6.33/drivers/ata/pata_sc1200.c      2010-03-07 12:23:35.977706017 -0500
19853 @@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
19854         .sg_tablesize   = LIBATA_DUMB_MAX_PRD,
19855  };
19856
19857 -static struct ata_port_operations sc1200_port_ops = {
19858 +static const struct ata_port_operations sc1200_port_ops = {
19859         .inherits       = &ata_bmdma_port_ops,
19860         .qc_prep        = ata_sff_dumb_qc_prep,
19861         .qc_issue       = sc1200_qc_issue,
19862 diff -urNp linux-2.6.33/drivers/ata/pata_scc.c linux-2.6.33/drivers/ata/pata_scc.c
19863 --- linux-2.6.33/drivers/ata/pata_scc.c 2010-02-24 13:52:17.000000000 -0500
19864 +++ linux-2.6.33/drivers/ata/pata_scc.c 2010-03-07 12:23:35.981708557 -0500
19865 @@ -965,7 +965,7 @@ static struct scsi_host_template scc_sht
19866         ATA_BMDMA_SHT(DRV_NAME),
19867  };
19868
19869 -static struct ata_port_operations scc_pata_ops = {
19870 +static const struct ata_port_operations scc_pata_ops = {
19871         .inherits               = &ata_bmdma_port_ops,
19872
19873         .set_piomode            = scc_set_piomode,
19874 diff -urNp linux-2.6.33/drivers/ata/pata_sch.c linux-2.6.33/drivers/ata/pata_sch.c
19875 --- linux-2.6.33/drivers/ata/pata_sch.c 2010-02-24 13:52:17.000000000 -0500
19876 +++ linux-2.6.33/drivers/ata/pata_sch.c 2010-03-07 12:23:35.981708557 -0500
19877 @@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
19878         ATA_BMDMA_SHT(DRV_NAME),
19879  };
19880
19881 -static struct ata_port_operations sch_pata_ops = {
19882 +static const struct ata_port_operations sch_pata_ops = {
19883         .inherits               = &ata_bmdma_port_ops,
19884         .cable_detect           = ata_cable_unknown,
19885         .set_piomode            = sch_set_piomode,
19886 diff -urNp linux-2.6.33/drivers/ata/pata_serverworks.c linux-2.6.33/drivers/ata/pata_serverworks.c
19887 --- linux-2.6.33/drivers/ata/pata_serverworks.c 2010-02-24 13:52:17.000000000 -0500
19888 +++ linux-2.6.33/drivers/ata/pata_serverworks.c 2010-03-07 12:23:35.981708557 -0500
19889 @@ -299,7 +299,7 @@ static struct scsi_host_template serverw
19890         ATA_BMDMA_SHT(DRV_NAME),
19891  };
19892
19893 -static struct ata_port_operations serverworks_osb4_port_ops = {
19894 +static const struct ata_port_operations serverworks_osb4_port_ops = {
19895         .inherits       = &ata_bmdma_port_ops,
19896         .cable_detect   = serverworks_cable_detect,
19897         .mode_filter    = serverworks_osb4_filter,
19898 @@ -307,7 +307,7 @@ static struct ata_port_operations server
19899         .set_dmamode    = serverworks_set_dmamode,
19900  };
19901
19902 -static struct ata_port_operations serverworks_csb_port_ops = {
19903 +static const struct ata_port_operations serverworks_csb_port_ops = {
19904         .inherits       = &serverworks_osb4_port_ops,
19905         .mode_filter    = serverworks_csb_filter,
19906  };
19907 diff -urNp linux-2.6.33/drivers/ata/pata_sil680.c linux-2.6.33/drivers/ata/pata_sil680.c
19908 --- linux-2.6.33/drivers/ata/pata_sil680.c      2010-02-24 13:52:17.000000000 -0500
19909 +++ linux-2.6.33/drivers/ata/pata_sil680.c      2010-03-07 12:23:35.981708557 -0500
19910 @@ -194,7 +194,7 @@ static struct scsi_host_template sil680_
19911         ATA_BMDMA_SHT(DRV_NAME),
19912  };
19913
19914 -static struct ata_port_operations sil680_port_ops = {
19915 +static const struct ata_port_operations sil680_port_ops = {
19916         .inherits       = &ata_bmdma32_port_ops,
19917         .cable_detect   = sil680_cable_detect,
19918         .set_piomode    = sil680_set_piomode,
19919 diff -urNp linux-2.6.33/drivers/ata/pata_sis.c linux-2.6.33/drivers/ata/pata_sis.c
19920 --- linux-2.6.33/drivers/ata/pata_sis.c 2010-02-24 13:52:17.000000000 -0500
19921 +++ linux-2.6.33/drivers/ata/pata_sis.c 2010-03-07 12:23:35.981708557 -0500
19922 @@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
19923         ATA_BMDMA_SHT(DRV_NAME),
19924  };
19925
19926 -static struct ata_port_operations sis_133_for_sata_ops = {
19927 +static const struct ata_port_operations sis_133_for_sata_ops = {
19928         .inherits               = &ata_bmdma_port_ops,
19929         .set_piomode            = sis_133_set_piomode,
19930         .set_dmamode            = sis_133_set_dmamode,
19931         .cable_detect           = sis_133_cable_detect,
19932  };
19933
19934 -static struct ata_port_operations sis_base_ops = {
19935 +static const struct ata_port_operations sis_base_ops = {
19936         .inherits               = &ata_bmdma_port_ops,
19937         .prereset               = sis_pre_reset,
19938  };
19939
19940 -static struct ata_port_operations sis_133_ops = {
19941 +static const struct ata_port_operations sis_133_ops = {
19942         .inherits               = &sis_base_ops,
19943         .set_piomode            = sis_133_set_piomode,
19944         .set_dmamode            = sis_133_set_dmamode,
19945         .cable_detect           = sis_133_cable_detect,
19946  };
19947
19948 -static struct ata_port_operations sis_133_early_ops = {
19949 +static const struct ata_port_operations sis_133_early_ops = {
19950         .inherits               = &sis_base_ops,
19951         .set_piomode            = sis_100_set_piomode,
19952         .set_dmamode            = sis_133_early_set_dmamode,
19953         .cable_detect           = sis_66_cable_detect,
19954  };
19955
19956 -static struct ata_port_operations sis_100_ops = {
19957 +static const struct ata_port_operations sis_100_ops = {
19958         .inherits               = &sis_base_ops,
19959         .set_piomode            = sis_100_set_piomode,
19960         .set_dmamode            = sis_100_set_dmamode,
19961         .cable_detect           = sis_66_cable_detect,
19962  };
19963
19964 -static struct ata_port_operations sis_66_ops = {
19965 +static const struct ata_port_operations sis_66_ops = {
19966         .inherits               = &sis_base_ops,
19967         .set_piomode            = sis_old_set_piomode,
19968         .set_dmamode            = sis_66_set_dmamode,
19969         .cable_detect           = sis_66_cable_detect,
19970  };
19971
19972 -static struct ata_port_operations sis_old_ops = {
19973 +static const struct ata_port_operations sis_old_ops = {
19974         .inherits               = &sis_base_ops,
19975         .set_piomode            = sis_old_set_piomode,
19976         .set_dmamode            = sis_old_set_dmamode,
19977 diff -urNp linux-2.6.33/drivers/ata/pata_sl82c105.c linux-2.6.33/drivers/ata/pata_sl82c105.c
19978 --- linux-2.6.33/drivers/ata/pata_sl82c105.c    2010-02-24 13:52:17.000000000 -0500
19979 +++ linux-2.6.33/drivers/ata/pata_sl82c105.c    2010-03-07 12:23:35.981708557 -0500
19980 @@ -231,7 +231,7 @@ static struct scsi_host_template sl82c10
19981         ATA_BMDMA_SHT(DRV_NAME),
19982  };
19983
19984 -static struct ata_port_operations sl82c105_port_ops = {
19985 +static const struct ata_port_operations sl82c105_port_ops = {
19986         .inherits       = &ata_bmdma_port_ops,
19987         .qc_defer       = sl82c105_qc_defer,
19988         .bmdma_start    = sl82c105_bmdma_start,
19989 diff -urNp linux-2.6.33/drivers/ata/pata_triflex.c linux-2.6.33/drivers/ata/pata_triflex.c
19990 --- linux-2.6.33/drivers/ata/pata_triflex.c     2010-02-24 13:52:17.000000000 -0500
19991 +++ linux-2.6.33/drivers/ata/pata_triflex.c     2010-03-07 12:23:35.981708557 -0500
19992 @@ -178,7 +178,7 @@ static struct scsi_host_template triflex
19993         ATA_BMDMA_SHT(DRV_NAME),
19994  };
19995
19996 -static struct ata_port_operations triflex_port_ops = {
19997 +static const struct ata_port_operations triflex_port_ops = {
19998         .inherits       = &ata_bmdma_port_ops,
19999         .bmdma_start    = triflex_bmdma_start,
20000         .bmdma_stop     = triflex_bmdma_stop,
20001 diff -urNp linux-2.6.33/drivers/ata/pata_via.c linux-2.6.33/drivers/ata/pata_via.c
20002 --- linux-2.6.33/drivers/ata/pata_via.c 2010-02-24 13:52:17.000000000 -0500
20003 +++ linux-2.6.33/drivers/ata/pata_via.c 2010-03-07 12:23:35.981708557 -0500
20004 @@ -452,7 +452,7 @@ static struct scsi_host_template via_sht
20005         ATA_BMDMA_SHT(DRV_NAME),
20006  };
20007
20008 -static struct ata_port_operations via_port_ops = {
20009 +static const struct ata_port_operations via_port_ops = {
20010         .inherits       = &ata_bmdma_port_ops,
20011         .cable_detect   = via_cable_detect,
20012         .set_piomode    = via_set_piomode,
20013 @@ -463,7 +463,7 @@ static struct ata_port_operations via_po
20014         .mode_filter    = via_mode_filter,
20015  };
20016
20017 -static struct ata_port_operations via_port_ops_noirq = {
20018 +static const struct ata_port_operations via_port_ops_noirq = {
20019         .inherits       = &via_port_ops,
20020         .sff_data_xfer  = ata_sff_data_xfer_noirq,
20021  };
20022 diff -urNp linux-2.6.33/drivers/ata/pata_winbond.c linux-2.6.33/drivers/ata/pata_winbond.c
20023 --- linux-2.6.33/drivers/ata/pata_winbond.c     2010-02-24 13:52:17.000000000 -0500
20024 +++ linux-2.6.33/drivers/ata/pata_winbond.c     2010-03-07 12:23:35.981708557 -0500
20025 @@ -125,7 +125,7 @@ static struct scsi_host_template winbond
20026         ATA_PIO_SHT(DRV_NAME),
20027  };
20028
20029 -static struct ata_port_operations winbond_port_ops = {
20030 +static const struct ata_port_operations winbond_port_ops = {
20031         .inherits       = &ata_sff_port_ops,
20032         .sff_data_xfer  = winbond_data_xfer,
20033         .cable_detect   = ata_cable_40wire,
20034 diff -urNp linux-2.6.33/drivers/ata/pdc_adma.c linux-2.6.33/drivers/ata/pdc_adma.c
20035 --- linux-2.6.33/drivers/ata/pdc_adma.c 2010-02-24 13:52:17.000000000 -0500
20036 +++ linux-2.6.33/drivers/ata/pdc_adma.c 2010-03-07 12:23:35.981708557 -0500
20037 @@ -145,7 +145,7 @@ static struct scsi_host_template adma_at
20038         .dma_boundary           = ADMA_DMA_BOUNDARY,
20039  };
20040
20041 -static struct ata_port_operations adma_ata_ops = {
20042 +static const struct ata_port_operations adma_ata_ops = {
20043         .inherits               = &ata_sff_port_ops,
20044
20045         .lost_interrupt         = ATA_OP_NULL,
20046 diff -urNp linux-2.6.33/drivers/ata/sata_fsl.c linux-2.6.33/drivers/ata/sata_fsl.c
20047 --- linux-2.6.33/drivers/ata/sata_fsl.c 2010-02-24 13:52:17.000000000 -0500
20048 +++ linux-2.6.33/drivers/ata/sata_fsl.c 2010-03-07 12:23:35.981708557 -0500
20049 @@ -1260,7 +1260,7 @@ static struct scsi_host_template sata_fs
20050         .dma_boundary = ATA_DMA_BOUNDARY,
20051  };
20052
20053 -static struct ata_port_operations sata_fsl_ops = {
20054 +static const struct ata_port_operations sata_fsl_ops = {
20055         .inherits               = &sata_pmp_port_ops,
20056
20057         .qc_defer = ata_std_qc_defer,
20058 diff -urNp linux-2.6.33/drivers/ata/sata_inic162x.c linux-2.6.33/drivers/ata/sata_inic162x.c
20059 --- linux-2.6.33/drivers/ata/sata_inic162x.c    2010-02-24 13:52:17.000000000 -0500
20060 +++ linux-2.6.33/drivers/ata/sata_inic162x.c    2010-03-07 12:23:35.981708557 -0500
20061 @@ -721,7 +721,7 @@ static int inic_port_start(struct ata_po
20062         return 0;
20063  }
20064
20065 -static struct ata_port_operations inic_port_ops = {
20066 +static const struct ata_port_operations inic_port_ops = {
20067         .inherits               = &sata_port_ops,
20068
20069         .check_atapi_dma        = inic_check_atapi_dma,
20070 diff -urNp linux-2.6.33/drivers/ata/sata_mv.c linux-2.6.33/drivers/ata/sata_mv.c
20071 --- linux-2.6.33/drivers/ata/sata_mv.c  2010-02-24 13:52:17.000000000 -0500
20072 +++ linux-2.6.33/drivers/ata/sata_mv.c  2010-03-07 12:23:35.981708557 -0500
20073 @@ -662,7 +662,7 @@ static struct scsi_host_template mv6_sht
20074         .dma_boundary           = MV_DMA_BOUNDARY,
20075  };
20076
20077 -static struct ata_port_operations mv5_ops = {
20078 +static const struct ata_port_operations mv5_ops = {
20079         .inherits               = &ata_sff_port_ops,
20080
20081         .lost_interrupt         = ATA_OP_NULL,
20082 @@ -684,7 +684,7 @@ static struct ata_port_operations mv5_op
20083         .port_stop              = mv_port_stop,
20084  };
20085
20086 -static struct ata_port_operations mv6_ops = {
20087 +static const struct ata_port_operations mv6_ops = {
20088         .inherits               = &mv5_ops,
20089         .dev_config             = mv6_dev_config,
20090         .scr_read               = mv_scr_read,
20091 @@ -704,7 +704,7 @@ static struct ata_port_operations mv6_op
20092         .bmdma_status           = mv_bmdma_status,
20093  };
20094
20095 -static struct ata_port_operations mv_iie_ops = {
20096 +static const struct ata_port_operations mv_iie_ops = {
20097         .inherits               = &mv6_ops,
20098         .dev_config             = ATA_OP_NULL,
20099         .qc_prep                = mv_qc_prep_iie,
20100 diff -urNp linux-2.6.33/drivers/ata/sata_nv.c linux-2.6.33/drivers/ata/sata_nv.c
20101 --- linux-2.6.33/drivers/ata/sata_nv.c  2010-02-24 13:52:17.000000000 -0500
20102 +++ linux-2.6.33/drivers/ata/sata_nv.c  2010-03-07 12:23:35.981708557 -0500
20103 @@ -464,7 +464,7 @@ static struct scsi_host_template nv_swnc
20104   * cases.  Define nv_hardreset() which only kicks in for post-boot
20105   * probing and use it for all variants.
20106   */
20107 -static struct ata_port_operations nv_generic_ops = {
20108 +static const struct ata_port_operations nv_generic_ops = {
20109         .inherits               = &ata_bmdma_port_ops,
20110         .lost_interrupt         = ATA_OP_NULL,
20111         .scr_read               = nv_scr_read,
20112 @@ -472,20 +472,20 @@ static struct ata_port_operations nv_gen
20113         .hardreset              = nv_hardreset,
20114  };
20115
20116 -static struct ata_port_operations nv_nf2_ops = {
20117 +static const struct ata_port_operations nv_nf2_ops = {
20118         .inherits               = &nv_generic_ops,
20119         .freeze                 = nv_nf2_freeze,
20120         .thaw                   = nv_nf2_thaw,
20121  };
20122
20123 -static struct ata_port_operations nv_ck804_ops = {
20124 +static const struct ata_port_operations nv_ck804_ops = {
20125         .inherits               = &nv_generic_ops,
20126         .freeze                 = nv_ck804_freeze,
20127         .thaw                   = nv_ck804_thaw,
20128         .host_stop              = nv_ck804_host_stop,
20129  };
20130
20131 -static struct ata_port_operations nv_adma_ops = {
20132 +static const struct ata_port_operations nv_adma_ops = {
20133         .inherits               = &nv_ck804_ops,
20134
20135         .check_atapi_dma        = nv_adma_check_atapi_dma,
20136 @@ -509,7 +509,7 @@ static struct ata_port_operations nv_adm
20137         .host_stop              = nv_adma_host_stop,
20138  };
20139
20140 -static struct ata_port_operations nv_swncq_ops = {
20141 +static const struct ata_port_operations nv_swncq_ops = {
20142         .inherits               = &nv_generic_ops,
20143
20144         .qc_defer               = ata_std_qc_defer,
20145 diff -urNp linux-2.6.33/drivers/ata/sata_promise.c linux-2.6.33/drivers/ata/sata_promise.c
20146 --- linux-2.6.33/drivers/ata/sata_promise.c     2010-02-24 13:52:17.000000000 -0500
20147 +++ linux-2.6.33/drivers/ata/sata_promise.c     2010-03-07 12:23:35.981708557 -0500
20148 @@ -195,7 +195,7 @@ static const struct ata_port_operations
20149         .error_handler          = pdc_error_handler,
20150  };
20151
20152 -static struct ata_port_operations pdc_sata_ops = {
20153 +static const struct ata_port_operations pdc_sata_ops = {
20154         .inherits               = &pdc_common_ops,
20155         .cable_detect           = pdc_sata_cable_detect,
20156         .freeze                 = pdc_sata_freeze,
20157 @@ -208,14 +208,14 @@ static struct ata_port_operations pdc_sa
20158
20159  /* First-generation chips need a more restrictive ->check_atapi_dma op,
20160     and ->freeze/thaw that ignore the hotplug controls. */
20161 -static struct ata_port_operations pdc_old_sata_ops = {
20162 +static const struct ata_port_operations pdc_old_sata_ops = {
20163         .inherits               = &pdc_sata_ops,
20164         .freeze                 = pdc_freeze,
20165         .thaw                   = pdc_thaw,
20166         .check_atapi_dma        = pdc_old_sata_check_atapi_dma,
20167  };
20168
20169 -static struct ata_port_operations pdc_pata_ops = {
20170 +static const struct ata_port_operations pdc_pata_ops = {
20171         .inherits               = &pdc_common_ops,
20172         .cable_detect           = pdc_pata_cable_detect,
20173         .freeze                 = pdc_freeze,
20174 diff -urNp linux-2.6.33/drivers/ata/sata_qstor.c linux-2.6.33/drivers/ata/sata_qstor.c
20175 --- linux-2.6.33/drivers/ata/sata_qstor.c       2010-02-24 13:52:17.000000000 -0500
20176 +++ linux-2.6.33/drivers/ata/sata_qstor.c       2010-03-07 12:23:35.985647175 -0500
20177 @@ -132,7 +132,7 @@ static struct scsi_host_template qs_ata_
20178         .dma_boundary           = QS_DMA_BOUNDARY,
20179  };
20180
20181 -static struct ata_port_operations qs_ata_ops = {
20182 +static const struct ata_port_operations qs_ata_ops = {
20183         .inherits               = &ata_sff_port_ops,
20184
20185         .check_atapi_dma        = qs_check_atapi_dma,
20186 diff -urNp linux-2.6.33/drivers/ata/sata_sil24.c linux-2.6.33/drivers/ata/sata_sil24.c
20187 --- linux-2.6.33/drivers/ata/sata_sil24.c       2010-02-24 13:52:17.000000000 -0500
20188 +++ linux-2.6.33/drivers/ata/sata_sil24.c       2010-03-07 12:23:35.985647175 -0500
20189 @@ -388,7 +388,7 @@ static struct scsi_host_template sil24_s
20190         .dma_boundary           = ATA_DMA_BOUNDARY,
20191  };
20192
20193 -static struct ata_port_operations sil24_ops = {
20194 +static const struct ata_port_operations sil24_ops = {
20195         .inherits               = &sata_pmp_port_ops,
20196
20197         .qc_defer               = sil24_qc_defer,
20198 diff -urNp linux-2.6.33/drivers/ata/sata_sil.c linux-2.6.33/drivers/ata/sata_sil.c
20199 --- linux-2.6.33/drivers/ata/sata_sil.c 2010-02-24 13:52:17.000000000 -0500
20200 +++ linux-2.6.33/drivers/ata/sata_sil.c 2010-03-07 12:23:35.985647175 -0500
20201 @@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
20202         .sg_tablesize           = ATA_MAX_PRD
20203  };
20204
20205 -static struct ata_port_operations sil_ops = {
20206 +static const struct ata_port_operations sil_ops = {
20207         .inherits               = &ata_bmdma32_port_ops,
20208         .dev_config             = sil_dev_config,
20209         .set_mode               = sil_set_mode,
20210 diff -urNp linux-2.6.33/drivers/ata/sata_sis.c linux-2.6.33/drivers/ata/sata_sis.c
20211 --- linux-2.6.33/drivers/ata/sata_sis.c 2010-02-24 13:52:17.000000000 -0500
20212 +++ linux-2.6.33/drivers/ata/sata_sis.c 2010-03-07 12:23:35.985647175 -0500
20213 @@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
20214         ATA_BMDMA_SHT(DRV_NAME),
20215  };
20216
20217 -static struct ata_port_operations sis_ops = {
20218 +static const struct ata_port_operations sis_ops = {
20219         .inherits               = &ata_bmdma_port_ops,
20220         .scr_read               = sis_scr_read,
20221         .scr_write              = sis_scr_write,
20222 diff -urNp linux-2.6.33/drivers/ata/sata_svw.c linux-2.6.33/drivers/ata/sata_svw.c
20223 --- linux-2.6.33/drivers/ata/sata_svw.c 2010-02-24 13:52:17.000000000 -0500
20224 +++ linux-2.6.33/drivers/ata/sata_svw.c 2010-03-07 12:23:35.985647175 -0500
20225 @@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
20226  };
20227
20228
20229 -static struct ata_port_operations k2_sata_ops = {
20230 +static const struct ata_port_operations k2_sata_ops = {
20231         .inherits               = &ata_bmdma_port_ops,
20232         .sff_tf_load            = k2_sata_tf_load,
20233         .sff_tf_read            = k2_sata_tf_read,
20234 diff -urNp linux-2.6.33/drivers/ata/sata_sx4.c linux-2.6.33/drivers/ata/sata_sx4.c
20235 --- linux-2.6.33/drivers/ata/sata_sx4.c 2010-02-24 13:52:17.000000000 -0500
20236 +++ linux-2.6.33/drivers/ata/sata_sx4.c 2010-03-07 12:23:35.985647175 -0500
20237 @@ -248,7 +248,7 @@ static struct scsi_host_template pdc_sat
20238  };
20239
20240  /* TODO: inherit from base port_ops after converting to new EH */
20241 -static struct ata_port_operations pdc_20621_ops = {
20242 +static const struct ata_port_operations pdc_20621_ops = {
20243         .inherits               = &ata_sff_port_ops,
20244
20245         .check_atapi_dma        = pdc_check_atapi_dma,
20246 diff -urNp linux-2.6.33/drivers/ata/sata_uli.c linux-2.6.33/drivers/ata/sata_uli.c
20247 --- linux-2.6.33/drivers/ata/sata_uli.c 2010-02-24 13:52:17.000000000 -0500
20248 +++ linux-2.6.33/drivers/ata/sata_uli.c 2010-03-07 12:23:35.985647175 -0500
20249 @@ -79,7 +79,7 @@ static struct scsi_host_template uli_sht
20250         ATA_BMDMA_SHT(DRV_NAME),
20251  };
20252
20253 -static struct ata_port_operations uli_ops = {
20254 +static const struct ata_port_operations uli_ops = {
20255         .inherits               = &ata_bmdma_port_ops,
20256         .scr_read               = uli_scr_read,
20257         .scr_write              = uli_scr_write,
20258 diff -urNp linux-2.6.33/drivers/ata/sata_via.c linux-2.6.33/drivers/ata/sata_via.c
20259 --- linux-2.6.33/drivers/ata/sata_via.c 2010-02-24 13:52:17.000000000 -0500
20260 +++ linux-2.6.33/drivers/ata/sata_via.c 2010-03-07 12:23:35.985647175 -0500
20261 @@ -112,31 +112,31 @@ static struct scsi_host_template svia_sh
20262         ATA_BMDMA_SHT(DRV_NAME),
20263  };
20264
20265 -static struct ata_port_operations svia_base_ops = {
20266 +static const struct ata_port_operations svia_base_ops = {
20267         .inherits               = &ata_bmdma_port_ops,
20268         .sff_tf_load            = svia_tf_load,
20269  };
20270
20271 -static struct ata_port_operations vt6420_sata_ops = {
20272 +static const struct ata_port_operations vt6420_sata_ops = {
20273         .inherits               = &svia_base_ops,
20274         .freeze                 = svia_noop_freeze,
20275         .prereset               = vt6420_prereset,
20276  };
20277
20278 -static struct ata_port_operations vt6421_pata_ops = {
20279 +static const struct ata_port_operations vt6421_pata_ops = {
20280         .inherits               = &svia_base_ops,
20281         .cable_detect           = vt6421_pata_cable_detect,
20282         .set_piomode            = vt6421_set_pio_mode,
20283         .set_dmamode            = vt6421_set_dma_mode,
20284  };
20285
20286 -static struct ata_port_operations vt6421_sata_ops = {
20287 +static const struct ata_port_operations vt6421_sata_ops = {
20288         .inherits               = &svia_base_ops,
20289         .scr_read               = svia_scr_read,
20290         .scr_write              = svia_scr_write,
20291  };
20292
20293 -static struct ata_port_operations vt8251_ops = {
20294 +static const struct ata_port_operations vt8251_ops = {
20295         .inherits               = &svia_base_ops,
20296         .hardreset              = sata_std_hardreset,
20297         .scr_read               = vt8251_scr_read,
20298 diff -urNp linux-2.6.33/drivers/ata/sata_vsc.c linux-2.6.33/drivers/ata/sata_vsc.c
20299 --- linux-2.6.33/drivers/ata/sata_vsc.c 2010-02-24 13:52:17.000000000 -0500
20300 +++ linux-2.6.33/drivers/ata/sata_vsc.c 2010-03-07 12:23:35.985647175 -0500
20301 @@ -306,7 +306,7 @@ static struct scsi_host_template vsc_sat
20302  };
20303
20304
20305 -static struct ata_port_operations vsc_sata_ops = {
20306 +static const struct ata_port_operations vsc_sata_ops = {
20307         .inherits               = &ata_bmdma_port_ops,
20308         /* The IRQ handling is not quite standard SFF behaviour so we
20309            cannot use the default lost interrupt handler */
20310 diff -urNp linux-2.6.33/drivers/atm/adummy.c linux-2.6.33/drivers/atm/adummy.c
20311 --- linux-2.6.33/drivers/atm/adummy.c   2010-02-24 13:52:17.000000000 -0500
20312 +++ linux-2.6.33/drivers/atm/adummy.c   2010-03-07 12:23:35.985647175 -0500
20313 @@ -77,7 +77,7 @@ adummy_send(struct atm_vcc *vcc, struct
20314                 vcc->pop(vcc, skb);
20315         else
20316                 dev_kfree_skb_any(skb);
20317 -       atomic_inc(&vcc->stats->tx);
20318 +       atomic_inc_unchecked(&vcc->stats->tx);
20319
20320         return 0;
20321  }
20322 diff -urNp linux-2.6.33/drivers/atm/ambassador.c linux-2.6.33/drivers/atm/ambassador.c
20323 --- linux-2.6.33/drivers/atm/ambassador.c       2010-02-24 13:52:17.000000000 -0500
20324 +++ linux-2.6.33/drivers/atm/ambassador.c       2010-03-07 12:23:35.985647175 -0500
20325 @@ -453,7 +453,7 @@ static void tx_complete (amb_dev * dev,
20326    PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
20327
20328    // VC layer stats
20329 -  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
20330 +  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
20331
20332    // free the descriptor
20333    kfree (tx_descr);
20334 @@ -494,7 +494,7 @@ static void rx_complete (amb_dev * dev,
20335           dump_skb ("<<<", vc, skb);
20336
20337           // VC layer stats
20338 -         atomic_inc(&atm_vcc->stats->rx);
20339 +         atomic_inc_unchecked(&atm_vcc->stats->rx);
20340           __net_timestamp(skb);
20341           // end of our responsability
20342           atm_vcc->push (atm_vcc, skb);
20343 @@ -509,7 +509,7 @@ static void rx_complete (amb_dev * dev,
20344        } else {
20345         PRINTK (KERN_INFO, "dropped over-size frame");
20346         // should we count this?
20347 -       atomic_inc(&atm_vcc->stats->rx_drop);
20348 +       atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
20349        }
20350
20351      } else {
20352 @@ -1341,7 +1341,7 @@ static int amb_send (struct atm_vcc * at
20353    }
20354
20355    if (check_area (skb->data, skb->len)) {
20356 -    atomic_inc(&atm_vcc->stats->tx_err);
20357 +    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
20358      return -ENOMEM; // ?
20359    }
20360
20361 diff -urNp linux-2.6.33/drivers/atm/atmtcp.c linux-2.6.33/drivers/atm/atmtcp.c
20362 --- linux-2.6.33/drivers/atm/atmtcp.c   2010-02-24 13:52:17.000000000 -0500
20363 +++ linux-2.6.33/drivers/atm/atmtcp.c   2010-03-07 12:23:35.985647175 -0500
20364 @@ -206,7 +206,7 @@ static int atmtcp_v_send(struct atm_vcc
20365                 if (vcc->pop) vcc->pop(vcc,skb);
20366                 else dev_kfree_skb(skb);
20367                 if (dev_data) return 0;
20368 -               atomic_inc(&vcc->stats->tx_err);
20369 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20370                 return -ENOLINK;
20371         }
20372         size = skb->len+sizeof(struct atmtcp_hdr);
20373 @@ -214,7 +214,7 @@ static int atmtcp_v_send(struct atm_vcc
20374         if (!new_skb) {
20375                 if (vcc->pop) vcc->pop(vcc,skb);
20376                 else dev_kfree_skb(skb);
20377 -               atomic_inc(&vcc->stats->tx_err);
20378 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20379                 return -ENOBUFS;
20380         }
20381         hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
20382 @@ -225,8 +225,8 @@ static int atmtcp_v_send(struct atm_vcc
20383         if (vcc->pop) vcc->pop(vcc,skb);
20384         else dev_kfree_skb(skb);
20385         out_vcc->push(out_vcc,new_skb);
20386 -       atomic_inc(&vcc->stats->tx);
20387 -       atomic_inc(&out_vcc->stats->rx);
20388 +       atomic_inc_unchecked(&vcc->stats->tx);
20389 +       atomic_inc_unchecked(&out_vcc->stats->rx);
20390         return 0;
20391  }
20392
20393 @@ -300,7 +300,7 @@ static int atmtcp_c_send(struct atm_vcc
20394         out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
20395         read_unlock(&vcc_sklist_lock);
20396         if (!out_vcc) {
20397 -               atomic_inc(&vcc->stats->tx_err);
20398 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20399                 goto done;
20400         }
20401         skb_pull(skb,sizeof(struct atmtcp_hdr));
20402 @@ -312,8 +312,8 @@ static int atmtcp_c_send(struct atm_vcc
20403         __net_timestamp(new_skb);
20404         skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
20405         out_vcc->push(out_vcc,new_skb);
20406 -       atomic_inc(&vcc->stats->tx);
20407 -       atomic_inc(&out_vcc->stats->rx);
20408 +       atomic_inc_unchecked(&vcc->stats->tx);
20409 +       atomic_inc_unchecked(&out_vcc->stats->rx);
20410  done:
20411         if (vcc->pop) vcc->pop(vcc,skb);
20412         else dev_kfree_skb(skb);
20413 diff -urNp linux-2.6.33/drivers/atm/eni.c linux-2.6.33/drivers/atm/eni.c
20414 --- linux-2.6.33/drivers/atm/eni.c      2010-02-24 13:52:17.000000000 -0500
20415 +++ linux-2.6.33/drivers/atm/eni.c      2010-03-07 12:23:35.985647175 -0500
20416 @@ -525,7 +525,7 @@ static int rx_aal0(struct atm_vcc *vcc)
20417                 DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
20418                     vcc->dev->number);
20419                 length = 0;
20420 -               atomic_inc(&vcc->stats->rx_err);
20421 +               atomic_inc_unchecked(&vcc->stats->rx_err);
20422         }
20423         else {
20424                 length = ATM_CELL_SIZE-1; /* no HEC */
20425 @@ -580,7 +580,7 @@ static int rx_aal5(struct atm_vcc *vcc)
20426                             size);
20427                 }
20428                 eff = length = 0;
20429 -               atomic_inc(&vcc->stats->rx_err);
20430 +               atomic_inc_unchecked(&vcc->stats->rx_err);
20431         }
20432         else {
20433                 size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
20434 @@ -597,7 +597,7 @@ static int rx_aal5(struct atm_vcc *vcc)
20435                             "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
20436                             vcc->dev->number,vcc->vci,length,size << 2,descr);
20437                         length = eff = 0;
20438 -                       atomic_inc(&vcc->stats->rx_err);
20439 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
20440                 }
20441         }
20442         skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
20443 @@ -770,7 +770,7 @@ rx_dequeued++;
20444                         vcc->push(vcc,skb);
20445                         pushed++;
20446                 }
20447 -               atomic_inc(&vcc->stats->rx);
20448 +               atomic_inc_unchecked(&vcc->stats->rx);
20449         }
20450         wake_up(&eni_dev->rx_wait);
20451  }
20452 @@ -1227,7 +1227,7 @@ static void dequeue_tx(struct atm_dev *d
20453                     PCI_DMA_TODEVICE);
20454                 if (vcc->pop) vcc->pop(vcc,skb);
20455                 else dev_kfree_skb_irq(skb);
20456 -               atomic_inc(&vcc->stats->tx);
20457 +               atomic_inc_unchecked(&vcc->stats->tx);
20458                 wake_up(&eni_dev->tx_wait);
20459  dma_complete++;
20460         }
20461 diff -urNp linux-2.6.33/drivers/atm/firestream.c linux-2.6.33/drivers/atm/firestream.c
20462 --- linux-2.6.33/drivers/atm/firestream.c       2010-02-24 13:52:17.000000000 -0500
20463 +++ linux-2.6.33/drivers/atm/firestream.c       2010-03-07 12:23:35.985647175 -0500
20464 @@ -748,7 +748,7 @@ static void process_txdone_queue (struct
20465                                 }
20466                         }
20467
20468 -                       atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
20469 +                       atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
20470
20471                         fs_dprintk (FS_DEBUG_TXMEM, "i");
20472                         fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
20473 @@ -815,7 +815,7 @@ static void process_incoming (struct fs_
20474  #endif
20475                                 skb_put (skb, qe->p1 & 0xffff);
20476                                 ATM_SKB(skb)->vcc = atm_vcc;
20477 -                               atomic_inc(&atm_vcc->stats->rx);
20478 +                               atomic_inc_unchecked(&atm_vcc->stats->rx);
20479                                 __net_timestamp(skb);
20480                                 fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
20481                                 atm_vcc->push (atm_vcc, skb);
20482 @@ -836,12 +836,12 @@ static void process_incoming (struct fs_
20483                                 kfree (pe);
20484                         }
20485                         if (atm_vcc)
20486 -                               atomic_inc(&atm_vcc->stats->rx_drop);
20487 +                               atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
20488                         break;
20489                 case 0x1f: /*  Reassembly abort: no buffers. */
20490                         /* Silently increment error counter. */
20491                         if (atm_vcc)
20492 -                               atomic_inc(&atm_vcc->stats->rx_drop);
20493 +                               atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
20494                         break;
20495                 default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
20496                         printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n",
20497 diff -urNp linux-2.6.33/drivers/atm/fore200e.c linux-2.6.33/drivers/atm/fore200e.c
20498 --- linux-2.6.33/drivers/atm/fore200e.c 2010-02-24 13:52:17.000000000 -0500
20499 +++ linux-2.6.33/drivers/atm/fore200e.c 2010-03-07 12:23:35.989712079 -0500
20500 @@ -931,9 +931,9 @@ fore200e_tx_irq(struct fore200e* fore200
20501  #endif
20502                 /* check error condition */
20503                 if (*entry->status & STATUS_ERROR)
20504 -                   atomic_inc(&vcc->stats->tx_err);
20505 +                   atomic_inc_unchecked(&vcc->stats->tx_err);
20506                 else
20507 -                   atomic_inc(&vcc->stats->tx);
20508 +                   atomic_inc_unchecked(&vcc->stats->tx);
20509             }
20510         }
20511
20512 @@ -1082,7 +1082,7 @@ fore200e_push_rpd(struct fore200e* fore2
20513      if (skb == NULL) {
20514         DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
20515
20516 -       atomic_inc(&vcc->stats->rx_drop);
20517 +       atomic_inc_unchecked(&vcc->stats->rx_drop);
20518         return -ENOMEM;
20519      }
20520
20521 @@ -1125,14 +1125,14 @@ fore200e_push_rpd(struct fore200e* fore2
20522
20523         dev_kfree_skb_any(skb);
20524
20525 -       atomic_inc(&vcc->stats->rx_drop);
20526 +       atomic_inc_unchecked(&vcc->stats->rx_drop);
20527         return -ENOMEM;
20528      }
20529
20530      ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
20531
20532      vcc->push(vcc, skb);
20533 -    atomic_inc(&vcc->stats->rx);
20534 +    atomic_inc_unchecked(&vcc->stats->rx);
20535
20536      ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
20537
20538 @@ -1210,7 +1210,7 @@ fore200e_rx_irq(struct fore200e* fore200
20539                 DPRINTK(2, "damaged PDU on %d.%d.%d\n",
20540                         fore200e->atm_dev->number,
20541                         entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
20542 -               atomic_inc(&vcc->stats->rx_err);
20543 +               atomic_inc_unchecked(&vcc->stats->rx_err);
20544             }
20545         }
20546
20547 @@ -1655,7 +1655,7 @@ fore200e_send(struct atm_vcc *vcc, struc
20548                 goto retry_here;
20549             }
20550
20551 -           atomic_inc(&vcc->stats->tx_err);
20552 +           atomic_inc_unchecked(&vcc->stats->tx_err);
20553
20554             fore200e->tx_sat++;
20555             DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
20556 diff -urNp linux-2.6.33/drivers/atm/he.c linux-2.6.33/drivers/atm/he.c
20557 --- linux-2.6.33/drivers/atm/he.c       2010-02-24 13:52:17.000000000 -0500
20558 +++ linux-2.6.33/drivers/atm/he.c       2010-03-07 12:23:35.989712079 -0500
20559 @@ -1769,7 +1769,7 @@ he_service_rbrq(struct he_dev *he_dev, i
20560
20561                 if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
20562                         hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
20563 -                               atomic_inc(&vcc->stats->rx_drop);
20564 +                               atomic_inc_unchecked(&vcc->stats->rx_drop);
20565                         goto return_host_buffers;
20566                 }
20567
20568 @@ -1802,7 +1802,7 @@ he_service_rbrq(struct he_dev *he_dev, i
20569                                 RBRQ_LEN_ERR(he_dev->rbrq_head)
20570                                                         ? "LEN_ERR" : "",
20571                                                         vcc->vpi, vcc->vci);
20572 -                       atomic_inc(&vcc->stats->rx_err);
20573 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
20574                         goto return_host_buffers;
20575                 }
20576
20577 @@ -1861,7 +1861,7 @@ he_service_rbrq(struct he_dev *he_dev, i
20578                 vcc->push(vcc, skb);
20579                 spin_lock(&he_dev->global_lock);
20580
20581 -               atomic_inc(&vcc->stats->rx);
20582 +               atomic_inc_unchecked(&vcc->stats->rx);
20583
20584  return_host_buffers:
20585                 ++pdus_assembled;
20586 @@ -2206,7 +2206,7 @@ __enqueue_tpd(struct he_dev *he_dev, str
20587                                         tpd->vcc->pop(tpd->vcc, tpd->skb);
20588                                 else
20589                                         dev_kfree_skb_any(tpd->skb);
20590 -                               atomic_inc(&tpd->vcc->stats->tx_err);
20591 +                               atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
20592                         }
20593                         pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
20594                         return;
20595 @@ -2618,7 +2618,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
20596                         vcc->pop(vcc, skb);
20597                 else
20598                         dev_kfree_skb_any(skb);
20599 -               atomic_inc(&vcc->stats->tx_err);
20600 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20601                 return -EINVAL;
20602         }
20603
20604 @@ -2629,7 +2629,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
20605                         vcc->pop(vcc, skb);
20606                 else
20607                         dev_kfree_skb_any(skb);
20608 -               atomic_inc(&vcc->stats->tx_err);
20609 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20610                 return -EINVAL;
20611         }
20612  #endif
20613 @@ -2641,7 +2641,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
20614                         vcc->pop(vcc, skb);
20615                 else
20616                         dev_kfree_skb_any(skb);
20617 -               atomic_inc(&vcc->stats->tx_err);
20618 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20619                 spin_unlock_irqrestore(&he_dev->global_lock, flags);
20620                 return -ENOMEM;
20621         }
20622 @@ -2683,7 +2683,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
20623                                         vcc->pop(vcc, skb);
20624                                 else
20625                                         dev_kfree_skb_any(skb);
20626 -                               atomic_inc(&vcc->stats->tx_err);
20627 +                               atomic_inc_unchecked(&vcc->stats->tx_err);
20628                                 spin_unlock_irqrestore(&he_dev->global_lock, flags);
20629                                 return -ENOMEM;
20630                         }
20631 @@ -2714,7 +2714,7 @@ he_send(struct atm_vcc *vcc, struct sk_b
20632         __enqueue_tpd(he_dev, tpd, cid);
20633         spin_unlock_irqrestore(&he_dev->global_lock, flags);
20634
20635 -       atomic_inc(&vcc->stats->tx);
20636 +       atomic_inc_unchecked(&vcc->stats->tx);
20637
20638         return 0;
20639  }
20640 diff -urNp linux-2.6.33/drivers/atm/horizon.c linux-2.6.33/drivers/atm/horizon.c
20641 --- linux-2.6.33/drivers/atm/horizon.c  2010-02-24 13:52:17.000000000 -0500
20642 +++ linux-2.6.33/drivers/atm/horizon.c  2010-03-07 12:23:35.989712079 -0500
20643 @@ -1033,7 +1033,7 @@ static void rx_schedule (hrz_dev * dev,
20644         {
20645           struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
20646           // VC layer stats
20647 -         atomic_inc(&vcc->stats->rx);
20648 +         atomic_inc_unchecked(&vcc->stats->rx);
20649           __net_timestamp(skb);
20650           // end of our responsability
20651           vcc->push (vcc, skb);
20652 @@ -1185,7 +1185,7 @@ static void tx_schedule (hrz_dev * const
20653         dev->tx_iovec = NULL;
20654
20655         // VC layer stats
20656 -       atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
20657 +       atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
20658
20659         // free the skb
20660         hrz_kfree_skb (skb);
20661 diff -urNp linux-2.6.33/drivers/atm/idt77252.c linux-2.6.33/drivers/atm/idt77252.c
20662 --- linux-2.6.33/drivers/atm/idt77252.c 2010-02-24 13:52:17.000000000 -0500
20663 +++ linux-2.6.33/drivers/atm/idt77252.c 2010-03-07 12:23:35.989712079 -0500
20664 @@ -810,7 +810,7 @@ drain_scq(struct idt77252_dev *card, str
20665                 else
20666                         dev_kfree_skb(skb);
20667
20668 -               atomic_inc(&vcc->stats->tx);
20669 +               atomic_inc_unchecked(&vcc->stats->tx);
20670         }
20671
20672         atomic_dec(&scq->used);
20673 @@ -1073,13 +1073,13 @@ dequeue_rx(struct idt77252_dev *card, st
20674                         if ((sb = dev_alloc_skb(64)) == NULL) {
20675                                 printk("%s: Can't allocate buffers for aal0.\n",
20676                                        card->name);
20677 -                               atomic_add(i, &vcc->stats->rx_drop);
20678 +                               atomic_add_unchecked(i, &vcc->stats->rx_drop);
20679                                 break;
20680                         }
20681                         if (!atm_charge(vcc, sb->truesize)) {
20682                                 RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
20683                                          card->name);
20684 -                               atomic_add(i - 1, &vcc->stats->rx_drop);
20685 +                               atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
20686                                 dev_kfree_skb(sb);
20687                                 break;
20688                         }
20689 @@ -1096,7 +1096,7 @@ dequeue_rx(struct idt77252_dev *card, st
20690                         ATM_SKB(sb)->vcc = vcc;
20691                         __net_timestamp(sb);
20692                         vcc->push(vcc, sb);
20693 -                       atomic_inc(&vcc->stats->rx);
20694 +                       atomic_inc_unchecked(&vcc->stats->rx);
20695
20696                         cell += ATM_CELL_PAYLOAD;
20697                 }
20698 @@ -1133,13 +1133,13 @@ dequeue_rx(struct idt77252_dev *card, st
20699                                  "(CDC: %08x)\n",
20700                                  card->name, len, rpp->len, readl(SAR_REG_CDC));
20701                         recycle_rx_pool_skb(card, rpp);
20702 -                       atomic_inc(&vcc->stats->rx_err);
20703 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
20704                         return;
20705                 }
20706                 if (stat & SAR_RSQE_CRC) {
20707                         RXPRINTK("%s: AAL5 CRC error.\n", card->name);
20708                         recycle_rx_pool_skb(card, rpp);
20709 -                       atomic_inc(&vcc->stats->rx_err);
20710 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
20711                         return;
20712                 }
20713                 if (skb_queue_len(&rpp->queue) > 1) {
20714 @@ -1150,7 +1150,7 @@ dequeue_rx(struct idt77252_dev *card, st
20715                                 RXPRINTK("%s: Can't alloc RX skb.\n",
20716                                          card->name);
20717                                 recycle_rx_pool_skb(card, rpp);
20718 -                               atomic_inc(&vcc->stats->rx_err);
20719 +                               atomic_inc_unchecked(&vcc->stats->rx_err);
20720                                 return;
20721                         }
20722                         if (!atm_charge(vcc, skb->truesize)) {
20723 @@ -1169,7 +1169,7 @@ dequeue_rx(struct idt77252_dev *card, st
20724                         __net_timestamp(skb);
20725
20726                         vcc->push(vcc, skb);
20727 -                       atomic_inc(&vcc->stats->rx);
20728 +                       atomic_inc_unchecked(&vcc->stats->rx);
20729
20730                         return;
20731                 }
20732 @@ -1191,7 +1191,7 @@ dequeue_rx(struct idt77252_dev *card, st
20733                 __net_timestamp(skb);
20734
20735                 vcc->push(vcc, skb);
20736 -               atomic_inc(&vcc->stats->rx);
20737 +               atomic_inc_unchecked(&vcc->stats->rx);
20738
20739                 if (skb->truesize > SAR_FB_SIZE_3)
20740                         add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
20741 @@ -1303,14 +1303,14 @@ idt77252_rx_raw(struct idt77252_dev *car
20742                 if (vcc->qos.aal != ATM_AAL0) {
20743                         RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
20744                                 card->name, vpi, vci);
20745 -                       atomic_inc(&vcc->stats->rx_drop);
20746 +                       atomic_inc_unchecked(&vcc->stats->rx_drop);
20747                         goto drop;
20748                 }
20749
20750                 if ((sb = dev_alloc_skb(64)) == NULL) {
20751                         printk("%s: Can't allocate buffers for AAL0.\n",
20752                                card->name);
20753 -                       atomic_inc(&vcc->stats->rx_err);
20754 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
20755                         goto drop;
20756                 }
20757
20758 @@ -1329,7 +1329,7 @@ idt77252_rx_raw(struct idt77252_dev *car
20759                 ATM_SKB(sb)->vcc = vcc;
20760                 __net_timestamp(sb);
20761                 vcc->push(vcc, sb);
20762 -               atomic_inc(&vcc->stats->rx);
20763 +               atomic_inc_unchecked(&vcc->stats->rx);
20764
20765  drop:
20766                 skb_pull(queue, 64);
20767 @@ -1954,13 +1954,13 @@ idt77252_send_skb(struct atm_vcc *vcc, s
20768
20769         if (vc == NULL) {
20770                 printk("%s: NULL connection in send().\n", card->name);
20771 -               atomic_inc(&vcc->stats->tx_err);
20772 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20773                 dev_kfree_skb(skb);
20774                 return -EINVAL;
20775         }
20776         if (!test_bit(VCF_TX, &vc->flags)) {
20777                 printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
20778 -               atomic_inc(&vcc->stats->tx_err);
20779 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20780                 dev_kfree_skb(skb);
20781                 return -EINVAL;
20782         }
20783 @@ -1972,14 +1972,14 @@ idt77252_send_skb(struct atm_vcc *vcc, s
20784                 break;
20785         default:
20786                 printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
20787 -               atomic_inc(&vcc->stats->tx_err);
20788 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20789                 dev_kfree_skb(skb);
20790                 return -EINVAL;
20791         }
20792
20793         if (skb_shinfo(skb)->nr_frags != 0) {
20794                 printk("%s: No scatter-gather yet.\n", card->name);
20795 -               atomic_inc(&vcc->stats->tx_err);
20796 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20797                 dev_kfree_skb(skb);
20798                 return -EINVAL;
20799         }
20800 @@ -1987,7 +1987,7 @@ idt77252_send_skb(struct atm_vcc *vcc, s
20801
20802         err = queue_skb(card, vc, skb, oam);
20803         if (err) {
20804 -               atomic_inc(&vcc->stats->tx_err);
20805 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20806                 dev_kfree_skb(skb);
20807                 return err;
20808         }
20809 @@ -2010,7 +2010,7 @@ idt77252_send_oam(struct atm_vcc *vcc, v
20810         skb = dev_alloc_skb(64);
20811         if (!skb) {
20812                 printk("%s: Out of memory in send_oam().\n", card->name);
20813 -               atomic_inc(&vcc->stats->tx_err);
20814 +               atomic_inc_unchecked(&vcc->stats->tx_err);
20815                 return -ENOMEM;
20816         }
20817         atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
20818 diff -urNp linux-2.6.33/drivers/atm/iphase.c linux-2.6.33/drivers/atm/iphase.c
20819 --- linux-2.6.33/drivers/atm/iphase.c   2010-02-24 13:52:17.000000000 -0500
20820 +++ linux-2.6.33/drivers/atm/iphase.c   2010-03-07 12:23:35.989712079 -0500
20821 @@ -1123,7 +1123,7 @@ static int rx_pkt(struct atm_dev *dev)
20822         status = (u_short) (buf_desc_ptr->desc_mode);
20823         if (status & (RX_CER | RX_PTE | RX_OFL))
20824         {
20825 -                atomic_inc(&vcc->stats->rx_err);
20826 +                atomic_inc_unchecked(&vcc->stats->rx_err);
20827                 IF_ERR(printk("IA: bad packet, dropping it");)
20828                  if (status & RX_CER) {
20829                      IF_ERR(printk(" cause: packet CRC error\n");)
20830 @@ -1146,7 +1146,7 @@ static int rx_pkt(struct atm_dev *dev)
20831         len = dma_addr - buf_addr;
20832          if (len > iadev->rx_buf_sz) {
20833             printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
20834 -           atomic_inc(&vcc->stats->rx_err);
20835 +           atomic_inc_unchecked(&vcc->stats->rx_err);
20836            goto out_free_desc;
20837          }
20838
20839 @@ -1296,7 +1296,7 @@ static void rx_dle_intr(struct atm_dev *
20840            ia_vcc = INPH_IA_VCC(vcc);
20841            if (ia_vcc == NULL)
20842            {
20843 -             atomic_inc(&vcc->stats->rx_err);
20844 +             atomic_inc_unchecked(&vcc->stats->rx_err);
20845               dev_kfree_skb_any(skb);
20846               atm_return(vcc, atm_guess_pdu2truesize(len));
20847               goto INCR_DLE;
20848 @@ -1308,7 +1308,7 @@ static void rx_dle_intr(struct atm_dev *
20849            if ((length > iadev->rx_buf_sz) || (length >
20850                                (skb->len - sizeof(struct cpcs_trailer))))
20851            {
20852 -             atomic_inc(&vcc->stats->rx_err);
20853 +             atomic_inc_unchecked(&vcc->stats->rx_err);
20854               IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)",
20855                                                              length, skb->len);)
20856               dev_kfree_skb_any(skb);
20857 @@ -1324,7 +1324,7 @@ static void rx_dle_intr(struct atm_dev *
20858
20859           IF_RX(printk("rx_dle_intr: skb push");)
20860           vcc->push(vcc,skb);
20861 -         atomic_inc(&vcc->stats->rx);
20862 +         atomic_inc_unchecked(&vcc->stats->rx);
20863            iadev->rx_pkt_cnt++;
20864        }
20865  INCR_DLE:
20866 @@ -2806,15 +2806,15 @@ static int ia_ioctl(struct atm_dev *dev,
20867           {
20868               struct k_sonet_stats *stats;
20869               stats = &PRIV(_ia_dev[board])->sonet_stats;
20870 -             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
20871 -             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
20872 -             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
20873 -             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
20874 -             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
20875 -             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
20876 -             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
20877 -             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
20878 -             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
20879 +             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
20880 +             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
20881 +             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
20882 +             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
20883 +             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
20884 +             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
20885 +             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
20886 +             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
20887 +             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
20888           }
20889              ia_cmds.status = 0;
20890              break;
20891 @@ -2919,7 +2919,7 @@ static int ia_pkt_tx (struct atm_vcc *vc
20892         if ((desc == 0) || (desc > iadev->num_tx_desc))
20893         {
20894                 IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);)
20895 -                atomic_inc(&vcc->stats->tx);
20896 +                atomic_inc_unchecked(&vcc->stats->tx);
20897                 if (vcc->pop)
20898                     vcc->pop(vcc, skb);
20899                 else
20900 @@ -3024,14 +3024,14 @@ static int ia_pkt_tx (struct atm_vcc *vc
20901          ATM_DESC(skb) = vcc->vci;
20902          skb_queue_tail(&iadev->tx_dma_q, skb);
20903
20904 -        atomic_inc(&vcc->stats->tx);
20905 +        atomic_inc_unchecked(&vcc->stats->tx);
20906          iadev->tx_pkt_cnt++;
20907         /* Increment transaction counter */
20908         writel(2, iadev->dma+IPHASE5575_TX_COUNTER);
20909
20910  #if 0
20911          /* add flow control logic */
20912 -        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
20913 +        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
20914            if (iavcc->vc_desc_cnt > 10) {
20915               vcc->tx_quota =  vcc->tx_quota * 3 / 4;
20916              printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
20917 diff -urNp linux-2.6.33/drivers/atm/lanai.c linux-2.6.33/drivers/atm/lanai.c
20918 --- linux-2.6.33/drivers/atm/lanai.c    2010-02-24 13:52:17.000000000 -0500
20919 +++ linux-2.6.33/drivers/atm/lanai.c    2010-03-07 12:23:35.989712079 -0500
20920 @@ -1305,7 +1305,7 @@ static void lanai_send_one_aal5(struct l
20921         vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
20922         lanai_endtx(lanai, lvcc);
20923         lanai_free_skb(lvcc->tx.atmvcc, skb);
20924 -       atomic_inc(&lvcc->tx.atmvcc->stats->tx);
20925 +       atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
20926  }
20927
20928  /* Try to fill the buffer - don't call unless there is backlog */
20929 @@ -1428,7 +1428,7 @@ static void vcc_rx_aal5(struct lanai_vcc
20930         ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
20931         __net_timestamp(skb);
20932         lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
20933 -       atomic_inc(&lvcc->rx.atmvcc->stats->rx);
20934 +       atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
20935      out:
20936         lvcc->rx.buf.ptr = end;
20937         cardvcc_write(lvcc, endptr, vcc_rxreadptr);
20938 @@ -1670,7 +1670,7 @@ static int handle_service(struct lanai_d
20939                 DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
20940                     "vcc %d\n", lanai->number, (unsigned int) s, vci);
20941                 lanai->stats.service_rxnotaal5++;
20942 -               atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
20943 +               atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
20944                 return 0;
20945         }
20946         if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
20947 @@ -1682,7 +1682,7 @@ static int handle_service(struct lanai_d
20948                 int bytes;
20949                 read_unlock(&vcc_sklist_lock);
20950                 DPRINTK("got trashed rx pdu on vci %d\n", vci);
20951 -               atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
20952 +               atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
20953                 lvcc->stats.x.aal5.service_trash++;
20954                 bytes = (SERVICE_GET_END(s) * 16) -
20955                     (((unsigned long) lvcc->rx.buf.ptr) -
20956 @@ -1694,7 +1694,7 @@ static int handle_service(struct lanai_d
20957         }
20958         if (s & SERVICE_STREAM) {
20959                 read_unlock(&vcc_sklist_lock);
20960 -               atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
20961 +               atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
20962                 lvcc->stats.x.aal5.service_stream++;
20963                 printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
20964                     "PDU on VCI %d!\n", lanai->number, vci);
20965 @@ -1702,7 +1702,7 @@ static int handle_service(struct lanai_d
20966                 return 0;
20967         }
20968         DPRINTK("got rx crc error on vci %d\n", vci);
20969 -       atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
20970 +       atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
20971         lvcc->stats.x.aal5.service_rxcrc++;
20972         lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
20973         cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
20974 diff -urNp linux-2.6.33/drivers/atm/nicstar.c linux-2.6.33/drivers/atm/nicstar.c
20975 --- linux-2.6.33/drivers/atm/nicstar.c  2010-02-24 13:52:17.000000000 -0500
20976 +++ linux-2.6.33/drivers/atm/nicstar.c  2010-03-07 12:23:35.993715829 -0500
20977 @@ -1723,7 +1723,7 @@ static int ns_send(struct atm_vcc *vcc,
20978     if ((vc = (vc_map *) vcc->dev_data) == NULL)
20979     {
20980        printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
20981 -      atomic_inc(&vcc->stats->tx_err);
20982 +      atomic_inc_unchecked(&vcc->stats->tx_err);
20983        dev_kfree_skb_any(skb);
20984        return -EINVAL;
20985     }
20986 @@ -1731,7 +1731,7 @@ static int ns_send(struct atm_vcc *vcc,
20987     if (!vc->tx)
20988     {
20989        printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
20990 -      atomic_inc(&vcc->stats->tx_err);
20991 +      atomic_inc_unchecked(&vcc->stats->tx_err);
20992        dev_kfree_skb_any(skb);
20993        return -EINVAL;
20994     }
20995 @@ -1739,7 +1739,7 @@ static int ns_send(struct atm_vcc *vcc,
20996     if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
20997     {
20998        printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
20999 -      atomic_inc(&vcc->stats->tx_err);
21000 +      atomic_inc_unchecked(&vcc->stats->tx_err);
21001        dev_kfree_skb_any(skb);
21002        return -EINVAL;
21003     }
21004 @@ -1747,7 +1747,7 @@ static int ns_send(struct atm_vcc *vcc,
21005     if (skb_shinfo(skb)->nr_frags != 0)
21006     {
21007        printk("nicstar%d: No scatter-gather yet.\n", card->index);
21008 -      atomic_inc(&vcc->stats->tx_err);
21009 +      atomic_inc_unchecked(&vcc->stats->tx_err);
21010        dev_kfree_skb_any(skb);
21011        return -EINVAL;
21012     }
21013 @@ -1792,11 +1792,11 @@ static int ns_send(struct atm_vcc *vcc,
21014
21015     if (push_scqe(card, vc, scq, &scqe, skb) != 0)
21016     {
21017 -      atomic_inc(&vcc->stats->tx_err);
21018 +      atomic_inc_unchecked(&vcc->stats->tx_err);
21019        dev_kfree_skb_any(skb);
21020        return -EIO;
21021     }
21022 -   atomic_inc(&vcc->stats->tx);
21023 +   atomic_inc_unchecked(&vcc->stats->tx);
21024
21025     return 0;
21026  }
21027 @@ -2111,14 +2111,14 @@ static void dequeue_rx(ns_dev *card, ns_
21028           {
21029              printk("nicstar%d: Can't allocate buffers for aal0.\n",
21030                     card->index);
21031 -            atomic_add(i,&vcc->stats->rx_drop);
21032 +            atomic_add_unchecked(i,&vcc->stats->rx_drop);
21033              break;
21034           }
21035           if (!atm_charge(vcc, sb->truesize))
21036           {
21037              RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
21038                       card->index);
21039 -            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
21040 +            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
21041              dev_kfree_skb_any(sb);
21042              break;
21043           }
21044 @@ -2133,7 +2133,7 @@ static void dequeue_rx(ns_dev *card, ns_
21045           ATM_SKB(sb)->vcc = vcc;
21046          __net_timestamp(sb);
21047           vcc->push(vcc, sb);
21048 -         atomic_inc(&vcc->stats->rx);
21049 +         atomic_inc_unchecked(&vcc->stats->rx);
21050           cell += ATM_CELL_PAYLOAD;
21051        }
21052
21053 @@ -2152,7 +2152,7 @@ static void dequeue_rx(ns_dev *card, ns_
21054          if (iovb == NULL)
21055          {
21056             printk("nicstar%d: Out of iovec buffers.\n", card->index);
21057 -            atomic_inc(&vcc->stats->rx_drop);
21058 +            atomic_inc_unchecked(&vcc->stats->rx_drop);
21059              recycle_rx_buf(card, skb);
21060              return;
21061          }
21062 @@ -2182,7 +2182,7 @@ static void dequeue_rx(ns_dev *card, ns_
21063     else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
21064     {
21065        printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
21066 -      atomic_inc(&vcc->stats->rx_err);
21067 +      atomic_inc_unchecked(&vcc->stats->rx_err);
21068        recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
21069        NS_SKB(iovb)->iovcnt = 0;
21070        iovb->len = 0;
21071 @@ -2202,7 +2202,7 @@ static void dequeue_rx(ns_dev *card, ns_
21072           printk("nicstar%d: Expected a small buffer, and this is not one.\n",
21073                 card->index);
21074           which_list(card, skb);
21075 -         atomic_inc(&vcc->stats->rx_err);
21076 +         atomic_inc_unchecked(&vcc->stats->rx_err);
21077           recycle_rx_buf(card, skb);
21078           vc->rx_iov = NULL;
21079           recycle_iov_buf(card, iovb);
21080 @@ -2216,7 +2216,7 @@ static void dequeue_rx(ns_dev *card, ns_
21081           printk("nicstar%d: Expected a large buffer, and this is not one.\n",
21082                 card->index);
21083           which_list(card, skb);
21084 -         atomic_inc(&vcc->stats->rx_err);
21085 +         atomic_inc_unchecked(&vcc->stats->rx_err);
21086           recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
21087                                NS_SKB(iovb)->iovcnt);
21088           vc->rx_iov = NULL;
21089 @@ -2240,7 +2240,7 @@ static void dequeue_rx(ns_dev *card, ns_
21090              printk(" - PDU size mismatch.\n");
21091           else
21092              printk(".\n");
21093 -         atomic_inc(&vcc->stats->rx_err);
21094 +         atomic_inc_unchecked(&vcc->stats->rx_err);
21095           recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
21096            NS_SKB(iovb)->iovcnt);
21097          vc->rx_iov = NULL;
21098 @@ -2256,7 +2256,7 @@ static void dequeue_rx(ns_dev *card, ns_
21099           if (!atm_charge(vcc, skb->truesize))
21100           {
21101              push_rxbufs(card, skb);
21102 -            atomic_inc(&vcc->stats->rx_drop);
21103 +            atomic_inc_unchecked(&vcc->stats->rx_drop);
21104           }
21105           else
21106          {
21107 @@ -2268,7 +2268,7 @@ static void dequeue_rx(ns_dev *card, ns_
21108              ATM_SKB(skb)->vcc = vcc;
21109             __net_timestamp(skb);
21110              vcc->push(vcc, skb);
21111 -            atomic_inc(&vcc->stats->rx);
21112 +            atomic_inc_unchecked(&vcc->stats->rx);
21113           }
21114        }
21115        else if (NS_SKB(iovb)->iovcnt == 2)      /* One small plus one large buffer */
21116 @@ -2283,7 +2283,7 @@ static void dequeue_rx(ns_dev *card, ns_
21117              if (!atm_charge(vcc, sb->truesize))
21118              {
21119                 push_rxbufs(card, sb);
21120 -               atomic_inc(&vcc->stats->rx_drop);
21121 +               atomic_inc_unchecked(&vcc->stats->rx_drop);
21122              }
21123              else
21124             {
21125 @@ -2295,7 +2295,7 @@ static void dequeue_rx(ns_dev *card, ns_
21126                 ATM_SKB(sb)->vcc = vcc;
21127                __net_timestamp(sb);
21128                 vcc->push(vcc, sb);
21129 -               atomic_inc(&vcc->stats->rx);
21130 +               atomic_inc_unchecked(&vcc->stats->rx);
21131              }
21132
21133              push_rxbufs(card, skb);
21134 @@ -2306,7 +2306,7 @@ static void dequeue_rx(ns_dev *card, ns_
21135              if (!atm_charge(vcc, skb->truesize))
21136              {
21137                 push_rxbufs(card, skb);
21138 -               atomic_inc(&vcc->stats->rx_drop);
21139 +               atomic_inc_unchecked(&vcc->stats->rx_drop);
21140              }
21141              else
21142              {
21143 @@ -2320,7 +2320,7 @@ static void dequeue_rx(ns_dev *card, ns_
21144                 ATM_SKB(skb)->vcc = vcc;
21145                __net_timestamp(skb);
21146                 vcc->push(vcc, skb);
21147 -               atomic_inc(&vcc->stats->rx);
21148 +               atomic_inc_unchecked(&vcc->stats->rx);
21149              }
21150
21151              push_rxbufs(card, sb);
21152 @@ -2342,7 +2342,7 @@ static void dequeue_rx(ns_dev *card, ns_
21153              if (hb == NULL)
21154              {
21155                 printk("nicstar%d: Out of huge buffers.\n", card->index);
21156 -               atomic_inc(&vcc->stats->rx_drop);
21157 +               atomic_inc_unchecked(&vcc->stats->rx_drop);
21158                 recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
21159                                      NS_SKB(iovb)->iovcnt);
21160                 vc->rx_iov = NULL;
21161 @@ -2393,7 +2393,7 @@ static void dequeue_rx(ns_dev *card, ns_
21162              }
21163             else
21164                dev_kfree_skb_any(hb);
21165 -           atomic_inc(&vcc->stats->rx_drop);
21166 +           atomic_inc_unchecked(&vcc->stats->rx_drop);
21167           }
21168           else
21169          {
21170 @@ -2427,7 +2427,7 @@ static void dequeue_rx(ns_dev *card, ns_
21171  #endif /* NS_USE_DESTRUCTORS */
21172             __net_timestamp(hb);
21173              vcc->push(vcc, hb);
21174 -            atomic_inc(&vcc->stats->rx);
21175 +            atomic_inc_unchecked(&vcc->stats->rx);
21176           }
21177        }
21178
21179 diff -urNp linux-2.6.33/drivers/atm/solos-pci.c linux-2.6.33/drivers/atm/solos-pci.c
21180 --- linux-2.6.33/drivers/atm/solos-pci.c        2010-02-24 13:52:17.000000000 -0500
21181 +++ linux-2.6.33/drivers/atm/solos-pci.c        2010-03-07 12:23:35.993715829 -0500
21182 @@ -714,7 +714,7 @@ void solos_bh(unsigned long card_arg)
21183                                 }
21184                                 atm_charge(vcc, skb->truesize);
21185                                 vcc->push(vcc, skb);
21186 -                               atomic_inc(&vcc->stats->rx);
21187 +                               atomic_inc_unchecked(&vcc->stats->rx);
21188                                 break;
21189
21190                         case PKT_STATUS:
21191 @@ -1017,7 +1017,7 @@ static uint32_t fpga_tx(struct solos_car
21192                         vcc = SKB_CB(oldskb)->vcc;
21193
21194                         if (vcc) {
21195 -                               atomic_inc(&vcc->stats->tx);
21196 +                               atomic_inc_unchecked(&vcc->stats->tx);
21197                                 solos_pop(vcc, oldskb);
21198                         } else
21199                                 dev_kfree_skb_irq(oldskb);
21200 diff -urNp linux-2.6.33/drivers/atm/suni.c linux-2.6.33/drivers/atm/suni.c
21201 --- linux-2.6.33/drivers/atm/suni.c     2010-02-24 13:52:17.000000000 -0500
21202 +++ linux-2.6.33/drivers/atm/suni.c     2010-03-07 12:23:35.993715829 -0500
21203 @@ -49,8 +49,8 @@ static DEFINE_SPINLOCK(sunis_lock);
21204
21205
21206  #define ADD_LIMITED(s,v) \
21207 -    atomic_add((v),&stats->s); \
21208 -    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
21209 +    atomic_add_unchecked((v),&stats->s); \
21210 +    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
21211
21212
21213  static void suni_hz(unsigned long from_timer)
21214 diff -urNp linux-2.6.33/drivers/atm/uPD98402.c linux-2.6.33/drivers/atm/uPD98402.c
21215 --- linux-2.6.33/drivers/atm/uPD98402.c 2010-02-24 13:52:17.000000000 -0500
21216 +++ linux-2.6.33/drivers/atm/uPD98402.c 2010-03-07 12:23:35.993715829 -0500
21217 @@ -41,7 +41,7 @@ static int fetch_stats(struct atm_dev *d
21218         struct sonet_stats tmp;
21219         int error = 0;
21220
21221 -       atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
21222 +       atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
21223         sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
21224         if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
21225         if (zero && !error) {
21226 @@ -160,9 +160,9 @@ static int uPD98402_ioctl(struct atm_dev
21227
21228
21229  #define ADD_LIMITED(s,v) \
21230 -    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
21231 -    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
21232 -       atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
21233 +    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
21234 +    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
21235 +       atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
21236
21237
21238  static void stat_event(struct atm_dev *dev)
21239 @@ -193,7 +193,7 @@ static void uPD98402_int(struct atm_dev
21240                 if (reason & uPD98402_INT_PFM) stat_event(dev);
21241                 if (reason & uPD98402_INT_PCO) {
21242                         (void) GET(PCOCR); /* clear interrupt cause */
21243 -                       atomic_add(GET(HECCT),
21244 +                       atomic_add_unchecked(GET(HECCT),
21245                             &PRIV(dev)->sonet_stats.uncorr_hcs);
21246                 }
21247                 if ((reason & uPD98402_INT_RFO) &&
21248 @@ -221,9 +221,9 @@ static int uPD98402_start(struct atm_dev
21249         PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
21250           uPD98402_INT_LOS),PIMR); /* enable them */
21251         (void) fetch_stats(dev,NULL,1); /* clear kernel counters */
21252 -       atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
21253 -       atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
21254 -       atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
21255 +       atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
21256 +       atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
21257 +       atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
21258         return 0;
21259  }
21260
21261 diff -urNp linux-2.6.33/drivers/atm/zatm.c linux-2.6.33/drivers/atm/zatm.c
21262 --- linux-2.6.33/drivers/atm/zatm.c     2010-02-24 13:52:17.000000000 -0500
21263 +++ linux-2.6.33/drivers/atm/zatm.c     2010-03-07 12:23:35.993715829 -0500
21264 @@ -458,7 +458,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
21265                 }
21266                 if (!size) {
21267                         dev_kfree_skb_irq(skb);
21268 -                       if (vcc) atomic_inc(&vcc->stats->rx_err);
21269 +                       if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
21270                         continue;
21271                 }
21272                 if (!atm_charge(vcc,skb->truesize)) {
21273 @@ -468,7 +468,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
21274                 skb->len = size;
21275                 ATM_SKB(skb)->vcc = vcc;
21276                 vcc->push(vcc,skb);
21277 -               atomic_inc(&vcc->stats->rx);
21278 +               atomic_inc_unchecked(&vcc->stats->rx);
21279         }
21280         zout(pos & 0xffff,MTA(mbx));
21281  #if 0 /* probably a stupid idea */
21282 @@ -732,7 +732,7 @@ if (*ZATM_PRV_DSC(skb) != (uPD98401_TXPD
21283                         skb_queue_head(&zatm_vcc->backlog,skb);
21284                         break;
21285                 }
21286 -       atomic_inc(&vcc->stats->tx);
21287 +       atomic_inc_unchecked(&vcc->stats->tx);
21288         wake_up(&zatm_vcc->tx_wait);
21289  }
21290
21291 diff -urNp linux-2.6.33/drivers/base/bus.c linux-2.6.33/drivers/base/bus.c
21292 --- linux-2.6.33/drivers/base/bus.c     2010-02-24 13:52:17.000000000 -0500
21293 +++ linux-2.6.33/drivers/base/bus.c     2010-03-07 12:23:35.993715829 -0500
21294 @@ -70,7 +70,7 @@ static ssize_t drv_attr_store(struct kob
21295         return ret;
21296  }
21297
21298 -static struct sysfs_ops driver_sysfs_ops = {
21299 +static const struct sysfs_ops driver_sysfs_ops = {
21300         .show   = drv_attr_show,
21301         .store  = drv_attr_store,
21302  };
21303 @@ -115,7 +115,7 @@ static ssize_t bus_attr_store(struct kob
21304         return ret;
21305  }
21306
21307 -static struct sysfs_ops bus_sysfs_ops = {
21308 +static const struct sysfs_ops bus_sysfs_ops = {
21309         .show   = bus_attr_show,
21310         .store  = bus_attr_store,
21311  };
21312 @@ -154,7 +154,7 @@ static int bus_uevent_filter(struct kset
21313         return 0;
21314  }
21315
21316 -static struct kset_uevent_ops bus_uevent_ops = {
21317 +static const struct kset_uevent_ops bus_uevent_ops = {
21318         .filter = bus_uevent_filter,
21319  };
21320
21321 diff -urNp linux-2.6.33/drivers/base/class.c linux-2.6.33/drivers/base/class.c
21322 --- linux-2.6.33/drivers/base/class.c   2010-02-24 13:52:17.000000000 -0500
21323 +++ linux-2.6.33/drivers/base/class.c   2010-03-07 12:23:35.993715829 -0500
21324 @@ -63,7 +63,7 @@ static void class_release(struct kobject
21325         kfree(cp);
21326  }
21327
21328 -static struct sysfs_ops class_sysfs_ops = {
21329 +static const struct sysfs_ops class_sysfs_ops = {
21330         .show   = class_attr_show,
21331         .store  = class_attr_store,
21332  };
21333 diff -urNp linux-2.6.33/drivers/base/core.c linux-2.6.33/drivers/base/core.c
21334 --- linux-2.6.33/drivers/base/core.c    2010-02-24 13:52:17.000000000 -0500
21335 +++ linux-2.6.33/drivers/base/core.c    2010-03-07 12:23:35.993715829 -0500
21336 @@ -100,7 +100,7 @@ static ssize_t dev_attr_store(struct kob
21337         return ret;
21338  }
21339
21340 -static struct sysfs_ops dev_sysfs_ops = {
21341 +static const struct sysfs_ops dev_sysfs_ops = {
21342         .show   = dev_attr_show,
21343         .store  = dev_attr_store,
21344  };
21345 @@ -252,7 +252,7 @@ static int dev_uevent(struct kset *kset,
21346         return retval;
21347  }
21348
21349 -static struct kset_uevent_ops device_uevent_ops = {
21350 +static const struct kset_uevent_ops device_uevent_ops = {
21351         .filter =       dev_uevent_filter,
21352         .name =         dev_uevent_name,
21353         .uevent =       dev_uevent,
21354 diff -urNp linux-2.6.33/drivers/base/memory.c linux-2.6.33/drivers/base/memory.c
21355 --- linux-2.6.33/drivers/base/memory.c  2010-02-24 13:52:17.000000000 -0500
21356 +++ linux-2.6.33/drivers/base/memory.c  2010-03-07 12:23:35.993715829 -0500
21357 @@ -44,7 +44,7 @@ static int memory_uevent(struct kset *ks
21358         return retval;
21359  }
21360
21361 -static struct kset_uevent_ops memory_uevent_ops = {
21362 +static const struct kset_uevent_ops memory_uevent_ops = {
21363         .name           = memory_uevent_name,
21364         .uevent         = memory_uevent,
21365  };
21366 diff -urNp linux-2.6.33/drivers/base/sys.c linux-2.6.33/drivers/base/sys.c
21367 --- linux-2.6.33/drivers/base/sys.c     2010-02-24 13:52:17.000000000 -0500
21368 +++ linux-2.6.33/drivers/base/sys.c     2010-03-07 12:23:35.993715829 -0500
21369 @@ -54,7 +54,7 @@ sysdev_store(struct kobject *kobj, struc
21370         return -EIO;
21371  }
21372
21373 -static struct sysfs_ops sysfs_ops = {
21374 +static const struct sysfs_ops sysfs_ops = {
21375         .show   = sysdev_show,
21376         .store  = sysdev_store,
21377  };
21378 @@ -104,7 +104,7 @@ static ssize_t sysdev_class_store(struct
21379         return -EIO;
21380  }
21381
21382 -static struct sysfs_ops sysfs_class_ops = {
21383 +static const struct sysfs_ops sysfs_class_ops = {
21384         .show   = sysdev_class_show,
21385         .store  = sysdev_class_store,
21386  };
21387 diff -urNp linux-2.6.33/drivers/block/pktcdvd.c linux-2.6.33/drivers/block/pktcdvd.c
21388 --- linux-2.6.33/drivers/block/pktcdvd.c        2010-02-24 13:52:17.000000000 -0500
21389 +++ linux-2.6.33/drivers/block/pktcdvd.c        2010-03-07 12:23:35.993715829 -0500
21390 @@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
21391         return len;
21392  }
21393
21394 -static struct sysfs_ops kobj_pkt_ops = {
21395 +static const struct sysfs_ops kobj_pkt_ops = {
21396         .show = kobj_pkt_show,
21397         .store = kobj_pkt_store
21398  };
21399 diff -urNp linux-2.6.33/drivers/char/agp/frontend.c linux-2.6.33/drivers/char/agp/frontend.c
21400 --- linux-2.6.33/drivers/char/agp/frontend.c    2010-02-24 13:52:17.000000000 -0500
21401 +++ linux-2.6.33/drivers/char/agp/frontend.c    2010-03-07 12:23:35.993715829 -0500
21402 @@ -818,7 +818,7 @@ static int agpioc_reserve_wrap(struct ag
21403         if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
21404                 return -EFAULT;
21405
21406 -       if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
21407 +       if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
21408                 return -EFAULT;
21409
21410         client = agp_find_client_by_pid(reserve.pid);
21411 diff -urNp linux-2.6.33/drivers/char/agp/intel-agp.c linux-2.6.33/drivers/char/agp/intel-agp.c
21412 --- linux-2.6.33/drivers/char/agp/intel-agp.c   2010-02-24 13:52:17.000000000 -0500
21413 +++ linux-2.6.33/drivers/char/agp/intel-agp.c   2010-03-07 12:23:35.997708726 -0500
21414 @@ -2575,7 +2575,7 @@ static struct pci_device_id agp_intel_pc
21415         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_M_HB),
21416         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MA_HB),
21417         ID(PCI_DEVICE_ID_INTEL_IRONLAKE_MC2_HB),
21418 -       { }
21419 +       { 0, 0, 0, 0, 0, 0, 0 }
21420  };
21421
21422  MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
21423 diff -urNp linux-2.6.33/drivers/char/hpet.c linux-2.6.33/drivers/char/hpet.c
21424 --- linux-2.6.33/drivers/char/hpet.c    2010-02-24 13:52:17.000000000 -0500
21425 +++ linux-2.6.33/drivers/char/hpet.c    2010-03-07 12:23:35.997708726 -0500
21426 @@ -995,7 +995,7 @@ static struct acpi_driver hpet_acpi_driv
21427                 },
21428  };
21429
21430 -static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
21431 +static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
21432
21433  static int __init hpet_init(void)
21434  {
21435 diff -urNp linux-2.6.33/drivers/char/hvc_beat.c linux-2.6.33/drivers/char/hvc_beat.c
21436 --- linux-2.6.33/drivers/char/hvc_beat.c        2010-02-24 13:52:17.000000000 -0500
21437 +++ linux-2.6.33/drivers/char/hvc_beat.c        2010-03-07 12:23:35.997708726 -0500
21438 @@ -84,7 +84,7 @@ static int hvc_beat_put_chars(uint32_t v
21439         return cnt;
21440  }
21441
21442 -static struct hv_ops hvc_beat_get_put_ops = {
21443 +static const struct hv_ops hvc_beat_get_put_ops = {
21444         .get_chars = hvc_beat_get_chars,
21445         .put_chars = hvc_beat_put_chars,
21446  };
21447 diff -urNp linux-2.6.33/drivers/char/hvc_console.c linux-2.6.33/drivers/char/hvc_console.c
21448 --- linux-2.6.33/drivers/char/hvc_console.c     2010-02-24 13:52:17.000000000 -0500
21449 +++ linux-2.6.33/drivers/char/hvc_console.c     2010-03-07 12:23:35.997708726 -0500
21450 @@ -125,7 +125,7 @@ static struct hvc_struct *hvc_get_by_ind
21451   * console interfaces but can still be used as a tty device.  This has to be
21452   * static because kmalloc will not work during early console init.
21453   */
21454 -static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
21455 +static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
21456  static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
21457         {[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
21458
21459 @@ -247,7 +247,7 @@ static void destroy_hvc_struct(struct kr
21460   * vty adapters do NOT get an hvc_instantiate() callback since they
21461   * appear after early console init.
21462   */
21463 -int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
21464 +int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
21465  {
21466         struct hvc_struct *hp;
21467
21468 @@ -749,7 +749,7 @@ static const struct tty_operations hvc_o
21469  };
21470
21471  struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
21472 -                                       struct hv_ops *ops, int outbuf_size)
21473 +                                       const struct hv_ops *ops, int outbuf_size)
21474  {
21475         struct hvc_struct *hp;
21476         int i;
21477 diff -urNp linux-2.6.33/drivers/char/hvc_console.h linux-2.6.33/drivers/char/hvc_console.h
21478 --- linux-2.6.33/drivers/char/hvc_console.h     2010-02-24 13:52:17.000000000 -0500
21479 +++ linux-2.6.33/drivers/char/hvc_console.h     2010-03-07 12:23:35.997708726 -0500
21480 @@ -55,7 +55,7 @@ struct hvc_struct {
21481         int outbuf_size;
21482         int n_outbuf;
21483         uint32_t vtermno;
21484 -       struct hv_ops *ops;
21485 +       const struct hv_ops *ops;
21486         int irq_requested;
21487         int data;
21488         struct winsize ws;
21489 @@ -76,11 +76,11 @@ struct hv_ops {
21490  };
21491
21492  /* Register a vterm and a slot index for use as a console (console_init) */
21493 -extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
21494 +extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
21495
21496  /* register a vterm for hvc tty operation (module_init or hotplug add) */
21497  extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
21498 -                               struct hv_ops *ops, int outbuf_size);
21499 +                               const struct hv_ops *ops, int outbuf_size);
21500  /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
21501  extern int hvc_remove(struct hvc_struct *hp);
21502
21503 diff -urNp linux-2.6.33/drivers/char/hvc_iseries.c linux-2.6.33/drivers/char/hvc_iseries.c
21504 --- linux-2.6.33/drivers/char/hvc_iseries.c     2010-02-24 13:52:17.000000000 -0500
21505 +++ linux-2.6.33/drivers/char/hvc_iseries.c     2010-03-07 12:23:35.997708726 -0500
21506 @@ -197,7 +197,7 @@ done:
21507         return sent;
21508  }
21509
21510 -static struct hv_ops hvc_get_put_ops = {
21511 +static const struct hv_ops hvc_get_put_ops = {
21512         .get_chars = get_chars,
21513         .put_chars = put_chars,
21514         .notifier_add = notifier_add_irq,
21515 diff -urNp linux-2.6.33/drivers/char/hvc_iucv.c linux-2.6.33/drivers/char/hvc_iucv.c
21516 --- linux-2.6.33/drivers/char/hvc_iucv.c        2010-02-24 13:52:17.000000000 -0500
21517 +++ linux-2.6.33/drivers/char/hvc_iucv.c        2010-03-07 12:23:35.997708726 -0500
21518 @@ -922,7 +922,7 @@ static int hvc_iucv_pm_restore_thaw(stru
21519
21520
21521  /* HVC operations */
21522 -static struct hv_ops hvc_iucv_ops = {
21523 +static const struct hv_ops hvc_iucv_ops = {
21524         .get_chars = hvc_iucv_get_chars,
21525         .put_chars = hvc_iucv_put_chars,
21526         .notifier_add = hvc_iucv_notifier_add,
21527 diff -urNp linux-2.6.33/drivers/char/hvc_rtas.c linux-2.6.33/drivers/char/hvc_rtas.c
21528 --- linux-2.6.33/drivers/char/hvc_rtas.c        2010-02-24 13:52:17.000000000 -0500
21529 +++ linux-2.6.33/drivers/char/hvc_rtas.c        2010-03-07 12:23:35.997708726 -0500
21530 @@ -71,7 +71,7 @@ static int hvc_rtas_read_console(uint32_
21531         return i;
21532  }
21533
21534 -static struct hv_ops hvc_rtas_get_put_ops = {
21535 +static const struct hv_ops hvc_rtas_get_put_ops = {
21536         .get_chars = hvc_rtas_read_console,
21537         .put_chars = hvc_rtas_write_console,
21538  };
21539 diff -urNp linux-2.6.33/drivers/char/hvcs.c linux-2.6.33/drivers/char/hvcs.c
21540 --- linux-2.6.33/drivers/char/hvcs.c    2010-02-24 13:52:17.000000000 -0500
21541 +++ linux-2.6.33/drivers/char/hvcs.c    2010-03-07 12:23:35.997708726 -0500
21542 @@ -269,7 +269,7 @@ struct hvcs_struct {
21543         unsigned int index;
21544
21545         struct tty_struct *tty;
21546 -       int open_count;
21547 +       atomic_t open_count;
21548
21549         /*
21550          * Used to tell the driver kernel_thread what operations need to take
21551 @@ -419,7 +419,7 @@ static ssize_t hvcs_vterm_state_store(st
21552
21553         spin_lock_irqsave(&hvcsd->lock, flags);
21554
21555 -       if (hvcsd->open_count > 0) {
21556 +       if (atomic_read(&hvcsd->open_count) > 0) {
21557                 spin_unlock_irqrestore(&hvcsd->lock, flags);
21558                 printk(KERN_INFO "HVCS: vterm state unchanged.  "
21559                                 "The hvcs device node is still in use.\n");
21560 @@ -1135,7 +1135,7 @@ static int hvcs_open(struct tty_struct *
21561                 if ((retval = hvcs_partner_connect(hvcsd)))
21562                         goto error_release;
21563
21564 -       hvcsd->open_count = 1;
21565 +       atomic_set(&hvcsd->open_count, 1);
21566         hvcsd->tty = tty;
21567         tty->driver_data = hvcsd;
21568
21569 @@ -1169,7 +1169,7 @@ fast_open:
21570
21571         spin_lock_irqsave(&hvcsd->lock, flags);
21572         kref_get(&hvcsd->kref);
21573 -       hvcsd->open_count++;
21574 +       atomic_inc(&hvcsd->open_count);
21575         hvcsd->todo_mask |= HVCS_SCHED_READ;
21576         spin_unlock_irqrestore(&hvcsd->lock, flags);
21577
21578 @@ -1213,7 +1213,7 @@ static void hvcs_close(struct tty_struct
21579         hvcsd = tty->driver_data;
21580
21581         spin_lock_irqsave(&hvcsd->lock, flags);
21582 -       if (--hvcsd->open_count == 0) {
21583 +       if (atomic_dec_and_test(&hvcsd->open_count)) {
21584
21585                 vio_disable_interrupts(hvcsd->vdev);
21586
21587 @@ -1239,10 +1239,10 @@ static void hvcs_close(struct tty_struct
21588                 free_irq(irq, hvcsd);
21589                 kref_put(&hvcsd->kref, destroy_hvcs_struct);
21590                 return;
21591 -       } else if (hvcsd->open_count < 0) {
21592 +       } else if (atomic_read(&hvcsd->open_count) < 0) {
21593                 printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
21594                                 " is missmanaged.\n",
21595 -               hvcsd->vdev->unit_address, hvcsd->open_count);
21596 +               hvcsd->vdev->unit_address, atomic_read(&hvcsd->open_count));
21597         }
21598
21599         spin_unlock_irqrestore(&hvcsd->lock, flags);
21600 @@ -1258,7 +1258,7 @@ static void hvcs_hangup(struct tty_struc
21601
21602         spin_lock_irqsave(&hvcsd->lock, flags);
21603         /* Preserve this so that we know how many kref refs to put */
21604 -       temp_open_count = hvcsd->open_count;
21605 +       temp_open_count = atomic_read(&hvcsd->open_count);
21606
21607         /*
21608          * Don't kref put inside the spinlock because the destruction
21609 @@ -1273,7 +1273,7 @@ static void hvcs_hangup(struct tty_struc
21610         hvcsd->tty->driver_data = NULL;
21611         hvcsd->tty = NULL;
21612
21613 -       hvcsd->open_count = 0;
21614 +       atomic_set(&hvcsd->open_count, 0);
21615
21616         /* This will drop any buffered data on the floor which is OK in a hangup
21617          * scenario. */
21618 @@ -1344,7 +1344,7 @@ static int hvcs_write(struct tty_struct
21619          * the middle of a write operation?  This is a crummy place to do this
21620          * but we want to keep it all in the spinlock.
21621          */
21622 -       if (hvcsd->open_count <= 0) {
21623 +       if (atomic_read(&hvcsd->open_count) <= 0) {
21624                 spin_unlock_irqrestore(&hvcsd->lock, flags);
21625                 return -ENODEV;
21626         }
21627 @@ -1418,7 +1418,7 @@ static int hvcs_write_room(struct tty_st
21628  {
21629         struct hvcs_struct *hvcsd = tty->driver_data;
21630
21631 -       if (!hvcsd || hvcsd->open_count <= 0)
21632 +       if (!hvcsd || atomic_read(&hvcsd->open_count) <= 0)
21633                 return 0;
21634
21635         return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
21636 diff -urNp linux-2.6.33/drivers/char/hvc_udbg.c linux-2.6.33/drivers/char/hvc_udbg.c
21637 --- linux-2.6.33/drivers/char/hvc_udbg.c        2010-02-24 13:52:17.000000000 -0500
21638 +++ linux-2.6.33/drivers/char/hvc_udbg.c        2010-03-07 12:23:35.997708726 -0500
21639 @@ -58,7 +58,7 @@ static int hvc_udbg_get(uint32_t vtermno
21640         return i;
21641  }
21642
21643 -static struct hv_ops hvc_udbg_ops = {
21644 +static const struct hv_ops hvc_udbg_ops = {
21645         .get_chars = hvc_udbg_get,
21646         .put_chars = hvc_udbg_put,
21647  };
21648 diff -urNp linux-2.6.33/drivers/char/hvc_vio.c linux-2.6.33/drivers/char/hvc_vio.c
21649 --- linux-2.6.33/drivers/char/hvc_vio.c 2010-02-24 13:52:17.000000000 -0500
21650 +++ linux-2.6.33/drivers/char/hvc_vio.c 2010-03-07 12:23:35.997708726 -0500
21651 @@ -77,7 +77,7 @@ static int filtered_get_chars(uint32_t v
21652         return got;
21653  }
21654
21655 -static struct hv_ops hvc_get_put_ops = {
21656 +static const struct hv_ops hvc_get_put_ops = {
21657         .get_chars = filtered_get_chars,
21658         .put_chars = hvc_put_chars,
21659         .notifier_add = notifier_add_irq,
21660 diff -urNp linux-2.6.33/drivers/char/hvc_xen.c linux-2.6.33/drivers/char/hvc_xen.c
21661 --- linux-2.6.33/drivers/char/hvc_xen.c 2010-02-24 13:52:17.000000000 -0500
21662 +++ linux-2.6.33/drivers/char/hvc_xen.c 2010-03-07 12:23:35.997708726 -0500
21663 @@ -122,7 +122,7 @@ static int read_console(uint32_t vtermno
21664         return recv;
21665  }
21666
21667 -static struct hv_ops hvc_ops = {
21668 +static const struct hv_ops hvc_ops = {
21669         .get_chars = read_console,
21670         .put_chars = write_console,
21671         .notifier_add = notifier_add_irq,
21672 diff -urNp linux-2.6.33/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.33/drivers/char/ipmi/ipmi_msghandler.c
21673 --- linux-2.6.33/drivers/char/ipmi/ipmi_msghandler.c    2010-02-24 13:52:17.000000000 -0500
21674 +++ linux-2.6.33/drivers/char/ipmi/ipmi_msghandler.c    2010-03-07 12:23:35.997708726 -0500
21675 @@ -414,7 +414,7 @@ struct ipmi_smi {
21676         struct proc_dir_entry *proc_dir;
21677         char                  proc_dir_name[10];
21678
21679 -       atomic_t stats[IPMI_NUM_STATS];
21680 +       atomic_unchecked_t stats[IPMI_NUM_STATS];
21681
21682         /*
21683          * run_to_completion duplicate of smb_info, smi_info
21684 @@ -447,9 +447,9 @@ static DEFINE_MUTEX(smi_watchers_mutex);
21685
21686
21687  #define ipmi_inc_stat(intf, stat) \
21688 -       atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
21689 +       atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
21690  #define ipmi_get_stat(intf, stat) \
21691 -       ((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
21692 +       ((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
21693
21694  static int is_lan_addr(struct ipmi_addr *addr)
21695  {
21696 @@ -2808,7 +2808,7 @@ int ipmi_register_smi(struct ipmi_smi_ha
21697         INIT_LIST_HEAD(&intf->cmd_rcvrs);
21698         init_waitqueue_head(&intf->waitq);
21699         for (i = 0; i < IPMI_NUM_STATS; i++)
21700 -               atomic_set(&intf->stats[i], 0);
21701 +               atomic_set_unchecked(&intf->stats[i], 0);
21702
21703         intf->proc_dir = NULL;
21704
21705 diff -urNp linux-2.6.33/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.33/drivers/char/ipmi/ipmi_si_intf.c
21706 --- linux-2.6.33/drivers/char/ipmi/ipmi_si_intf.c       2010-02-24 13:52:17.000000000 -0500
21707 +++ linux-2.6.33/drivers/char/ipmi/ipmi_si_intf.c       2010-03-07 12:23:36.001707082 -0500
21708 @@ -278,7 +278,7 @@ struct smi_info {
21709         unsigned char slave_addr;
21710
21711         /* Counters and things for the proc filesystem. */
21712 -       atomic_t stats[SI_NUM_STATS];
21713 +       atomic_unchecked_t stats[SI_NUM_STATS];
21714
21715         struct task_struct *thread;
21716
21717 @@ -286,9 +286,9 @@ struct smi_info {
21718  };
21719
21720  #define smi_inc_stat(smi, stat) \
21721 -       atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
21722 +       atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
21723  #define smi_get_stat(smi, stat) \
21724 -       ((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
21725 +       ((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
21726
21727  #define SI_MAX_PARMS 4
21728
21729 @@ -3020,7 +3020,7 @@ static int try_smi_init(struct smi_info
21730         atomic_set(&new_smi->req_events, 0);
21731         new_smi->run_to_completion = 0;
21732         for (i = 0; i < SI_NUM_STATS; i++)
21733 -               atomic_set(&new_smi->stats[i], 0);
21734 +               atomic_set_unchecked(&new_smi->stats[i], 0);
21735
21736         new_smi->interrupt_disabled = 0;
21737         atomic_set(&new_smi->stop_operation, 0);
21738 diff -urNp linux-2.6.33/drivers/char/keyboard.c linux-2.6.33/drivers/char/keyboard.c
21739 --- linux-2.6.33/drivers/char/keyboard.c        2010-02-24 13:52:17.000000000 -0500
21740 +++ linux-2.6.33/drivers/char/keyboard.c        2010-03-07 12:23:36.001707082 -0500
21741 @@ -652,6 +652,16 @@ static void k_spec(struct vc_data *vc, u
21742              kbd->kbdmode == VC_MEDIUMRAW) &&
21743              value != KVAL(K_SAK))
21744                 return;         /* SAK is allowed even in raw mode */
21745 +
21746 +#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
21747 +       {
21748 +               void *func = fn_handler[value];
21749 +               if (func == fn_show_state || func == fn_show_ptregs ||
21750 +                   func == fn_show_mem)
21751 +                       return;
21752 +       }
21753 +#endif
21754 +
21755         fn_handler[value](vc);
21756  }
21757
21758 @@ -1405,7 +1415,7 @@ static const struct input_device_id kbd_
21759                  .evbit = { BIT_MASK(EV_SND) },
21760          },
21761
21762 -       { },    /* Terminating entry */
21763 +       { 0 },    /* Terminating entry */
21764  };
21765
21766  MODULE_DEVICE_TABLE(input, kbd_ids);
21767 diff -urNp linux-2.6.33/drivers/char/mem.c linux-2.6.33/drivers/char/mem.c
21768 --- linux-2.6.33/drivers/char/mem.c     2010-02-24 13:52:17.000000000 -0500
21769 +++ linux-2.6.33/drivers/char/mem.c     2010-03-07 12:23:36.001707082 -0500
21770 @@ -18,6 +18,7 @@
21771  #include <linux/raw.h>
21772  #include <linux/tty.h>
21773  #include <linux/capability.h>
21774 +#include <linux/security.h>
21775  #include <linux/ptrace.h>
21776  #include <linux/device.h>
21777  #include <linux/highmem.h>
21778 @@ -34,6 +35,10 @@
21779  # include <linux/efi.h>
21780  #endif
21781
21782 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
21783 +extern struct file_operations grsec_fops;
21784 +#endif
21785 +
21786  static inline unsigned long size_inside_page(unsigned long start,
21787                                              unsigned long size)
21788  {
21789 @@ -191,6 +196,11 @@ static ssize_t write_mem(struct file * f
21790         if (!valid_phys_addr_range(p, count))
21791                 return -EFAULT;
21792
21793 +#ifdef CONFIG_GRKERNSEC_KMEM
21794 +       gr_handle_mem_write();
21795 +       return -EPERM;
21796 +#endif
21797 +
21798         written = 0;
21799
21800  #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
21801 @@ -311,6 +321,11 @@ static int mmap_mem(struct file * file,
21802                                                 &vma->vm_page_prot))
21803                 return -EINVAL;
21804
21805 +#ifdef CONFIG_GRKERNSEC_KMEM
21806 +       if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
21807 +               return -EPERM;
21808 +#endif
21809 +
21810         vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
21811                                                  size,
21812                                                  vma->vm_page_prot);
21813 @@ -527,6 +542,11 @@ static ssize_t write_kmem(struct file *
21814         char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
21815         int err = 0;
21816
21817 +#ifdef CONFIG_GRKERNSEC_KMEM
21818 +       gr_handle_kmem_write();
21819 +       return -EPERM;
21820 +#endif
21821 +
21822         if (p < (unsigned long) high_memory) {
21823                 unsigned long to_write = min_t(unsigned long, count,
21824                                                (unsigned long)high_memory - p);
21825 @@ -727,6 +747,16 @@ static loff_t memory_lseek(struct file *
21826
21827  static int open_port(struct inode * inode, struct file * filp)
21828  {
21829 +#ifdef CONFIG_GRKERNSEC_KMEM
21830 +       gr_handle_open_port();
21831 +       return -EPERM;
21832 +#endif
21833 +
21834 +       return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
21835 +}
21836 +
21837 +static int open_mem(struct inode * inode, struct file * filp)
21838 +{
21839         return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
21840  }
21841
21842 @@ -734,7 +764,6 @@ static int open_port(struct inode * inod
21843  #define full_lseek      null_lseek
21844  #define write_zero     write_null
21845  #define read_full       read_zero
21846 -#define open_mem       open_port
21847  #define open_kmem      open_mem
21848  #define open_oldmem    open_mem
21849
21850 @@ -850,6 +879,9 @@ static const struct memdev {
21851  #ifdef CONFIG_CRASH_DUMP
21852         [12] = { "oldmem", 0, &oldmem_fops, NULL },
21853  #endif
21854 +#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
21855 +       [13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
21856 +#endif
21857  };
21858
21859  static int memory_open(struct inode *inode, struct file *filp)
21860 diff -urNp linux-2.6.33/drivers/char/nvram.c linux-2.6.33/drivers/char/nvram.c
21861 --- linux-2.6.33/drivers/char/nvram.c   2010-02-24 13:52:17.000000000 -0500
21862 +++ linux-2.6.33/drivers/char/nvram.c   2010-03-07 12:23:36.001707082 -0500
21863 @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
21864
21865         spin_unlock_irq(&rtc_lock);
21866
21867 -       if (copy_to_user(buf, contents, tmp - contents))
21868 +       if (tmp - contents > sizeof(contents) || copy_to_user(buf, contents, tmp - contents))
21869                 return -EFAULT;
21870
21871         *ppos = i;
21872 @@ -434,7 +434,10 @@ static const struct file_operations nvra
21873  static struct miscdevice nvram_dev = {
21874         NVRAM_MINOR,
21875         "nvram",
21876 -       &nvram_fops
21877 +       &nvram_fops,
21878 +       {NULL, NULL},
21879 +       NULL,
21880 +       NULL
21881  };
21882
21883  static int __init nvram_init(void)
21884 diff -urNp linux-2.6.33/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.33/drivers/char/pcmcia/ipwireless/tty.c
21885 --- linux-2.6.33/drivers/char/pcmcia/ipwireless/tty.c   2010-02-24 13:52:17.000000000 -0500
21886 +++ linux-2.6.33/drivers/char/pcmcia/ipwireless/tty.c   2010-03-07 12:23:36.001707082 -0500
21887 @@ -51,7 +51,7 @@ struct ipw_tty {
21888         int tty_type;
21889         struct ipw_network *network;
21890         struct tty_struct *linux_tty;
21891 -       int open_count;
21892 +       atomic_t open_count;
21893         unsigned int control_lines;
21894         struct mutex ipw_tty_mutex;
21895         int tx_bytes_queued;
21896 @@ -127,10 +127,10 @@ static int ipw_open(struct tty_struct *l
21897                 mutex_unlock(&tty->ipw_tty_mutex);
21898                 return -ENODEV;
21899         }
21900 -       if (tty->open_count == 0)
21901 +       if (atomic_read(&tty->open_count) == 0)
21902                 tty->tx_bytes_queued = 0;
21903
21904 -       tty->open_count++;
21905 +       atomic_inc(&tty->open_count);
21906
21907         tty->linux_tty = linux_tty;
21908         linux_tty->driver_data = tty;
21909 @@ -146,9 +146,7 @@ static int ipw_open(struct tty_struct *l
21910
21911  static void do_ipw_close(struct ipw_tty *tty)
21912  {
21913 -       tty->open_count--;
21914 -
21915 -       if (tty->open_count == 0) {
21916 +       if (atomic_dec_return(&tty->open_count) == 0) {
21917                 struct tty_struct *linux_tty = tty->linux_tty;
21918
21919                 if (linux_tty != NULL) {
21920 @@ -169,7 +167,7 @@ static void ipw_hangup(struct tty_struct
21921                 return;
21922
21923         mutex_lock(&tty->ipw_tty_mutex);
21924 -       if (tty->open_count == 0) {
21925 +       if (atomic_read(&tty->open_count) == 0) {
21926                 mutex_unlock(&tty->ipw_tty_mutex);
21927                 return;
21928         }
21929 @@ -198,7 +196,7 @@ void ipwireless_tty_received(struct ipw_
21930                 return;
21931         }
21932
21933 -       if (!tty->open_count) {
21934 +       if (!atomic_read(&tty->open_count)) {
21935                 mutex_unlock(&tty->ipw_tty_mutex);
21936                 return;
21937         }
21938 @@ -240,7 +238,7 @@ static int ipw_write(struct tty_struct *
21939                 return -ENODEV;
21940
21941         mutex_lock(&tty->ipw_tty_mutex);
21942 -       if (!tty->open_count) {
21943 +       if (!atomic_read(&tty->open_count)) {
21944                 mutex_unlock(&tty->ipw_tty_mutex);
21945                 return -EINVAL;
21946         }
21947 @@ -280,7 +278,7 @@ static int ipw_write_room(struct tty_str
21948         if (!tty)
21949                 return -ENODEV;
21950
21951 -       if (!tty->open_count)
21952 +       if (!atomic_read(&tty->open_count))
21953                 return -EINVAL;
21954
21955         room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
21956 @@ -322,7 +320,7 @@ static int ipw_chars_in_buffer(struct tt
21957         if (!tty)
21958                 return 0;
21959
21960 -       if (!tty->open_count)
21961 +       if (!atomic_read(&tty->open_count))
21962                 return 0;
21963
21964         return tty->tx_bytes_queued;
21965 @@ -403,7 +401,7 @@ static int ipw_tiocmget(struct tty_struc
21966         if (!tty)
21967                 return -ENODEV;
21968
21969 -       if (!tty->open_count)
21970 +       if (!atomic_read(&tty->open_count))
21971                 return -EINVAL;
21972
21973         return get_control_lines(tty);
21974 @@ -419,7 +417,7 @@ ipw_tiocmset(struct tty_struct *linux_tt
21975         if (!tty)
21976                 return -ENODEV;
21977
21978 -       if (!tty->open_count)
21979 +       if (!atomic_read(&tty->open_count))
21980                 return -EINVAL;
21981
21982         return set_control_lines(tty, set, clear);
21983 @@ -433,7 +431,7 @@ static int ipw_ioctl(struct tty_struct *
21984         if (!tty)
21985                 return -ENODEV;
21986
21987 -       if (!tty->open_count)
21988 +       if (!atomic_read(&tty->open_count))
21989                 return -EINVAL;
21990
21991         /* FIXME: Exactly how is the tty object locked here .. */
21992 @@ -591,7 +589,7 @@ void ipwireless_tty_free(struct ipw_tty
21993                                    against a parallel ioctl etc */
21994                                 mutex_lock(&ttyj->ipw_tty_mutex);
21995                         }
21996 -                       while (ttyj->open_count)
21997 +                       while (atomic_read(&ttyj->open_count))
21998                                 do_ipw_close(ttyj);
21999                         ipwireless_disassociate_network_ttys(network,
22000                                                              ttyj->channel_idx);
22001 diff -urNp linux-2.6.33/drivers/char/pty.c linux-2.6.33/drivers/char/pty.c
22002 --- linux-2.6.33/drivers/char/pty.c     2010-02-24 13:52:17.000000000 -0500
22003 +++ linux-2.6.33/drivers/char/pty.c     2010-03-07 12:23:36.001707082 -0500
22004 @@ -676,7 +676,18 @@ static int ptmx_open(struct inode *inode
22005         return ret;
22006  }
22007
22008 -static struct file_operations ptmx_fops;
22009 +static const struct file_operations ptmx_fops = {
22010 +       .llseek         = no_llseek,
22011 +       .read           = tty_read,
22012 +       .write          = tty_write,
22013 +       .poll           = tty_poll,
22014 +       .unlocked_ioctl = tty_ioctl,
22015 +       .compat_ioctl   = tty_compat_ioctl,
22016 +       .open           = ptmx_open,
22017 +       .release        = tty_release,
22018 +       .fasync         = tty_fasync,
22019 +};
22020 +
22021
22022  static void __init unix98_pty_init(void)
22023  {
22024 @@ -730,9 +741,6 @@ static void __init unix98_pty_init(void)
22025         register_sysctl_table(pty_root_table);
22026
22027         /* Now create the /dev/ptmx special device */
22028 -       tty_default_fops(&ptmx_fops);
22029 -       ptmx_fops.open = ptmx_open;
22030 -
22031         cdev_init(&ptmx_cdev, &ptmx_fops);
22032         if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
22033             register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
22034 diff -urNp linux-2.6.33/drivers/char/random.c linux-2.6.33/drivers/char/random.c
22035 --- linux-2.6.33/drivers/char/random.c  2010-02-24 13:52:17.000000000 -0500
22036 +++ linux-2.6.33/drivers/char/random.c  2010-03-07 12:23:36.001707082 -0500
22037 @@ -254,8 +254,13 @@
22038  /*
22039   * Configuration information
22040   */
22041 +#ifdef CONFIG_GRKERNSEC_RANDNET
22042 +#define INPUT_POOL_WORDS 512
22043 +#define OUTPUT_POOL_WORDS 128
22044 +#else
22045  #define INPUT_POOL_WORDS 128
22046  #define OUTPUT_POOL_WORDS 32
22047 +#endif
22048  #define SEC_XFER_SIZE 512
22049
22050  /*
22051 @@ -292,10 +297,17 @@ static struct poolinfo {
22052         int poolwords;
22053         int tap1, tap2, tap3, tap4, tap5;
22054  } poolinfo_table[] = {
22055 +#ifdef CONFIG_GRKERNSEC_RANDNET
22056 +       /* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
22057 +       { 512,  411,    308,    208,    104,    1 },
22058 +       /* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
22059 +       { 128,  103,    76,     51,     25,     1 },
22060 +#else
22061         /* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
22062         { 128,  103,    76,     51,     25,     1 },
22063         /* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
22064         { 32,   26,     20,     14,     7,      1 },
22065 +#endif
22066  #if 0
22067         /* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
22068         { 2048, 1638,   1231,   819,    411,    1 },
22069 @@ -903,7 +915,7 @@ static ssize_t extract_entropy_user(stru
22070
22071                 extract_buf(r, tmp);
22072                 i = min_t(int, nbytes, EXTRACT_SIZE);
22073 -               if (copy_to_user(buf, tmp, i)) {
22074 +               if (i > sizeof(tmp) || copy_to_user(buf, tmp, i)) {
22075                         ret = -EFAULT;
22076                         break;
22077                 }
22078 @@ -1209,7 +1221,7 @@ EXPORT_SYMBOL(generate_random_uuid);
22079  #include <linux/sysctl.h>
22080
22081  static int min_read_thresh = 8, min_write_thresh;
22082 -static int max_read_thresh = INPUT_POOL_WORDS * 32;
22083 +static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
22084  static int max_write_thresh = INPUT_POOL_WORDS * 32;
22085  static char sysctl_bootid[16];
22086
22087 diff -urNp linux-2.6.33/drivers/char/sonypi.c linux-2.6.33/drivers/char/sonypi.c
22088 --- linux-2.6.33/drivers/char/sonypi.c  2010-02-24 13:52:17.000000000 -0500
22089 +++ linux-2.6.33/drivers/char/sonypi.c  2010-03-07 12:23:36.001707082 -0500
22090 @@ -490,7 +490,7 @@ static struct sonypi_device {
22091         spinlock_t fifo_lock;
22092         wait_queue_head_t fifo_proc_list;
22093         struct fasync_struct *fifo_async;
22094 -       int open_count;
22095 +       atomic_t open_count;
22096         int model;
22097         struct input_dev *input_jog_dev;
22098         struct input_dev *input_key_dev;
22099 @@ -897,7 +897,7 @@ static int sonypi_misc_fasync(int fd, st
22100  static int sonypi_misc_release(struct inode *inode, struct file *file)
22101  {
22102         mutex_lock(&sonypi_device.lock);
22103 -       sonypi_device.open_count--;
22104 +       atomic_dec(&sonypi_device.open_count);
22105         mutex_unlock(&sonypi_device.lock);
22106         return 0;
22107  }
22108 @@ -906,9 +906,9 @@ static int sonypi_misc_open(struct inode
22109  {
22110         mutex_lock(&sonypi_device.lock);
22111         /* Flush input queue on first open */
22112 -       if (!sonypi_device.open_count)
22113 +       if (!atomic_read(&sonypi_device.open_count))
22114                 kfifo_reset(&sonypi_device.fifo);
22115 -       sonypi_device.open_count++;
22116 +       atomic_inc(&sonypi_device.open_count);
22117         mutex_unlock(&sonypi_device.lock);
22118
22119         return 0;
22120 diff -urNp linux-2.6.33/drivers/char/tpm/tpm_bios.c linux-2.6.33/drivers/char/tpm/tpm_bios.c
22121 --- linux-2.6.33/drivers/char/tpm/tpm_bios.c    2010-02-24 13:52:17.000000000 -0500
22122 +++ linux-2.6.33/drivers/char/tpm/tpm_bios.c    2010-03-07 12:23:36.001707082 -0500
22123 @@ -172,7 +172,7 @@ static void *tpm_bios_measurements_start
22124         event = addr;
22125
22126         if ((event->event_type == 0 && event->event_size == 0) ||
22127 -           ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
22128 +           (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
22129                 return NULL;
22130
22131         return addr;
22132 @@ -197,7 +197,7 @@ static void *tpm_bios_measurements_next(
22133                 return NULL;
22134
22135         if ((event->event_type == 0 && event->event_size == 0) ||
22136 -           ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
22137 +           (event->event_size >= limit - v - sizeof(struct tcpa_event)))
22138                 return NULL;
22139
22140         (*pos)++;
22141 @@ -290,7 +290,8 @@ static int tpm_binary_bios_measurements_
22142         int i;
22143
22144         for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
22145 -               seq_putc(m, data[i]);
22146 +               if (!seq_putc(m, data[i]))
22147 +                       return -EFAULT;
22148
22149         return 0;
22150  }
22151 @@ -409,6 +410,11 @@ static int read_log(struct tpm_bios_log
22152         log->bios_event_log_end = log->bios_event_log + len;
22153
22154         virt = acpi_os_map_memory(start, len);
22155 +       if (!virt) {
22156 +               kfree(log->bios_event_log);
22157 +               log->bios_event_log = NULL;
22158 +               return -EFAULT;
22159 +       }
22160
22161         memcpy(log->bios_event_log, virt, len);
22162
22163 diff -urNp linux-2.6.33/drivers/char/tty_io.c linux-2.6.33/drivers/char/tty_io.c
22164 --- linux-2.6.33/drivers/char/tty_io.c  2010-02-24 13:52:17.000000000 -0500
22165 +++ linux-2.6.33/drivers/char/tty_io.c  2010-03-07 12:23:36.001707082 -0500
22166 @@ -136,20 +136,10 @@ LIST_HEAD(tty_drivers);                   /* linked list
22167  DEFINE_MUTEX(tty_mutex);
22168  EXPORT_SYMBOL(tty_mutex);
22169
22170 -static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
22171 -static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
22172  ssize_t redirected_tty_write(struct file *, const char __user *,
22173                                                         size_t, loff_t *);
22174 -static unsigned int tty_poll(struct file *, poll_table *);
22175  static int tty_open(struct inode *, struct file *);
22176  long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
22177 -#ifdef CONFIG_COMPAT
22178 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
22179 -                               unsigned long arg);
22180 -#else
22181 -#define tty_compat_ioctl NULL
22182 -#endif
22183 -static int tty_fasync(int fd, struct file *filp, int on);
22184  static void release_tty(struct tty_struct *tty, int idx);
22185  static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
22186  static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
22187 @@ -871,7 +861,7 @@ EXPORT_SYMBOL(start_tty);
22188   *     read calls may be outstanding in parallel.
22189   */
22190
22191 -static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
22192 +ssize_t tty_read(struct file *file, char __user *buf, size_t count,
22193                         loff_t *ppos)
22194  {
22195         int i;
22196 @@ -899,6 +889,8 @@ static ssize_t tty_read(struct file *fil
22197         return i;
22198  }
22199
22200 +EXPORT_SYMBOL(tty_read);
22201 +
22202  void tty_write_unlock(struct tty_struct *tty)
22203  {
22204         mutex_unlock(&tty->atomic_write_lock);
22205 @@ -1048,7 +1040,7 @@ void tty_write_message(struct tty_struct
22206   *     write method will not be invoked in parallel for each device.
22207   */
22208
22209 -static ssize_t tty_write(struct file *file, const char __user *buf,
22210 +ssize_t tty_write(struct file *file, const char __user *buf,
22211                                                 size_t count, loff_t *ppos)
22212  {
22213         struct tty_struct *tty;
22214 @@ -1075,6 +1067,8 @@ static ssize_t tty_write(struct file *fi
22215         return ret;
22216  }
22217
22218 +EXPORT_SYMBOL(tty_write);
22219 +
22220  ssize_t redirected_tty_write(struct file *file, const char __user *buf,
22221                                                 size_t count, loff_t *ppos)
22222  {
22223 @@ -1894,6 +1888,8 @@ got_driver:
22224
22225
22226
22227 +EXPORT_SYMBOL(tty_release);
22228 +
22229  /**
22230   *     tty_poll        -       check tty status
22231   *     @filp: file being polled
22232 @@ -1906,7 +1902,7 @@ got_driver:
22233   *     may be re-entered freely by other callers.
22234   */
22235
22236 -static unsigned int tty_poll(struct file *filp, poll_table *wait)
22237 +unsigned int tty_poll(struct file *filp, poll_table *wait)
22238  {
22239         struct tty_struct *tty;
22240         struct tty_ldisc *ld;
22241 @@ -1923,7 +1919,9 @@ static unsigned int tty_poll(struct file
22242         return ret;
22243  }
22244
22245 -static int tty_fasync(int fd, struct file *filp, int on)
22246 +EXPORT_SYMBOL(tty_poll);
22247 +
22248 +int tty_fasync(int fd, struct file *filp, int on)
22249  {
22250         struct tty_struct *tty;
22251         unsigned long flags;
22252 @@ -1967,6 +1965,8 @@ out:
22253         return retval;
22254  }
22255
22256 +EXPORT_SYMBOL(tty_fasync);
22257 +
22258  /**
22259   *     tiocsti                 -       fake input character
22260   *     @tty: tty to fake input into
22261 @@ -2599,8 +2599,10 @@ long tty_ioctl(struct file *file, unsign
22262         return retval;
22263  }
22264
22265 +EXPORT_SYMBOL(tty_ioctl);
22266 +
22267  #ifdef CONFIG_COMPAT
22268 -static long tty_compat_ioctl(struct file *file, unsigned int cmd,
22269 +long tty_compat_ioctl(struct file *file, unsigned int cmd,
22270                                 unsigned long arg)
22271  {
22272         struct inode *inode = file->f_dentry->d_inode;
22273 @@ -2624,6 +2626,9 @@ static long tty_compat_ioctl(struct file
22274
22275         return retval;
22276  }
22277 +
22278 +EXPORT_SYMBOL(tty_compat_ioctl);
22279 +
22280  #endif
22281
22282  /*
22283 @@ -3067,11 +3072,6 @@ struct tty_struct *get_current_tty(void)
22284  }
22285  EXPORT_SYMBOL_GPL(get_current_tty);
22286
22287 -void tty_default_fops(struct file_operations *fops)
22288 -{
22289 -       *fops = tty_fops;
22290 -}
22291 -
22292  /*
22293   * Initialize the console device. This is called *early*, so
22294   * we can't necessarily depend on lots of kernel help here.
22295 diff -urNp linux-2.6.33/drivers/char/tty_ldisc.c linux-2.6.33/drivers/char/tty_ldisc.c
22296 --- linux-2.6.33/drivers/char/tty_ldisc.c       2010-02-24 13:52:17.000000000 -0500
22297 +++ linux-2.6.33/drivers/char/tty_ldisc.c       2010-03-07 12:23:36.001707082 -0500
22298 @@ -75,7 +75,7 @@ static void put_ldisc(struct tty_ldisc *
22299         if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
22300                 struct tty_ldisc_ops *ldo = ld->ops;
22301
22302 -               ldo->refcount--;
22303 +               atomic_dec(&ldo->refcount);
22304                 module_put(ldo->owner);
22305                 spin_unlock_irqrestore(&tty_ldisc_lock, flags);
22306
22307 @@ -109,7 +109,7 @@ int tty_register_ldisc(int disc, struct
22308         spin_lock_irqsave(&tty_ldisc_lock, flags);
22309         tty_ldiscs[disc] = new_ldisc;
22310         new_ldisc->num = disc;
22311 -       new_ldisc->refcount = 0;
22312 +       atomic_set(&new_ldisc->refcount, 0);
22313         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
22314
22315         return ret;
22316 @@ -137,7 +137,7 @@ int tty_unregister_ldisc(int disc)
22317                 return -EINVAL;
22318
22319         spin_lock_irqsave(&tty_ldisc_lock, flags);
22320 -       if (tty_ldiscs[disc]->refcount)
22321 +       if (atomic_read(&tty_ldiscs[disc]->refcount))
22322                 ret = -EBUSY;
22323         else
22324                 tty_ldiscs[disc] = NULL;
22325 @@ -158,7 +158,7 @@ static struct tty_ldisc_ops *get_ldops(i
22326         if (ldops) {
22327                 ret = ERR_PTR(-EAGAIN);
22328                 if (try_module_get(ldops->owner)) {
22329 -                       ldops->refcount++;
22330 +                       atomic_inc(&ldops->refcount);
22331                         ret = ldops;
22332                 }
22333         }
22334 @@ -171,7 +171,7 @@ static void put_ldops(struct tty_ldisc_o
22335         unsigned long flags;
22336
22337         spin_lock_irqsave(&tty_ldisc_lock, flags);
22338 -       ldops->refcount--;
22339 +       atomic_dec(&ldops->refcount);
22340         module_put(ldops->owner);
22341         spin_unlock_irqrestore(&tty_ldisc_lock, flags);
22342  }
22343 diff -urNp linux-2.6.33/drivers/char/virtio_console.c linux-2.6.33/drivers/char/virtio_console.c
22344 --- linux-2.6.33/drivers/char/virtio_console.c  2010-02-24 13:52:17.000000000 -0500
22345 +++ linux-2.6.33/drivers/char/virtio_console.c  2010-03-07 12:23:36.001707082 -0500
22346 @@ -44,6 +44,7 @@ static unsigned int in_len;
22347  static char *in, *inbuf;
22348
22349  /* The operations for our console. */
22350 +/* cannot be const */
22351  static struct hv_ops virtio_cons;
22352
22353  /* The hvc device */
22354 diff -urNp linux-2.6.33/drivers/char/vt_ioctl.c linux-2.6.33/drivers/char/vt_ioctl.c
22355 --- linux-2.6.33/drivers/char/vt_ioctl.c        2010-02-24 13:52:17.000000000 -0500
22356 +++ linux-2.6.33/drivers/char/vt_ioctl.c        2010-03-07 12:23:36.005705305 -0500
22357 @@ -226,6 +226,12 @@ do_kdsk_ioctl(int cmd, struct kbentry __
22358         case KDSKBENT:
22359                 if (!perm)
22360                         return -EPERM;
22361 +
22362 +#ifdef CONFIG_GRKERNSEC
22363 +               if (!capable(CAP_SYS_TTY_CONFIG))
22364 +                       return -EPERM;
22365 +#endif
22366 +
22367                 if (!i && v == K_NOSUCHMAP) {
22368                         /* deallocate map */
22369                         key_map = key_maps[s];
22370 @@ -366,6 +372,13 @@ do_kdgkb_ioctl(int cmd, struct kbsentry
22371                         goto reterr;
22372                 }
22373
22374 +#ifdef CONFIG_GRKERNSEC
22375 +               if (!capable(CAP_SYS_TTY_CONFIG)) {
22376 +                       ret = -EPERM;
22377 +                       goto reterr;
22378 +               }
22379 +#endif
22380 +
22381                 q = func_table[i];
22382                 first_free = funcbufptr + (funcbufsize - funcbufleft);
22383                 for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
22384 diff -urNp linux-2.6.33/drivers/cpufreq/cpufreq.c linux-2.6.33/drivers/cpufreq/cpufreq.c
22385 --- linux-2.6.33/drivers/cpufreq/cpufreq.c      2010-02-24 13:52:17.000000000 -0500
22386 +++ linux-2.6.33/drivers/cpufreq/cpufreq.c      2010-03-07 12:23:36.005705305 -0500
22387 @@ -766,7 +766,7 @@ static void cpufreq_sysfs_release(struct
22388         complete(&policy->kobj_unregister);
22389  }
22390
22391 -static struct sysfs_ops sysfs_ops = {
22392 +static const struct sysfs_ops sysfs_ops = {
22393         .show   = show,
22394         .store  = store,
22395  };
22396 diff -urNp linux-2.6.33/drivers/cpuidle/sysfs.c linux-2.6.33/drivers/cpuidle/sysfs.c
22397 --- linux-2.6.33/drivers/cpuidle/sysfs.c        2010-02-24 13:52:17.000000000 -0500
22398 +++ linux-2.6.33/drivers/cpuidle/sysfs.c        2010-03-07 12:23:36.005705305 -0500
22399 @@ -191,7 +191,7 @@ static ssize_t cpuidle_store(struct kobj
22400         return ret;
22401  }
22402
22403 -static struct sysfs_ops cpuidle_sysfs_ops = {
22404 +static const struct sysfs_ops cpuidle_sysfs_ops = {
22405         .show = cpuidle_show,
22406         .store = cpuidle_store,
22407  };
22408 @@ -277,7 +277,7 @@ static ssize_t cpuidle_state_show(struct
22409         return ret;
22410  }
22411
22412 -static struct sysfs_ops cpuidle_state_sysfs_ops = {
22413 +static const struct sysfs_ops cpuidle_state_sysfs_ops = {
22414         .show = cpuidle_state_show,
22415  };
22416
22417 diff -urNp linux-2.6.33/drivers/dma/ioat/dma.c linux-2.6.33/drivers/dma/ioat/dma.c
22418 --- linux-2.6.33/drivers/dma/ioat/dma.c 2010-02-24 13:52:17.000000000 -0500
22419 +++ linux-2.6.33/drivers/dma/ioat/dma.c 2010-03-07 12:23:36.005705305 -0500
22420 @@ -1146,7 +1146,7 @@ ioat_attr_show(struct kobject *kobj, str
22421         return entry->show(&chan->common, page);
22422  }
22423
22424 -struct sysfs_ops ioat_sysfs_ops = {
22425 +const struct sysfs_ops ioat_sysfs_ops = {
22426         .show   = ioat_attr_show,
22427  };
22428
22429 diff -urNp linux-2.6.33/drivers/dma/ioat/dma.h linux-2.6.33/drivers/dma/ioat/dma.h
22430 --- linux-2.6.33/drivers/dma/ioat/dma.h 2010-02-24 13:52:17.000000000 -0500
22431 +++ linux-2.6.33/drivers/dma/ioat/dma.h 2010-03-07 12:23:36.005705305 -0500
22432 @@ -347,7 +347,7 @@ bool ioat_cleanup_preamble(struct ioat_c
22433                            unsigned long *phys_complete);
22434  void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
22435  void ioat_kobject_del(struct ioatdma_device *device);
22436 -extern struct sysfs_ops ioat_sysfs_ops;
22437 +extern const struct sysfs_ops ioat_sysfs_ops;
22438  extern struct ioat_sysfs_entry ioat_version_attr;
22439  extern struct ioat_sysfs_entry ioat_cap_attr;
22440  #endif /* IOATDMA_H */
22441 diff -urNp linux-2.6.33/drivers/edac/edac_core.h linux-2.6.33/drivers/edac/edac_core.h
22442 --- linux-2.6.33/drivers/edac/edac_core.h       2010-02-24 13:52:17.000000000 -0500
22443 +++ linux-2.6.33/drivers/edac/edac_core.h       2010-03-07 12:23:36.005705305 -0500
22444 @@ -100,11 +100,11 @@ extern const char *edac_mem_types[];
22445
22446  #else                          /* !CONFIG_EDAC_DEBUG */
22447
22448 -#define debugf0( ... )
22449 -#define debugf1( ... )
22450 -#define debugf2( ... )
22451 -#define debugf3( ... )
22452 -#define debugf4( ... )
22453 +#define debugf0( ... ) do {} while (0)
22454 +#define debugf1( ... ) do {} while (0)
22455 +#define debugf2( ... ) do {} while (0)
22456 +#define debugf3( ... ) do {} while (0)
22457 +#define debugf4( ... ) do {} while (0)
22458
22459  #endif                         /* !CONFIG_EDAC_DEBUG */
22460
22461 diff -urNp linux-2.6.33/drivers/edac/edac_device_sysfs.c linux-2.6.33/drivers/edac/edac_device_sysfs.c
22462 --- linux-2.6.33/drivers/edac/edac_device_sysfs.c       2010-02-24 13:52:17.000000000 -0500
22463 +++ linux-2.6.33/drivers/edac/edac_device_sysfs.c       2010-03-07 12:23:36.005705305 -0500
22464 @@ -137,7 +137,7 @@ static ssize_t edac_dev_ctl_info_store(s
22465  }
22466
22467  /* edac_dev file operations for an 'ctl_info' */
22468 -static struct sysfs_ops device_ctl_info_ops = {
22469 +static const struct sysfs_ops device_ctl_info_ops = {
22470         .show = edac_dev_ctl_info_show,
22471         .store = edac_dev_ctl_info_store
22472  };
22473 @@ -373,7 +373,7 @@ static ssize_t edac_dev_instance_store(s
22474  }
22475
22476  /* edac_dev file operations for an 'instance' */
22477 -static struct sysfs_ops device_instance_ops = {
22478 +static const struct sysfs_ops device_instance_ops = {
22479         .show = edac_dev_instance_show,
22480         .store = edac_dev_instance_store
22481  };
22482 @@ -476,7 +476,7 @@ static ssize_t edac_dev_block_store(stru
22483  }
22484
22485  /* edac_dev file operations for a 'block' */
22486 -static struct sysfs_ops device_block_ops = {
22487 +static const struct sysfs_ops device_block_ops = {
22488         .show = edac_dev_block_show,
22489         .store = edac_dev_block_store
22490  };
22491 diff -urNp linux-2.6.33/drivers/edac/edac_mc_sysfs.c linux-2.6.33/drivers/edac/edac_mc_sysfs.c
22492 --- linux-2.6.33/drivers/edac/edac_mc_sysfs.c   2010-02-24 13:52:17.000000000 -0500
22493 +++ linux-2.6.33/drivers/edac/edac_mc_sysfs.c   2010-03-07 12:23:36.005705305 -0500
22494 @@ -245,7 +245,7 @@ static ssize_t csrowdev_store(struct kob
22495         return -EIO;
22496  }
22497
22498 -static struct sysfs_ops csrowfs_ops = {
22499 +static const struct sysfs_ops csrowfs_ops = {
22500         .show = csrowdev_show,
22501         .store = csrowdev_store
22502  };
22503 @@ -575,7 +575,7 @@ static ssize_t mcidev_store(struct kobje
22504  }
22505
22506  /* Intermediate show/store table */
22507 -static struct sysfs_ops mci_ops = {
22508 +static const struct sysfs_ops mci_ops = {
22509         .show = mcidev_show,
22510         .store = mcidev_store
22511  };
22512 diff -urNp linux-2.6.33/drivers/edac/edac_pci_sysfs.c linux-2.6.33/drivers/edac/edac_pci_sysfs.c
22513 --- linux-2.6.33/drivers/edac/edac_pci_sysfs.c  2010-02-24 13:52:17.000000000 -0500
22514 +++ linux-2.6.33/drivers/edac/edac_pci_sysfs.c  2010-03-07 12:23:36.005705305 -0500
22515 @@ -121,7 +121,7 @@ static ssize_t edac_pci_instance_store(s
22516  }
22517
22518  /* fs_ops table */
22519 -static struct sysfs_ops pci_instance_ops = {
22520 +static const struct sysfs_ops pci_instance_ops = {
22521         .show = edac_pci_instance_show,
22522         .store = edac_pci_instance_store
22523  };
22524 @@ -261,7 +261,7 @@ static ssize_t edac_pci_dev_store(struct
22525         return -EIO;
22526  }
22527
22528 -static struct sysfs_ops edac_pci_sysfs_ops = {
22529 +static const struct sysfs_ops edac_pci_sysfs_ops = {
22530         .show = edac_pci_dev_show,
22531         .store = edac_pci_dev_store
22532  };
22533 diff -urNp linux-2.6.33/drivers/firmware/dmi_scan.c linux-2.6.33/drivers/firmware/dmi_scan.c
22534 --- linux-2.6.33/drivers/firmware/dmi_scan.c    2010-02-24 13:52:17.000000000 -0500
22535 +++ linux-2.6.33/drivers/firmware/dmi_scan.c    2010-03-07 12:23:36.005705305 -0500
22536 @@ -388,11 +388,6 @@ void __init dmi_scan_machine(void)
22537                 }
22538         }
22539         else {
22540 -               /*
22541 -                * no iounmap() for that ioremap(); it would be a no-op, but
22542 -                * it's so early in setup that sucker gets confused into doing
22543 -                * what it shouldn't if we actually call it.
22544 -                */
22545                 p = dmi_ioremap(0xF0000, 0x10000);
22546                 if (p == NULL)
22547                         goto error;
22548 diff -urNp linux-2.6.33/drivers/firmware/edd.c linux-2.6.33/drivers/firmware/edd.c
22549 --- linux-2.6.33/drivers/firmware/edd.c 2010-02-24 13:52:17.000000000 -0500
22550 +++ linux-2.6.33/drivers/firmware/edd.c 2010-03-07 12:23:36.005705305 -0500
22551 @@ -122,7 +122,7 @@ edd_attr_show(struct kobject * kobj, str
22552         return ret;
22553  }
22554
22555 -static struct sysfs_ops edd_attr_ops = {
22556 +static const struct sysfs_ops edd_attr_ops = {
22557         .show = edd_attr_show,
22558  };
22559
22560 diff -urNp linux-2.6.33/drivers/firmware/efivars.c linux-2.6.33/drivers/firmware/efivars.c
22561 --- linux-2.6.33/drivers/firmware/efivars.c     2010-02-24 13:52:17.000000000 -0500
22562 +++ linux-2.6.33/drivers/firmware/efivars.c     2010-03-07 12:23:36.005705305 -0500
22563 @@ -362,7 +362,7 @@ static ssize_t efivar_attr_store(struct
22564         return ret;
22565  }
22566
22567 -static struct sysfs_ops efivar_attr_ops = {
22568 +static const struct sysfs_ops efivar_attr_ops = {
22569         .show = efivar_attr_show,
22570         .store = efivar_attr_store,
22571  };
22572 diff -urNp linux-2.6.33/drivers/firmware/iscsi_ibft.c linux-2.6.33/drivers/firmware/iscsi_ibft.c
22573 --- linux-2.6.33/drivers/firmware/iscsi_ibft.c  2010-02-24 13:52:17.000000000 -0500
22574 +++ linux-2.6.33/drivers/firmware/iscsi_ibft.c  2010-03-07 12:23:36.005705305 -0500
22575 @@ -525,7 +525,7 @@ static ssize_t ibft_show_attribute(struc
22576         return ret;
22577  }
22578
22579 -static struct sysfs_ops ibft_attr_ops = {
22580 +static const struct sysfs_ops ibft_attr_ops = {
22581         .show = ibft_show_attribute,
22582  };
22583
22584 diff -urNp linux-2.6.33/drivers/firmware/memmap.c linux-2.6.33/drivers/firmware/memmap.c
22585 --- linux-2.6.33/drivers/firmware/memmap.c      2010-02-24 13:52:17.000000000 -0500
22586 +++ linux-2.6.33/drivers/firmware/memmap.c      2010-03-07 12:23:36.005705305 -0500
22587 @@ -74,7 +74,7 @@ static struct attribute *def_attrs[] = {
22588         NULL
22589  };
22590
22591 -static struct sysfs_ops memmap_attr_ops = {
22592 +static const struct sysfs_ops memmap_attr_ops = {
22593         .show = memmap_attr_show,
22594  };
22595
22596 diff -urNp linux-2.6.33/drivers/gpu/drm/drm_drv.c linux-2.6.33/drivers/gpu/drm/drm_drv.c
22597 --- linux-2.6.33/drivers/gpu/drm/drm_drv.c      2010-02-24 13:52:17.000000000 -0500
22598 +++ linux-2.6.33/drivers/gpu/drm/drm_drv.c      2010-03-07 12:23:36.009705010 -0500
22599 @@ -448,7 +448,7 @@ long drm_ioctl(struct file *filp,
22600
22601         dev = file_priv->minor->dev;
22602         atomic_inc(&dev->ioctl_count);
22603 -       atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
22604 +       atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
22605         ++file_priv->ioctl_count;
22606
22607         DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
22608 diff -urNp linux-2.6.33/drivers/gpu/drm/drm_fops.c linux-2.6.33/drivers/gpu/drm/drm_fops.c
22609 --- linux-2.6.33/drivers/gpu/drm/drm_fops.c     2010-02-24 13:52:17.000000000 -0500
22610 +++ linux-2.6.33/drivers/gpu/drm/drm_fops.c     2010-03-07 12:23:36.009705010 -0500
22611 @@ -66,7 +66,7 @@ static int drm_setup(struct drm_device *
22612         }
22613
22614         for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
22615 -               atomic_set(&dev->counts[i], 0);
22616 +               atomic_set_unchecked(&dev->counts[i], 0);
22617
22618         dev->sigdata.lock = NULL;
22619
22620 @@ -130,9 +130,9 @@ int drm_open(struct inode *inode, struct
22621
22622         retcode = drm_open_helper(inode, filp, dev);
22623         if (!retcode) {
22624 -               atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
22625 +               atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
22626                 spin_lock(&dev->count_lock);
22627 -               if (!dev->open_count++) {
22628 +               if (atomic_inc_return(&dev->open_count) == 1) {
22629                         spin_unlock(&dev->count_lock);
22630                         retcode = drm_setup(dev);
22631                         goto out;
22632 @@ -472,7 +472,7 @@ int drm_release(struct inode *inode, str
22633
22634         lock_kernel();
22635
22636 -       DRM_DEBUG("open_count = %d\n", dev->open_count);
22637 +       DRM_DEBUG("open_count = %d\n", atomic_read(&dev->open_count));
22638
22639         if (dev->driver->preclose)
22640                 dev->driver->preclose(dev, file_priv);
22641 @@ -484,7 +484,7 @@ int drm_release(struct inode *inode, str
22642         DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
22643                   task_pid_nr(current),
22644                   (long)old_encode_dev(file_priv->minor->device),
22645 -                 dev->open_count);
22646 +                 atomic_read(&dev->open_count));
22647
22648         /* if the master has gone away we can't do anything with the lock */
22649         if (file_priv->minor->master)
22650 @@ -565,9 +565,9 @@ int drm_release(struct inode *inode, str
22651          * End inline drm_release
22652          */
22653
22654 -       atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
22655 +       atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
22656         spin_lock(&dev->count_lock);
22657 -       if (!--dev->open_count) {
22658 +       if (atomic_dec_and_test(&dev->open_count)) {
22659                 if (atomic_read(&dev->ioctl_count)) {
22660                         DRM_ERROR("Device busy: %d\n",
22661                                   atomic_read(&dev->ioctl_count));
22662 diff -urNp linux-2.6.33/drivers/gpu/drm/drm_ioctl.c linux-2.6.33/drivers/gpu/drm/drm_ioctl.c
22663 --- linux-2.6.33/drivers/gpu/drm/drm_ioctl.c    2010-02-24 13:52:17.000000000 -0500
22664 +++ linux-2.6.33/drivers/gpu/drm/drm_ioctl.c    2010-03-07 12:23:36.009705010 -0500
22665 @@ -283,7 +283,7 @@ int drm_getstats(struct drm_device *dev,
22666                         stats->data[i].value =
22667                             (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
22668                 else
22669 -                       stats->data[i].value = atomic_read(&dev->counts[i]);
22670 +                       stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
22671                 stats->data[i].type = dev->types[i];
22672         }
22673
22674 diff -urNp linux-2.6.33/drivers/gpu/drm/drm_lock.c linux-2.6.33/drivers/gpu/drm/drm_lock.c
22675 --- linux-2.6.33/drivers/gpu/drm/drm_lock.c     2010-02-24 13:52:17.000000000 -0500
22676 +++ linux-2.6.33/drivers/gpu/drm/drm_lock.c     2010-03-07 12:23:36.009705010 -0500
22677 @@ -87,7 +87,7 @@ int drm_lock(struct drm_device *dev, voi
22678                 if (drm_lock_take(&master->lock, lock->context)) {
22679                         master->lock.file_priv = file_priv;
22680                         master->lock.lock_time = jiffies;
22681 -                       atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
22682 +                       atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
22683                         break;  /* Got lock */
22684                 }
22685
22686 @@ -165,7 +165,7 @@ int drm_unlock(struct drm_device *dev, v
22687                 return -EINVAL;
22688         }
22689
22690 -       atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
22691 +       atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
22692
22693         /* kernel_context_switch isn't used by any of the x86 drm
22694          * modules but is required by the Sparc driver.
22695 diff -urNp linux-2.6.33/drivers/gpu/drm/i810/i810_dma.c linux-2.6.33/drivers/gpu/drm/i810/i810_dma.c
22696 --- linux-2.6.33/drivers/gpu/drm/i810/i810_dma.c        2010-02-24 13:52:17.000000000 -0500
22697 +++ linux-2.6.33/drivers/gpu/drm/i810/i810_dma.c        2010-03-07 12:23:36.009705010 -0500
22698 @@ -952,8 +952,8 @@ static int i810_dma_vertex(struct drm_de
22699                                  dma->buflist[vertex->idx],
22700                                  vertex->discard, vertex->used);
22701
22702 -       atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
22703 -       atomic_inc(&dev->counts[_DRM_STAT_DMA]);
22704 +       atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
22705 +       atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
22706         sarea_priv->last_enqueue = dev_priv->counter - 1;
22707         sarea_priv->last_dispatch = (int)hw_status[5];
22708
22709 @@ -1115,8 +1115,8 @@ static int i810_dma_mc(struct drm_device
22710         i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
22711                              mc->last_render);
22712
22713 -       atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
22714 -       atomic_inc(&dev->counts[_DRM_STAT_DMA]);
22715 +       atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
22716 +       atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
22717         sarea_priv->last_enqueue = dev_priv->counter - 1;
22718         sarea_priv->last_dispatch = (int)hw_status[5];
22719
22720 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7017.c
22721 --- linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7017.c      2010-02-24 13:52:17.000000000 -0500
22722 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7017.c      2010-03-07 12:23:36.009705010 -0500
22723 @@ -444,7 +444,7 @@ static void ch7017_destroy(struct intel_
22724         }
22725  }
22726
22727 -struct intel_dvo_dev_ops ch7017_ops = {
22728 +const struct intel_dvo_dev_ops ch7017_ops = {
22729         .init = ch7017_init,
22730         .detect = ch7017_detect,
22731         .mode_valid = ch7017_mode_valid,
22732 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7xxx.c
22733 --- linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7xxx.c      2010-02-24 13:52:17.000000000 -0500
22734 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo_ch7xxx.c      2010-03-07 12:23:36.009705010 -0500
22735 @@ -358,7 +358,7 @@ static void ch7xxx_destroy(struct intel_
22736         }
22737  }
22738
22739 -struct intel_dvo_dev_ops ch7xxx_ops = {
22740 +const struct intel_dvo_dev_ops ch7xxx_ops = {
22741         .init = ch7xxx_init,
22742         .detect = ch7xxx_detect,
22743         .mode_valid = ch7xxx_mode_valid,
22744 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo.h linux-2.6.33/drivers/gpu/drm/i915/dvo.h
22745 --- linux-2.6.33/drivers/gpu/drm/i915/dvo.h     2010-02-24 13:52:17.000000000 -0500
22746 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo.h     2010-03-07 12:23:36.009705010 -0500
22747 @@ -135,23 +135,23 @@ struct intel_dvo_dev_ops {
22748          *
22749          * \return singly-linked list of modes or NULL if no modes found.
22750          */
22751 -       struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
22752 +       struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
22753
22754         /**
22755          * Clean up driver-specific bits of the output
22756          */
22757 -       void (*destroy) (struct intel_dvo_device *dvo);
22758 +       void (* const destroy) (struct intel_dvo_device *dvo);
22759
22760         /**
22761          * Debugging hook to dump device registers to log file
22762          */
22763 -       void (*dump_regs)(struct intel_dvo_device *dvo);
22764 +       void (* const dump_regs)(struct intel_dvo_device *dvo);
22765  };
22766
22767 -extern struct intel_dvo_dev_ops sil164_ops;
22768 -extern struct intel_dvo_dev_ops ch7xxx_ops;
22769 -extern struct intel_dvo_dev_ops ivch_ops;
22770 -extern struct intel_dvo_dev_ops tfp410_ops;
22771 -extern struct intel_dvo_dev_ops ch7017_ops;
22772 +extern const struct intel_dvo_dev_ops sil164_ops;
22773 +extern const struct intel_dvo_dev_ops ch7xxx_ops;
22774 +extern const struct intel_dvo_dev_ops ivch_ops;
22775 +extern const struct intel_dvo_dev_ops tfp410_ops;
22776 +extern const struct intel_dvo_dev_ops ch7017_ops;
22777
22778  #endif /* _INTEL_DVO_H */
22779 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.33/drivers/gpu/drm/i915/dvo_ivch.c
22780 --- linux-2.6.33/drivers/gpu/drm/i915/dvo_ivch.c        2010-02-24 13:52:17.000000000 -0500
22781 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo_ivch.c        2010-03-07 12:23:36.009705010 -0500
22782 @@ -431,7 +431,7 @@ static void ivch_destroy(struct intel_dv
22783         }
22784  }
22785
22786 -struct intel_dvo_dev_ops ivch_ops= {
22787 +const struct intel_dvo_dev_ops ivch_ops= {
22788         .init = ivch_init,
22789         .dpms = ivch_dpms,
22790         .save = ivch_save,
22791 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.33/drivers/gpu/drm/i915/dvo_sil164.c
22792 --- linux-2.6.33/drivers/gpu/drm/i915/dvo_sil164.c      2010-02-24 13:52:17.000000000 -0500
22793 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo_sil164.c      2010-03-07 12:23:36.009705010 -0500
22794 @@ -290,7 +290,7 @@ static void sil164_destroy(struct intel_
22795         }
22796  }
22797
22798 -struct intel_dvo_dev_ops sil164_ops = {
22799 +const struct intel_dvo_dev_ops sil164_ops = {
22800         .init = sil164_init,
22801         .detect = sil164_detect,
22802         .mode_valid = sil164_mode_valid,
22803 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.33/drivers/gpu/drm/i915/dvo_tfp410.c
22804 --- linux-2.6.33/drivers/gpu/drm/i915/dvo_tfp410.c      2010-02-24 13:52:17.000000000 -0500
22805 +++ linux-2.6.33/drivers/gpu/drm/i915/dvo_tfp410.c      2010-03-07 12:23:36.009705010 -0500
22806 @@ -325,7 +325,7 @@ static void tfp410_destroy(struct intel_
22807         }
22808  }
22809
22810 -struct intel_dvo_dev_ops tfp410_ops = {
22811 +const struct intel_dvo_dev_ops tfp410_ops = {
22812         .init = tfp410_init,
22813         .detect = tfp410_detect,
22814         .mode_valid = tfp410_mode_valid,
22815 diff -urNp linux-2.6.33/drivers/gpu/drm/i915/i915_drv.c linux-2.6.33/drivers/gpu/drm/i915/i915_drv.c
22816 --- linux-2.6.33/drivers/gpu/drm/i915/i915_drv.c        2010-02-24 13:52:17.000000000 -0500
22817 +++ linux-2.6.33/drivers/gpu/drm/i915/i915_drv.c        2010-03-07 12:23:36.009705010 -0500
22818 @@ -470,7 +470,7 @@ const struct dev_pm_ops i915_pm_ops = {
22819       .restore = i915_pm_resume,
22820  };
22821
22822 -static struct vm_operations_struct i915_gem_vm_ops = {
22823 +static const struct vm_operations_struct i915_gem_vm_ops = {
22824         .fault = i915_gem_fault,
22825         .open = drm_gem_vm_open,
22826         .close = drm_gem_vm_close,
22827 diff -urNp linux-2.6.33/drivers/gpu/drm/nouveau/nouveau_backlight.c linux-2.6.33/drivers/gpu/drm/nouveau/nouveau_backlight.c
22828 --- linux-2.6.33/drivers/gpu/drm/nouveau/nouveau_backlight.c    2010-02-24 13:52:17.000000000 -0500
22829 +++ linux-2.6.33/drivers/gpu/drm/nouveau/nouveau_backlight.c    2010-03-07 12:23:36.009705010 -0500
22830 @@ -58,7 +58,7 @@ static int nv40_set_intensity(struct bac
22831         return 0;
22832  }
22833
22834 -static struct backlight_ops nv40_bl_ops = {
22835 +static const struct backlight_ops nv40_bl_ops = {
22836         .options = BL_CORE_SUSPENDRESUME,
22837         .get_brightness = nv40_get_intensity,
22838         .update_status = nv40_set_intensity,
22839 @@ -81,7 +81,7 @@ static int nv50_set_intensity(struct bac
22840         return 0;
22841  }
22842
22843 -static struct backlight_ops nv50_bl_ops = {
22844 +static const struct backlight_ops nv50_bl_ops = {
22845         .options = BL_CORE_SUSPENDRESUME,
22846         .get_brightness = nv50_get_intensity,
22847         .update_status = nv50_set_intensity,
22848 diff -urNp linux-2.6.33/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.33/drivers/gpu/drm/radeon/mkregtable.c
22849 --- linux-2.6.33/drivers/gpu/drm/radeon/mkregtable.c    2010-02-24 13:52:17.000000000 -0500
22850 +++ linux-2.6.33/drivers/gpu/drm/radeon/mkregtable.c    2010-03-07 12:23:36.009705010 -0500
22851 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t,
22852         regex_t mask_rex;
22853         regmatch_t match[4];
22854         char buf[1024];
22855 -       size_t end;
22856 +       long end;
22857         int len;
22858         int done = 0;
22859         int r;
22860         unsigned o;
22861         struct offset *offset;
22862         char last_reg_s[10];
22863 -       int last_reg;
22864 +       unsigned long last_reg;
22865
22866         if (regcomp
22867             (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
22868 diff -urNp linux-2.6.33/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.33/drivers/gpu/drm/radeon/radeon_atombios.c
22869 --- linux-2.6.33/drivers/gpu/drm/radeon/radeon_atombios.c       2010-02-24 13:52:17.000000000 -0500
22870 +++ linux-2.6.33/drivers/gpu/drm/radeon/radeon_atombios.c       2010-03-07 12:23:36.009705010 -0500
22871 @@ -637,14 +637,14 @@ static uint16_t atombios_get_connector_o
22872         }
22873  }
22874
22875 -struct bios_connector {
22876 +static struct bios_connector {
22877         bool valid;
22878         uint16_t line_mux;
22879         uint16_t devices;
22880         int connector_type;
22881         struct radeon_i2c_bus_rec ddc_bus;
22882         struct radeon_hpd hpd;
22883 -};
22884 +} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
22885
22886  bool radeon_get_atom_connector_info_from_supported_devices_table(struct
22887                                                                  drm_device
22888 @@ -660,7 +660,6 @@ bool radeon_get_atom_connector_info_from
22889         uint8_t dac;
22890         union atom_supported_devices *supported_devices;
22891         int i, j, max_device;
22892 -       struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
22893
22894         atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
22895
22896 diff -urNp linux-2.6.33/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.33/drivers/gpu/drm/radeon/radeon_state.c
22897 --- linux-2.6.33/drivers/gpu/drm/radeon/radeon_state.c  2010-02-24 13:52:17.000000000 -0500
22898 +++ linux-2.6.33/drivers/gpu/drm/radeon/radeon_state.c  2010-03-07 12:23:36.013715915 -0500
22899 @@ -2139,7 +2139,7 @@ static int radeon_cp_clear(struct drm_de
22900         if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
22901                 sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
22902
22903 -       if (DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
22904 +       if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS || DRM_COPY_FROM_USER(&depth_boxes, clear->depth_boxes,
22905                                sarea_priv->nbox * sizeof(depth_boxes[0])))
22906                 return -EFAULT;
22907
22908 @@ -3014,7 +3014,7 @@ static int radeon_cp_getparam(struct drm
22909  {
22910         drm_radeon_private_t *dev_priv = dev->dev_private;
22911         drm_radeon_getparam_t *param = data;
22912 -       int value;
22913 +       int value = 0;
22914
22915         DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
22916
22917 diff -urNp linux-2.6.33/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.33/drivers/gpu/drm/radeon/radeon_ttm.c
22918 --- linux-2.6.33/drivers/gpu/drm/radeon/radeon_ttm.c    2010-02-24 13:52:17.000000000 -0500
22919 +++ linux-2.6.33/drivers/gpu/drm/radeon/radeon_ttm.c    2010-03-07 12:23:36.013715915 -0500
22920 @@ -564,27 +564,10 @@ void radeon_ttm_fini(struct radeon_devic
22921         DRM_INFO("radeon: ttm finalized\n");
22922  }
22923
22924 -static struct vm_operations_struct radeon_ttm_vm_ops;
22925 -static const struct vm_operations_struct *ttm_vm_ops = NULL;
22926 -
22927 -static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
22928 -{
22929 -       struct ttm_buffer_object *bo;
22930 -       int r;
22931 -
22932 -       bo = (struct ttm_buffer_object *)vma->vm_private_data;
22933 -       if (bo == NULL) {
22934 -               return VM_FAULT_NOPAGE;
22935 -       }
22936 -       r = ttm_vm_ops->fault(vma, vmf);
22937 -       return r;
22938 -}
22939 -
22940  int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
22941  {
22942         struct drm_file *file_priv;
22943         struct radeon_device *rdev;
22944 -       int r;
22945
22946         if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
22947                 return drm_mmap(filp, vma);
22948 @@ -592,20 +575,9 @@ int radeon_mmap(struct file *filp, struc
22949
22950         file_priv = (struct drm_file *)filp->private_data;
22951         rdev = file_priv->minor->dev->dev_private;
22952 -       if (rdev == NULL) {
22953 +       if (!rdev)
22954                 return -EINVAL;
22955 -       }
22956 -       r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
22957 -       if (unlikely(r != 0)) {
22958 -               return r;
22959 -       }
22960 -       if (unlikely(ttm_vm_ops == NULL)) {
22961 -               ttm_vm_ops = vma->vm_ops;
22962 -               radeon_ttm_vm_ops = *ttm_vm_ops;
22963 -               radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
22964 -       }
22965 -       vma->vm_ops = &radeon_ttm_vm_ops;
22966 -       return 0;
22967 +       return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
22968  }
22969
22970
22971 diff -urNp linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo.c
22972 --- linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo.c   2010-02-24 13:52:17.000000000 -0500
22973 +++ linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo.c   2010-03-07 12:23:36.013715915 -0500
22974 @@ -128,7 +128,7 @@ static struct attribute *ttm_bo_global_a
22975         NULL
22976  };
22977
22978 -static struct sysfs_ops ttm_bo_global_ops = {
22979 +static const struct sysfs_ops ttm_bo_global_ops = {
22980         .show = &ttm_bo_global_show
22981  };
22982
22983 diff -urNp linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo_vm.c
22984 --- linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo_vm.c        2010-02-24 13:52:17.000000000 -0500
22985 +++ linux-2.6.33/drivers/gpu/drm/ttm/ttm_bo_vm.c        2010-03-07 12:23:36.013715915 -0500
22986 @@ -73,7 +73,7 @@ static int ttm_bo_vm_fault(struct vm_are
22987  {
22988         struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
22989             vma->vm_private_data;
22990 -       struct ttm_bo_device *bdev = bo->bdev;
22991 +       struct ttm_bo_device *bdev;
22992         unsigned long bus_base;
22993         unsigned long bus_offset;
22994         unsigned long bus_size;
22995 @@ -88,6 +88,10 @@ static int ttm_bo_vm_fault(struct vm_are
22996         unsigned long address = (unsigned long)vmf->virtual_address;
22997         int retval = VM_FAULT_NOPAGE;
22998
22999 +       if (!bo)
23000 +               return VM_FAULT_NOPAGE;
23001 +       bdev = bo->bdev;
23002 +
23003         /*
23004          * Work around locking order reversal in fault / nopfn
23005          * between mmap_sem and bo_reserve: Perform a trylock operation
23006 diff -urNp linux-2.6.33/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.33/drivers/gpu/drm/ttm/ttm_global.c
23007 --- linux-2.6.33/drivers/gpu/drm/ttm/ttm_global.c       2010-02-24 13:52:17.000000000 -0500
23008 +++ linux-2.6.33/drivers/gpu/drm/ttm/ttm_global.c       2010-03-07 12:23:36.013715915 -0500
23009 @@ -36,7 +36,7 @@
23010  struct ttm_global_item {
23011         struct mutex mutex;
23012         void *object;
23013 -       int refcount;
23014 +       atomic_t refcount;
23015  };
23016
23017  static struct ttm_global_item glob[TTM_GLOBAL_NUM];
23018 @@ -49,7 +49,7 @@ void ttm_global_init(void)
23019                 struct ttm_global_item *item = &glob[i];
23020                 mutex_init(&item->mutex);
23021                 item->object = NULL;
23022 -               item->refcount = 0;
23023 +               atomic_set(&item->refcount, 0);
23024         }
23025  }
23026
23027 @@ -59,7 +59,7 @@ void ttm_global_release(void)
23028         for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
23029                 struct ttm_global_item *item = &glob[i];
23030                 BUG_ON(item->object != NULL);
23031 -               BUG_ON(item->refcount != 0);
23032 +               BUG_ON(atomic_read(&item->refcount) != 0);
23033         }
23034  }
23035
23036 @@ -70,7 +70,7 @@ int ttm_global_item_ref(struct ttm_globa
23037         void *object;
23038
23039         mutex_lock(&item->mutex);
23040 -       if (item->refcount == 0) {
23041 +       if (atomic_read(&item->refcount) == 0) {
23042                 item->object = kzalloc(ref->size, GFP_KERNEL);
23043                 if (unlikely(item->object == NULL)) {
23044                         ret = -ENOMEM;
23045 @@ -83,7 +83,7 @@ int ttm_global_item_ref(struct ttm_globa
23046                         goto out_err;
23047
23048         }
23049 -       ++item->refcount;
23050 +       atomic_inc(&item->refcount);
23051         ref->object = item->object;
23052         object = item->object;
23053         mutex_unlock(&item->mutex);
23054 @@ -100,9 +100,9 @@ void ttm_global_item_unref(struct ttm_gl
23055         struct ttm_global_item *item = &glob[ref->global_type];
23056
23057         mutex_lock(&item->mutex);
23058 -       BUG_ON(item->refcount == 0);
23059 +       BUG_ON(atomic_read(&item->refcount) == 0);
23060         BUG_ON(ref->object != item->object);
23061 -       if (--item->refcount == 0) {
23062 +       if (atomic_dec_and_test(&item->refcount)) {
23063                 ref->release(ref);
23064                 item->object = NULL;
23065         }
23066 diff -urNp linux-2.6.33/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.33/drivers/gpu/drm/ttm/ttm_memory.c
23067 --- linux-2.6.33/drivers/gpu/drm/ttm/ttm_memory.c       2010-02-24 13:52:17.000000000 -0500
23068 +++ linux-2.6.33/drivers/gpu/drm/ttm/ttm_memory.c       2010-03-07 12:23:36.013715915 -0500
23069 @@ -152,7 +152,7 @@ static struct attribute *ttm_mem_zone_at
23070         NULL
23071  };
23072
23073 -static struct sysfs_ops ttm_mem_zone_ops = {
23074 +static const struct sysfs_ops ttm_mem_zone_ops = {
23075         .show = &ttm_mem_zone_show,
23076         .store = &ttm_mem_zone_store
23077  };
23078 diff -urNp linux-2.6.33/drivers/hwmon/k8temp.c linux-2.6.33/drivers/hwmon/k8temp.c
23079 --- linux-2.6.33/drivers/hwmon/k8temp.c 2010-02-24 13:52:17.000000000 -0500
23080 +++ linux-2.6.33/drivers/hwmon/k8temp.c 2010-03-07 12:23:36.013715915 -0500
23081 @@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
23082
23083  static const struct pci_device_id k8temp_ids[] = {
23084         { PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
23085 -       { 0 },
23086 +       { 0, 0, 0, 0, 0, 0, 0 },
23087  };
23088
23089  MODULE_DEVICE_TABLE(pci, k8temp_ids);
23090 diff -urNp linux-2.6.33/drivers/hwmon/sis5595.c linux-2.6.33/drivers/hwmon/sis5595.c
23091 --- linux-2.6.33/drivers/hwmon/sis5595.c        2010-02-24 13:52:17.000000000 -0500
23092 +++ linux-2.6.33/drivers/hwmon/sis5595.c        2010-03-07 12:23:36.013715915 -0500
23093 @@ -699,7 +699,7 @@ static struct sis5595_data *sis5595_upda
23094
23095  static const struct pci_device_id sis5595_pci_ids[] = {
23096         { PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
23097 -       { 0, }
23098 +       { 0, 0, 0, 0, 0, 0, 0 }
23099  };
23100
23101  MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
23102 diff -urNp linux-2.6.33/drivers/hwmon/via686a.c linux-2.6.33/drivers/hwmon/via686a.c
23103 --- linux-2.6.33/drivers/hwmon/via686a.c        2010-02-24 13:52:17.000000000 -0500
23104 +++ linux-2.6.33/drivers/hwmon/via686a.c        2010-03-07 12:23:36.013715915 -0500
23105 @@ -769,7 +769,7 @@ static struct via686a_data *via686a_upda
23106
23107  static const struct pci_device_id via686a_pci_ids[] = {
23108         { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
23109 -       { 0, }
23110 +       { 0, 0, 0, 0, 0, 0, 0 }
23111  };
23112
23113  MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
23114 diff -urNp linux-2.6.33/drivers/hwmon/vt8231.c linux-2.6.33/drivers/hwmon/vt8231.c
23115 --- linux-2.6.33/drivers/hwmon/vt8231.c 2010-02-24 13:52:17.000000000 -0500
23116 +++ linux-2.6.33/drivers/hwmon/vt8231.c 2010-03-07 12:23:36.013715915 -0500
23117 @@ -699,7 +699,7 @@ static struct platform_driver vt8231_dri
23118
23119  static const struct pci_device_id vt8231_pci_ids[] = {
23120         { PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
23121 -       { 0, }
23122 +       { 0, 0, 0, 0, 0, 0, 0 }
23123  };
23124
23125  MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
23126 diff -urNp linux-2.6.33/drivers/hwmon/w83791d.c linux-2.6.33/drivers/hwmon/w83791d.c
23127 --- linux-2.6.33/drivers/hwmon/w83791d.c        2010-02-24 13:52:17.000000000 -0500
23128 +++ linux-2.6.33/drivers/hwmon/w83791d.c        2010-03-07 12:23:36.013715915 -0500
23129 @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
23130                           struct i2c_board_info *info);
23131  static int w83791d_remove(struct i2c_client *client);
23132
23133 -static int w83791d_read(struct i2c_client *client, u8 register);
23134 -static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
23135 +static int w83791d_read(struct i2c_client *client, u8 reg);
23136 +static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
23137  static struct w83791d_data *w83791d_update_device(struct device *dev);
23138
23139  #ifdef DEBUG
23140 diff -urNp linux-2.6.33/drivers/i2c/busses/i2c-i801.c linux-2.6.33/drivers/i2c/busses/i2c-i801.c
23141 --- linux-2.6.33/drivers/i2c/busses/i2c-i801.c  2010-02-24 13:52:17.000000000 -0500
23142 +++ linux-2.6.33/drivers/i2c/busses/i2c-i801.c  2010-03-07 12:23:36.013715915 -0500
23143 @@ -578,7 +578,7 @@ static struct pci_device_id i801_ids[] =
23144         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_4) },
23145         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_ICH10_5) },
23146         { PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PCH_SMBUS) },
23147 -       { 0, }
23148 +       { 0, 0, 0, 0, 0, 0, 0 }
23149  };
23150
23151  MODULE_DEVICE_TABLE (pci, i801_ids);
23152 diff -urNp linux-2.6.33/drivers/i2c/busses/i2c-piix4.c linux-2.6.33/drivers/i2c/busses/i2c-piix4.c
23153 --- linux-2.6.33/drivers/i2c/busses/i2c-piix4.c 2010-02-24 13:52:17.000000000 -0500
23154 +++ linux-2.6.33/drivers/i2c/busses/i2c-piix4.c 2010-03-07 12:23:36.013715915 -0500
23155 @@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
23156                 .ident = "IBM",
23157                 .matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
23158         },
23159 -       { },
23160 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23161  };
23162
23163  static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
23164 @@ -491,7 +491,7 @@ static struct pci_device_id piix4_ids[]
23165                      PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
23166         { PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
23167                      PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
23168 -       { 0, }
23169 +       { 0, 0, 0, 0, 0, 0, 0 }
23170  };
23171
23172  MODULE_DEVICE_TABLE (pci, piix4_ids);
23173 diff -urNp linux-2.6.33/drivers/i2c/busses/i2c-sis630.c linux-2.6.33/drivers/i2c/busses/i2c-sis630.c
23174 --- linux-2.6.33/drivers/i2c/busses/i2c-sis630.c        2010-02-24 13:52:17.000000000 -0500
23175 +++ linux-2.6.33/drivers/i2c/busses/i2c-sis630.c        2010-03-07 12:23:36.013715915 -0500
23176 @@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
23177  static struct pci_device_id sis630_ids[] __devinitdata = {
23178         { PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
23179         { PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
23180 -       { 0, }
23181 +       { 0, 0, 0, 0, 0, 0, 0 }
23182  };
23183
23184  MODULE_DEVICE_TABLE (pci, sis630_ids);
23185 diff -urNp linux-2.6.33/drivers/i2c/busses/i2c-sis96x.c linux-2.6.33/drivers/i2c/busses/i2c-sis96x.c
23186 --- linux-2.6.33/drivers/i2c/busses/i2c-sis96x.c        2010-02-24 13:52:17.000000000 -0500
23187 +++ linux-2.6.33/drivers/i2c/busses/i2c-sis96x.c        2010-03-07 12:23:36.013715915 -0500
23188 @@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
23189
23190  static struct pci_device_id sis96x_ids[] = {
23191         { PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
23192 -       { 0, }
23193 +       { 0, 0, 0, 0, 0, 0, 0 }
23194  };
23195
23196  MODULE_DEVICE_TABLE (pci, sis96x_ids);
23197 diff -urNp linux-2.6.33/drivers/ide/ide-cd.c linux-2.6.33/drivers/ide/ide-cd.c
23198 --- linux-2.6.33/drivers/ide/ide-cd.c   2010-02-24 13:52:17.000000000 -0500
23199 +++ linux-2.6.33/drivers/ide/ide-cd.c   2010-03-07 12:23:36.017712707 -0500
23200 @@ -766,7 +766,7 @@ static void cdrom_do_block_pc(ide_drive_
23201                 alignment = queue_dma_alignment(q) | q->dma_pad_mask;
23202                 if ((unsigned long)buf & alignment
23203                     || blk_rq_bytes(rq) & q->dma_pad_mask
23204 -                   || object_is_on_stack(buf))
23205 +                   || object_starts_on_stack(buf))
23206                         drive->dma = 0;
23207         }
23208  }
23209 diff -urNp linux-2.6.33/drivers/ieee1394/dv1394.c linux-2.6.33/drivers/ieee1394/dv1394.c
23210 --- linux-2.6.33/drivers/ieee1394/dv1394.c      2010-02-24 13:52:17.000000000 -0500
23211 +++ linux-2.6.33/drivers/ieee1394/dv1394.c      2010-03-07 12:23:36.017712707 -0500
23212 @@ -739,7 +739,7 @@ static void frame_prepare(struct video_c
23213         based upon DIF section and sequence
23214  */
23215
23216 -static void inline
23217 +static inline void
23218  frame_put_packet (struct frame *f, struct packet *p)
23219  {
23220         int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
23221 @@ -2178,7 +2178,7 @@ static const struct ieee1394_device_id d
23222                 .specifier_id   = AVC_UNIT_SPEC_ID_ENTRY & 0xffffff,
23223                 .version        = AVC_SW_VERSION_ENTRY & 0xffffff
23224         },
23225 -       { }
23226 +       { 0, 0, 0, 0, 0, 0 }
23227  };
23228
23229  MODULE_DEVICE_TABLE(ieee1394, dv1394_id_table);
23230 diff -urNp linux-2.6.33/drivers/ieee1394/eth1394.c linux-2.6.33/drivers/ieee1394/eth1394.c
23231 --- linux-2.6.33/drivers/ieee1394/eth1394.c     2010-02-24 13:52:17.000000000 -0500
23232 +++ linux-2.6.33/drivers/ieee1394/eth1394.c     2010-03-07 12:23:36.017712707 -0500
23233 @@ -446,7 +446,7 @@ static const struct ieee1394_device_id e
23234                 .specifier_id = ETHER1394_GASP_SPECIFIER_ID,
23235                 .version = ETHER1394_GASP_VERSION,
23236         },
23237 -       {}
23238 +       { 0, 0, 0, 0, 0, 0 }
23239  };
23240
23241  MODULE_DEVICE_TABLE(ieee1394, eth1394_id_table);
23242 diff -urNp linux-2.6.33/drivers/ieee1394/hosts.c linux-2.6.33/drivers/ieee1394/hosts.c
23243 --- linux-2.6.33/drivers/ieee1394/hosts.c       2010-02-24 13:52:17.000000000 -0500
23244 +++ linux-2.6.33/drivers/ieee1394/hosts.c       2010-03-07 12:23:36.017712707 -0500
23245 @@ -78,6 +78,7 @@ static int dummy_isoctl(struct hpsb_iso
23246  }
23247
23248  static struct hpsb_host_driver dummy_driver = {
23249 +       .name =            "dummy",
23250         .transmit_packet = dummy_transmit_packet,
23251         .devctl =          dummy_devctl,
23252         .isoctl =          dummy_isoctl
23253 diff -urNp linux-2.6.33/drivers/ieee1394/ohci1394.c linux-2.6.33/drivers/ieee1394/ohci1394.c
23254 --- linux-2.6.33/drivers/ieee1394/ohci1394.c    2010-02-24 13:52:17.000000000 -0500
23255 +++ linux-2.6.33/drivers/ieee1394/ohci1394.c    2010-03-07 12:23:36.017712707 -0500
23256 @@ -148,9 +148,9 @@ printk(level "%s: " fmt "\n" , OHCI1394_
23257  printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
23258
23259  /* Module Parameters */
23260 -static int phys_dma = 1;
23261 +static int phys_dma;
23262  module_param(phys_dma, int, 0444);
23263 -MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
23264 +MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
23265
23266  static void dma_trm_tasklet(unsigned long data);
23267  static void dma_trm_reset(struct dma_trm_ctx *d);
23268 @@ -3445,7 +3445,7 @@ static struct pci_device_id ohci1394_pci
23269                 .subvendor =    PCI_ANY_ID,
23270                 .subdevice =    PCI_ANY_ID,
23271         },
23272 -       { 0, },
23273 +       { 0, 0, 0, 0, 0, 0, 0 },
23274  };
23275
23276  MODULE_DEVICE_TABLE(pci, ohci1394_pci_tbl);
23277 diff -urNp linux-2.6.33/drivers/ieee1394/raw1394.c linux-2.6.33/drivers/ieee1394/raw1394.c
23278 --- linux-2.6.33/drivers/ieee1394/raw1394.c     2010-02-24 13:52:17.000000000 -0500
23279 +++ linux-2.6.33/drivers/ieee1394/raw1394.c     2010-03-07 12:23:36.017712707 -0500
23280 @@ -3002,7 +3002,7 @@ static const struct ieee1394_device_id r
23281          .match_flags = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
23282          .specifier_id = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
23283          .version = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff},
23284 -       {}
23285 +       { 0, 0, 0, 0, 0, 0 }
23286  };
23287
23288  MODULE_DEVICE_TABLE(ieee1394, raw1394_id_table);
23289 diff -urNp linux-2.6.33/drivers/ieee1394/sbp2.c linux-2.6.33/drivers/ieee1394/sbp2.c
23290 --- linux-2.6.33/drivers/ieee1394/sbp2.c        2010-02-24 13:52:17.000000000 -0500
23291 +++ linux-2.6.33/drivers/ieee1394/sbp2.c        2010-03-07 12:23:36.017712707 -0500
23292 @@ -290,7 +290,7 @@ static const struct ieee1394_device_id s
23293          .match_flags   = IEEE1394_MATCH_SPECIFIER_ID | IEEE1394_MATCH_VERSION,
23294          .specifier_id  = SBP2_UNIT_SPEC_ID_ENTRY & 0xffffff,
23295          .version       = SBP2_SW_VERSION_ENTRY & 0xffffff},
23296 -       {}
23297 +       { 0, 0, 0, 0, 0, 0 }
23298  };
23299  MODULE_DEVICE_TABLE(ieee1394, sbp2_id_table);
23300
23301 @@ -2111,7 +2111,7 @@ MODULE_DESCRIPTION("IEEE-1394 SBP-2 prot
23302  MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
23303  MODULE_LICENSE("GPL");
23304
23305 -static int sbp2_module_init(void)
23306 +static int __init sbp2_module_init(void)
23307  {
23308         int ret;
23309
23310 diff -urNp linux-2.6.33/drivers/ieee1394/video1394.c linux-2.6.33/drivers/ieee1394/video1394.c
23311 --- linux-2.6.33/drivers/ieee1394/video1394.c   2010-02-24 13:52:17.000000000 -0500
23312 +++ linux-2.6.33/drivers/ieee1394/video1394.c   2010-03-07 12:23:36.021704836 -0500
23313 @@ -1311,7 +1311,7 @@ static const struct ieee1394_device_id v
23314                  .specifier_id   = CAMERA_UNIT_SPEC_ID_ENTRY & 0xffffff,
23315                  .version        = (CAMERA_SW_VERSION_ENTRY + 2) & 0xffffff
23316          },
23317 -       { }
23318 +       { 0, 0, 0, 0, 0, 0 }
23319  };
23320
23321  MODULE_DEVICE_TABLE(ieee1394, video1394_id_table);
23322 diff -urNp linux-2.6.33/drivers/infiniband/core/cm.c linux-2.6.33/drivers/infiniband/core/cm.c
23323 --- linux-2.6.33/drivers/infiniband/core/cm.c   2010-02-24 13:52:17.000000000 -0500
23324 +++ linux-2.6.33/drivers/infiniband/core/cm.c   2010-03-07 12:23:36.021704836 -0500
23325 @@ -112,7 +112,7 @@ static char const counter_group_names[CM
23326
23327  struct cm_counter_group {
23328         struct kobject obj;
23329 -       atomic_long_t counter[CM_ATTR_COUNT];
23330 +       atomic_long_unchecked_t counter[CM_ATTR_COUNT];
23331  };
23332
23333  struct cm_counter_attribute {
23334 @@ -1386,7 +1386,7 @@ static void cm_dup_req_handler(struct cm
23335         struct ib_mad_send_buf *msg = NULL;
23336         int ret;
23337
23338 -       atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23339 +       atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23340                         counter[CM_REQ_COUNTER]);
23341
23342         /* Quick state check to discard duplicate REQs. */
23343 @@ -1764,7 +1764,7 @@ static void cm_dup_rep_handler(struct cm
23344         if (!cm_id_priv)
23345                 return;
23346
23347 -       atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23348 +       atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23349                         counter[CM_REP_COUNTER]);
23350         ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
23351         if (ret)
23352 @@ -1931,7 +1931,7 @@ static int cm_rtu_handler(struct cm_work
23353         if (cm_id_priv->id.state != IB_CM_REP_SENT &&
23354             cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
23355                 spin_unlock_irq(&cm_id_priv->lock);
23356 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23357 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23358                                 counter[CM_RTU_COUNTER]);
23359                 goto out;
23360         }
23361 @@ -2110,7 +2110,7 @@ static int cm_dreq_handler(struct cm_wor
23362         cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
23363                                    dreq_msg->local_comm_id);
23364         if (!cm_id_priv) {
23365 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23366 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23367                                 counter[CM_DREQ_COUNTER]);
23368                 cm_issue_drep(work->port, work->mad_recv_wc);
23369                 return -EINVAL;
23370 @@ -2131,7 +2131,7 @@ static int cm_dreq_handler(struct cm_wor
23371         case IB_CM_MRA_REP_RCVD:
23372                 break;
23373         case IB_CM_TIMEWAIT:
23374 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23375 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23376                                 counter[CM_DREQ_COUNTER]);
23377                 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
23378                         goto unlock;
23379 @@ -2145,7 +2145,7 @@ static int cm_dreq_handler(struct cm_wor
23380                         cm_free_msg(msg);
23381                 goto deref;
23382         case IB_CM_DREQ_RCVD:
23383 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23384 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23385                                 counter[CM_DREQ_COUNTER]);
23386                 goto unlock;
23387         default:
23388 @@ -2501,7 +2501,7 @@ static int cm_mra_handler(struct cm_work
23389                     ib_modify_mad(cm_id_priv->av.port->mad_agent,
23390                                   cm_id_priv->msg, timeout)) {
23391                         if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
23392 -                               atomic_long_inc(&work->port->
23393 +                               atomic_long_inc_unchecked(&work->port->
23394                                                 counter_group[CM_RECV_DUPLICATES].
23395                                                 counter[CM_MRA_COUNTER]);
23396                         goto out;
23397 @@ -2510,7 +2510,7 @@ static int cm_mra_handler(struct cm_work
23398                 break;
23399         case IB_CM_MRA_REQ_RCVD:
23400         case IB_CM_MRA_REP_RCVD:
23401 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23402 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23403                                 counter[CM_MRA_COUNTER]);
23404                 /* fall through */
23405         default:
23406 @@ -2672,7 +2672,7 @@ static int cm_lap_handler(struct cm_work
23407         case IB_CM_LAP_IDLE:
23408                 break;
23409         case IB_CM_MRA_LAP_SENT:
23410 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23411 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23412                                 counter[CM_LAP_COUNTER]);
23413                 if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
23414                         goto unlock;
23415 @@ -2688,7 +2688,7 @@ static int cm_lap_handler(struct cm_work
23416                         cm_free_msg(msg);
23417                 goto deref;
23418         case IB_CM_LAP_RCVD:
23419 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23420 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23421                                 counter[CM_LAP_COUNTER]);
23422                 goto unlock;
23423         default:
23424 @@ -2972,7 +2972,7 @@ static int cm_sidr_req_handler(struct cm
23425         cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
23426         if (cur_cm_id_priv) {
23427                 spin_unlock_irq(&cm.lock);
23428 -               atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
23429 +               atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
23430                                 counter[CM_SIDR_REQ_COUNTER]);
23431                 goto out; /* Duplicate message. */
23432         }
23433 @@ -3183,10 +3183,10 @@ static void cm_send_handler(struct ib_ma
23434         if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
23435                 msg->retries = 1;
23436
23437 -       atomic_long_add(1 + msg->retries,
23438 +       atomic_long_add_unchecked(1 + msg->retries,
23439                         &port->counter_group[CM_XMIT].counter[attr_index]);
23440         if (msg->retries)
23441 -               atomic_long_add(msg->retries,
23442 +               atomic_long_add_unchecked(msg->retries,
23443                                 &port->counter_group[CM_XMIT_RETRIES].
23444                                 counter[attr_index]);
23445
23446 @@ -3396,7 +3396,7 @@ static void cm_recv_handler(struct ib_ma
23447         }
23448
23449         attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
23450 -       atomic_long_inc(&port->counter_group[CM_RECV].
23451 +       atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
23452                         counter[attr_id - CM_ATTR_ID_OFFSET]);
23453
23454         work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
23455 @@ -3594,10 +3594,10 @@ static ssize_t cm_show_counter(struct ko
23456         cm_attr = container_of(attr, struct cm_counter_attribute, attr);
23457
23458         return sprintf(buf, "%ld\n",
23459 -                      atomic_long_read(&group->counter[cm_attr->index]));
23460 +                      atomic_long_read_unchecked(&group->counter[cm_attr->index]));
23461  }
23462
23463 -static struct sysfs_ops cm_counter_ops = {
23464 +static const struct sysfs_ops cm_counter_ops = {
23465         .show = cm_show_counter
23466  };
23467
23468 diff -urNp linux-2.6.33/drivers/infiniband/core/sysfs.c linux-2.6.33/drivers/infiniband/core/sysfs.c
23469 --- linux-2.6.33/drivers/infiniband/core/sysfs.c        2010-02-24 13:52:17.000000000 -0500
23470 +++ linux-2.6.33/drivers/infiniband/core/sysfs.c        2010-03-07 12:23:36.021704836 -0500
23471 @@ -79,7 +79,7 @@ static ssize_t port_attr_show(struct kob
23472         return port_attr->show(p, port_attr, buf);
23473  }
23474
23475 -static struct sysfs_ops port_sysfs_ops = {
23476 +static const struct sysfs_ops port_sysfs_ops = {
23477         .show = port_attr_show
23478  };
23479
23480 diff -urNp linux-2.6.33/drivers/input/keyboard/atkbd.c linux-2.6.33/drivers/input/keyboard/atkbd.c
23481 --- linux-2.6.33/drivers/input/keyboard/atkbd.c 2010-02-24 13:52:17.000000000 -0500
23482 +++ linux-2.6.33/drivers/input/keyboard/atkbd.c 2010-03-07 12:23:36.021704836 -0500
23483 @@ -1229,7 +1229,7 @@ static struct serio_device_id atkbd_seri
23484                 .id     = SERIO_ANY,
23485                 .extra  = SERIO_ANY,
23486         },
23487 -       { 0 }
23488 +       { 0, 0, 0, 0 }
23489  };
23490
23491  MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
23492 diff -urNp linux-2.6.33/drivers/input/mouse/lifebook.c linux-2.6.33/drivers/input/mouse/lifebook.c
23493 --- linux-2.6.33/drivers/input/mouse/lifebook.c 2010-02-24 13:52:17.000000000 -0500
23494 +++ linux-2.6.33/drivers/input/mouse/lifebook.c 2010-03-07 12:23:36.021704836 -0500
23495 @@ -122,7 +122,7 @@ static const struct dmi_system_id __init
23496                         DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
23497                 },
23498         },
23499 -       { }
23500 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
23501  };
23502
23503  void __init lifebook_module_init(void)
23504 diff -urNp linux-2.6.33/drivers/input/mouse/psmouse-base.c linux-2.6.33/drivers/input/mouse/psmouse-base.c
23505 --- linux-2.6.33/drivers/input/mouse/psmouse-base.c     2010-02-24 13:52:17.000000000 -0500
23506 +++ linux-2.6.33/drivers/input/mouse/psmouse-base.c     2010-03-07 12:23:36.021704836 -0500
23507 @@ -1442,7 +1442,7 @@ static struct serio_device_id psmouse_se
23508                 .id     = SERIO_ANY,
23509                 .extra  = SERIO_ANY,
23510         },
23511 -       { 0 }
23512 +       { 0, 0, 0, 0 }
23513  };
23514
23515  MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
23516 diff -urNp linux-2.6.33/drivers/input/mouse/synaptics.c linux-2.6.33/drivers/input/mouse/synaptics.c
23517 --- linux-2.6.33/drivers/input/mouse/synaptics.c        2010-02-24 13:52:17.000000000 -0500
23518 +++ linux-2.6.33/drivers/input/mouse/synaptics.c        2010-03-07 12:23:36.021704836 -0500
23519 @@ -438,7 +438,7 @@ static void synaptics_process_packet(str
23520                                 break;
23521                         case 2:
23522                                 if (SYN_MODEL_PEN(priv->model_id))
23523 -                                       ;   /* Nothing, treat a pen as a single finger */
23524 +                                       break;   /* Nothing, treat a pen as a single finger */
23525                                 break;
23526                         case 4 ... 15:
23527                                 if (SYN_CAP_PALMDETECT(priv->capabilities))
23528 @@ -654,7 +654,6 @@ static const struct dmi_system_id __init
23529                         DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
23530                         DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
23531                 },
23532 -
23533         },
23534         {
23535                 /* Toshiba Portege M300 */
23536 @@ -663,9 +662,8 @@ static const struct dmi_system_id __init
23537                         DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
23538                         DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
23539                 },
23540 -
23541         },
23542 -       { }
23543 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23544  #endif
23545  };
23546
23547 diff -urNp linux-2.6.33/drivers/input/mousedev.c linux-2.6.33/drivers/input/mousedev.c
23548 --- linux-2.6.33/drivers/input/mousedev.c       2010-02-24 13:52:17.000000000 -0500
23549 +++ linux-2.6.33/drivers/input/mousedev.c       2010-03-07 12:23:36.021704836 -0500
23550 @@ -760,7 +760,7 @@ static ssize_t mousedev_read(struct file
23551
23552         spin_unlock_irq(&client->packet_lock);
23553
23554 -       if (copy_to_user(buffer, data, count))
23555 +       if (count > sizeof(data) || copy_to_user(buffer, data, count))
23556                 return -EFAULT;
23557
23558         return count;
23559 @@ -1057,7 +1057,7 @@ static struct input_handler mousedev_han
23560
23561  #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
23562  static struct miscdevice psaux_mouse = {
23563 -       PSMOUSE_MINOR, "psaux", &mousedev_fops
23564 +       PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
23565  };
23566  static int psaux_registered;
23567  #endif
23568 diff -urNp linux-2.6.33/drivers/input/serio/i8042-x86ia64io.h linux-2.6.33/drivers/input/serio/i8042-x86ia64io.h
23569 --- linux-2.6.33/drivers/input/serio/i8042-x86ia64io.h  2010-02-24 13:52:17.000000000 -0500
23570 +++ linux-2.6.33/drivers/input/serio/i8042-x86ia64io.h  2010-03-07 12:23:36.021704836 -0500
23571 @@ -172,7 +172,7 @@ static const struct dmi_system_id __init
23572                         DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
23573                 },
23574         },
23575 -       { }
23576 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23577  };
23578
23579  /*
23580 @@ -402,7 +402,7 @@ static const struct dmi_system_id __init
23581                         DMI_MATCH(DMI_PRODUCT_VERSION, "0100"),
23582                 },
23583         },
23584 -       { }
23585 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23586  };
23587
23588  static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
23589 @@ -469,7 +469,7 @@ static const struct dmi_system_id __init
23590                         DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
23591                 },
23592         },
23593 -       { }
23594 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23595  };
23596
23597  #ifdef CONFIG_PNP
23598 @@ -488,7 +488,7 @@ static const struct dmi_system_id __init
23599                         DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
23600                 },
23601         },
23602 -       { }
23603 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23604  };
23605
23606  static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
23607 @@ -512,7 +512,7 @@ static const struct dmi_system_id __init
23608                         DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
23609                 },
23610         },
23611 -       { }
23612 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23613  };
23614  #endif
23615
23616 @@ -586,7 +586,7 @@ static const struct dmi_system_id __init
23617                         DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
23618                 },
23619         },
23620 -       { }
23621 +       { NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
23622  };
23623
23624  #endif /* CONFIG_X86 */
23625 diff -urNp linux-2.6.33/drivers/input/serio/serio_raw.c linux-2.6.33/drivers/input/serio/serio_raw.c
23626 --- linux-2.6.33/drivers/input/serio/serio_raw.c        2010-02-24 13:52:17.000000000 -0500
23627 +++ linux-2.6.33/drivers/input/serio/serio_raw.c        2010-03-07 12:23:36.021704836 -0500
23628 @@ -377,7 +377,7 @@ static struct serio_device_id serio_raw_
23629                 .id     = SERIO_ANY,
23630                 .extra  = SERIO_ANY,
23631         },
23632 -       { 0 }
23633 +       { 0, 0, 0, 0 }
23634  };
23635
23636  MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
23637 diff -urNp linux-2.6.33/drivers/isdn/gigaset/common.c linux-2.6.33/drivers/isdn/gigaset/common.c
23638 --- linux-2.6.33/drivers/isdn/gigaset/common.c  2010-02-24 13:52:17.000000000 -0500
23639 +++ linux-2.6.33/drivers/isdn/gigaset/common.c  2010-03-07 12:23:36.021704836 -0500
23640 @@ -732,7 +732,7 @@ struct cardstate *gigaset_initcs(struct
23641         cs->commands_pending = 0;
23642         cs->cur_at_seq = 0;
23643         cs->gotfwver = -1;
23644 -       cs->open_count = 0;
23645 +       atomic_set(&cs->open_count, 0);
23646         cs->dev = NULL;
23647         cs->tty = NULL;
23648         cs->tty_dev = NULL;
23649 diff -urNp linux-2.6.33/drivers/isdn/gigaset/gigaset.h linux-2.6.33/drivers/isdn/gigaset/gigaset.h
23650 --- linux-2.6.33/drivers/isdn/gigaset/gigaset.h 2010-02-24 13:52:17.000000000 -0500
23651 +++ linux-2.6.33/drivers/isdn/gigaset/gigaset.h 2010-03-07 12:23:36.021704836 -0500
23652 @@ -440,7 +440,7 @@ struct cardstate {
23653         spinlock_t cmdlock;
23654         unsigned curlen, cmdbytes;
23655
23656 -       unsigned open_count;
23657 +       atomic_t open_count;
23658         struct tty_struct *tty;
23659         struct tasklet_struct if_wake_tasklet;
23660         unsigned control_state;
23661 diff -urNp linux-2.6.33/drivers/isdn/gigaset/interface.c linux-2.6.33/drivers/isdn/gigaset/interface.c
23662 --- linux-2.6.33/drivers/isdn/gigaset/interface.c       2010-02-24 13:52:17.000000000 -0500
23663 +++ linux-2.6.33/drivers/isdn/gigaset/interface.c       2010-03-07 12:23:36.025724522 -0500
23664 @@ -165,9 +165,7 @@ static int if_open(struct tty_struct *tt
23665                 return -ERESTARTSYS;
23666         tty->driver_data = cs;
23667
23668 -       ++cs->open_count;
23669 -
23670 -       if (cs->open_count == 1) {
23671 +       if (atomic_inc_return(&cs->open_count) == 1) {
23672                 spin_lock_irqsave(&cs->lock, flags);
23673                 cs->tty = tty;
23674                 spin_unlock_irqrestore(&cs->lock, flags);
23675 @@ -195,10 +193,10 @@ static void if_close(struct tty_struct *
23676
23677         if (!cs->connected)
23678                 gig_dbg(DEBUG_IF, "not connected");     /* nothing to do */
23679 -       else if (!cs->open_count)
23680 +       else if (!atomic_read(&cs->open_count))
23681                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23682         else {
23683 -               if (!--cs->open_count) {
23684 +               if (!atomic_dec_return(&cs->open_count)) {
23685                         spin_lock_irqsave(&cs->lock, flags);
23686                         cs->tty = NULL;
23687                         spin_unlock_irqrestore(&cs->lock, flags);
23688 @@ -233,7 +231,7 @@ static int if_ioctl(struct tty_struct *t
23689         if (!cs->connected) {
23690                 gig_dbg(DEBUG_IF, "not connected");
23691                 retval = -ENODEV;
23692 -       } else if (!cs->open_count)
23693 +       } else if (!atomic_read(&cs->open_count))
23694                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23695         else {
23696                 retval = 0;
23697 @@ -360,7 +358,7 @@ static int if_write(struct tty_struct *t
23698         if (!cs->connected) {
23699                 gig_dbg(DEBUG_IF, "not connected");
23700                 retval = -ENODEV;
23701 -       } else if (!cs->open_count)
23702 +       } else if (!atomic_read(&cs->open_count))
23703                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23704         else if (cs->mstate != MS_LOCKED) {
23705                 dev_warn(cs->dev, "can't write to unlocked device\n");
23706 @@ -394,7 +392,7 @@ static int if_write_room(struct tty_stru
23707         if (!cs->connected) {
23708                 gig_dbg(DEBUG_IF, "not connected");
23709                 retval = -ENODEV;
23710 -       } else if (!cs->open_count)
23711 +       } else if (!atomic_read(&cs->open_count))
23712                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23713         else if (cs->mstate != MS_LOCKED) {
23714                 dev_warn(cs->dev, "can't write to unlocked device\n");
23715 @@ -424,7 +422,7 @@ static int if_chars_in_buffer(struct tty
23716
23717         if (!cs->connected)
23718                 gig_dbg(DEBUG_IF, "not connected");
23719 -       else if (!cs->open_count)
23720 +       else if (!atomic_read(&cs->open_count))
23721                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23722         else if (cs->mstate != MS_LOCKED)
23723                 dev_warn(cs->dev, "can't write to unlocked device\n");
23724 @@ -452,7 +450,7 @@ static void if_throttle(struct tty_struc
23725
23726         if (!cs->connected)
23727                 gig_dbg(DEBUG_IF, "not connected");     /* nothing to do */
23728 -       else if (!cs->open_count)
23729 +       else if (!atomic_read(&cs->open_count))
23730                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23731         else
23732                 gig_dbg(DEBUG_ANY, "%s: not implemented\n", __func__);
23733 @@ -476,7 +474,7 @@ static void if_unthrottle(struct tty_str
23734
23735         if (!cs->connected)
23736                 gig_dbg(DEBUG_IF, "not connected");     /* nothing to do */
23737 -       else if (!cs->open_count)
23738 +       else if (!atomic_read(&cs->open_count))
23739                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23740         else
23741                 gig_dbg(DEBUG_ANY, "%s: not implemented\n", __func__);
23742 @@ -507,7 +505,7 @@ static void if_set_termios(struct tty_st
23743                 goto out;
23744         }
23745
23746 -       if (!cs->open_count) {
23747 +       if (!atomic_read(&cs->open_count)) {
23748                 dev_warn(cs->dev, "%s: device not opened\n", __func__);
23749                 goto out;
23750         }
23751 diff -urNp linux-2.6.33/drivers/isdn/hardware/avm/b1.c linux-2.6.33/drivers/isdn/hardware/avm/b1.c
23752 --- linux-2.6.33/drivers/isdn/hardware/avm/b1.c 2010-02-24 13:52:17.000000000 -0500
23753 +++ linux-2.6.33/drivers/isdn/hardware/avm/b1.c 2010-03-07 12:23:36.025724522 -0500
23754 @@ -173,7 +173,7 @@ int b1_load_t4file(avmcard *card, capilo
23755         }
23756         if (left) {
23757                 if (t4file->user) {
23758 -                       if (copy_from_user(buf, dp, left))
23759 +                       if (left > sizeof(buf) || copy_from_user(buf, dp, left))
23760                                 return -EFAULT;
23761                 } else {
23762                         memcpy(buf, dp, left);
23763 @@ -221,7 +221,7 @@ int b1_load_config(avmcard *card, capilo
23764         }
23765         if (left) {
23766                 if (config->user) {
23767 -                       if (copy_from_user(buf, dp, left))
23768 +                       if (left > sizeof(buf) || copy_from_user(buf, dp, left))
23769                                 return -EFAULT;
23770                 } else {
23771                         memcpy(buf, dp, left);
23772 diff -urNp linux-2.6.33/drivers/isdn/icn/icn.c linux-2.6.33/drivers/isdn/icn/icn.c
23773 --- linux-2.6.33/drivers/isdn/icn/icn.c 2010-02-24 13:52:17.000000000 -0500
23774 +++ linux-2.6.33/drivers/isdn/icn/icn.c 2010-03-07 12:23:36.025724522 -0500
23775 @@ -1044,7 +1044,7 @@ icn_writecmd(const u_char * buf, int len
23776                 if (count > len)
23777                         count = len;
23778                 if (user) {
23779 -                       if (copy_from_user(msg, buf, count))
23780 +                       if (count > sizeof(msg) || copy_from_user(msg, buf, count))
23781                                 return -EFAULT;
23782                 } else
23783                         memcpy(msg, buf, count);
23784 diff -urNp linux-2.6.33/drivers/lguest/core.c linux-2.6.33/drivers/lguest/core.c
23785 --- linux-2.6.33/drivers/lguest/core.c  2010-02-24 13:52:17.000000000 -0500
23786 +++ linux-2.6.33/drivers/lguest/core.c  2010-03-07 12:23:36.025724522 -0500
23787 @@ -91,9 +91,17 @@ static __init int map_switcher(void)
23788          * it's worked so far.  The end address needs +1 because __get_vm_area
23789          * allocates an extra guard page, so we need space for that.
23790          */
23791 +
23792 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
23793 +       switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
23794 +                                    VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
23795 +                                    + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
23796 +#else
23797         switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
23798                                      VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
23799                                      + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
23800 +#endif
23801 +
23802         if (!switcher_vma) {
23803                 err = -ENOMEM;
23804                 printk("lguest: could not map switcher pages high\n");
23805 diff -urNp linux-2.6.33/drivers/macintosh/via-pmu-backlight.c linux-2.6.33/drivers/macintosh/via-pmu-backlight.c
23806 --- linux-2.6.33/drivers/macintosh/via-pmu-backlight.c  2010-02-24 13:52:17.000000000 -0500
23807 +++ linux-2.6.33/drivers/macintosh/via-pmu-backlight.c  2010-03-07 12:23:36.025724522 -0500
23808 @@ -15,7 +15,7 @@
23809
23810  #define MAX_PMU_LEVEL 0xFF
23811
23812 -static struct backlight_ops pmu_backlight_data;
23813 +static const struct backlight_ops pmu_backlight_data;
23814  static DEFINE_SPINLOCK(pmu_backlight_lock);
23815  static int sleeping, uses_pmu_bl;
23816  static u8 bl_curve[FB_BACKLIGHT_LEVELS];
23817 @@ -115,7 +115,7 @@ static int pmu_backlight_get_brightness(
23818         return bd->props.brightness;
23819  }
23820
23821 -static struct backlight_ops pmu_backlight_data = {
23822 +static const struct backlight_ops pmu_backlight_data = {
23823         .get_brightness = pmu_backlight_get_brightness,
23824         .update_status  = pmu_backlight_update_status,
23825
23826 diff -urNp linux-2.6.33/drivers/macintosh/via-pmu.c linux-2.6.33/drivers/macintosh/via-pmu.c
23827 --- linux-2.6.33/drivers/macintosh/via-pmu.c    2010-02-24 13:52:17.000000000 -0500
23828 +++ linux-2.6.33/drivers/macintosh/via-pmu.c    2010-03-07 12:23:36.025724522 -0500
23829 @@ -2254,7 +2254,7 @@ static int pmu_sleep_valid(suspend_state
23830                 && (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
23831  }
23832
23833 -static struct platform_suspend_ops pmu_pm_ops = {
23834 +static const struct platform_suspend_ops pmu_pm_ops = {
23835         .enter = powerbook_sleep,
23836         .valid = pmu_sleep_valid,
23837  };
23838 diff -urNp linux-2.6.33/drivers/md/bitmap.c linux-2.6.33/drivers/md/bitmap.c
23839 --- linux-2.6.33/drivers/md/bitmap.c    2010-02-24 13:52:17.000000000 -0500
23840 +++ linux-2.6.33/drivers/md/bitmap.c    2010-03-07 12:23:36.025724522 -0500
23841 @@ -58,7 +58,7 @@
23842  #  if DEBUG > 0
23843  #    define PRINTK(x...) printk(KERN_DEBUG x)
23844  #  else
23845 -#    define PRINTK(x...)
23846 +#    define PRINTK(x...) do {} while (0)
23847  #  endif
23848  #endif
23849
23850 diff -urNp linux-2.6.33/drivers/md/dm-sysfs.c linux-2.6.33/drivers/md/dm-sysfs.c
23851 --- linux-2.6.33/drivers/md/dm-sysfs.c  2010-02-24 13:52:17.000000000 -0500
23852 +++ linux-2.6.33/drivers/md/dm-sysfs.c  2010-03-07 12:23:36.025724522 -0500
23853 @@ -75,7 +75,7 @@ static struct attribute *dm_attrs[] = {
23854         NULL,
23855  };
23856
23857 -static struct sysfs_ops dm_sysfs_ops = {
23858 +static const struct sysfs_ops dm_sysfs_ops = {
23859         .show   = dm_attr_show,
23860  };
23861
23862 diff -urNp linux-2.6.33/drivers/md/dm-table.c linux-2.6.33/drivers/md/dm-table.c
23863 --- linux-2.6.33/drivers/md/dm-table.c  2010-02-24 13:52:17.000000000 -0500
23864 +++ linux-2.6.33/drivers/md/dm-table.c  2010-03-07 12:23:36.025724522 -0500
23865 @@ -363,7 +363,7 @@ static int device_area_is_invalid(struct
23866         if (!dev_size)
23867                 return 0;
23868
23869 -       if ((start >= dev_size) || (start + len > dev_size)) {
23870 +       if ((start >= dev_size) || (len > dev_size - start)) {
23871                 DMWARN("%s: %s too small for target: "
23872                        "start=%llu, len=%llu, dev_size=%llu",
23873                        dm_device_name(ti->table->md), bdevname(bdev, b),
23874 diff -urNp linux-2.6.33/drivers/md/md.c linux-2.6.33/drivers/md/md.c
23875 --- linux-2.6.33/drivers/md/md.c        2010-02-24 13:52:17.000000000 -0500
23876 +++ linux-2.6.33/drivers/md/md.c        2010-03-07 12:23:36.025724522 -0500
23877 @@ -2642,7 +2642,7 @@ static void rdev_free(struct kobject *ko
23878         mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
23879         kfree(rdev);
23880  }
23881 -static struct sysfs_ops rdev_sysfs_ops = {
23882 +static const struct sysfs_ops rdev_sysfs_ops = {
23883         .show           = rdev_attr_show,
23884         .store          = rdev_attr_store,
23885  };
23886 @@ -4059,7 +4059,7 @@ static void md_free(struct kobject *ko)
23887         kfree(mddev);
23888  }
23889
23890 -static struct sysfs_ops md_sysfs_ops = {
23891 +static const struct sysfs_ops md_sysfs_ops = {
23892         .show   = md_attr_show,
23893         .store  = md_attr_store,
23894  };
23895 @@ -6187,7 +6187,7 @@ static int md_seq_show(struct seq_file *
23896                                 chunk_kb ? "KB" : "B");
23897                         if (bitmap->file) {
23898                                 seq_printf(seq, ", file: ");
23899 -                               seq_path(seq, &bitmap->file->f_path, " \t\n");
23900 +                               seq_path(seq, &bitmap->file->f_path, " \t\n\\");
23901                         }
23902
23903                         seq_printf(seq, "\n");
23904 @@ -6281,7 +6281,7 @@ static int is_mddev_idle(mddev_t *mddev,
23905                 struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
23906                 curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
23907                               (int)part_stat_read(&disk->part0, sectors[1]) -
23908 -                             atomic_read(&disk->sync_io);
23909 +                             atomic_read_unchecked(&disk->sync_io);
23910                 /* sync IO will cause sync_io to increase before the disk_stats
23911                  * as sync_io is counted when a request starts, and
23912                  * disk_stats is counted when it completes.
23913 diff -urNp linux-2.6.33/drivers/md/md.h linux-2.6.33/drivers/md/md.h
23914 --- linux-2.6.33/drivers/md/md.h        2010-02-24 13:52:17.000000000 -0500
23915 +++ linux-2.6.33/drivers/md/md.h        2010-03-07 12:23:36.029587202 -0500
23916 @@ -327,7 +327,7 @@ static inline void rdev_dec_pending(mdk_
23917
23918  static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
23919  {
23920 -        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
23921 +       atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
23922  }
23923
23924  struct mdk_personality
23925 diff -urNp linux-2.6.33/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.33/drivers/media/dvb/dvb-core/dvbdev.c
23926 --- linux-2.6.33/drivers/media/dvb/dvb-core/dvbdev.c    2010-02-24 13:52:17.000000000 -0500
23927 +++ linux-2.6.33/drivers/media/dvb/dvb-core/dvbdev.c    2010-03-07 12:23:36.029587202 -0500
23928 @@ -191,6 +191,7 @@ int dvb_register_device(struct dvb_adapt
23929                         const struct dvb_device *template, void *priv, int type)
23930  {
23931         struct dvb_device *dvbdev;
23932 +       /* cannot be const */
23933         struct file_operations *dvbdevfops;
23934         struct device *clsdev;
23935         int minor;
23936 diff -urNp linux-2.6.33/drivers/media/radio/radio-cadet.c linux-2.6.33/drivers/media/radio/radio-cadet.c
23937 --- linux-2.6.33/drivers/media/radio/radio-cadet.c      2010-02-24 13:52:17.000000000 -0500
23938 +++ linux-2.6.33/drivers/media/radio/radio-cadet.c      2010-03-07 12:23:36.029587202 -0500
23939 @@ -347,7 +347,7 @@ static ssize_t cadet_read(struct file *f
23940         while (i < count && dev->rdsin != dev->rdsout)
23941                 readbuf[i++] = dev->rdsbuf[dev->rdsout++];
23942
23943 -       if (copy_to_user(data, readbuf, i))
23944 +       if (i > sizeof(readbuf) || copy_to_user(data, readbuf, i))
23945                 return -EFAULT;
23946         return i;
23947  }
23948 diff -urNp linux-2.6.33/drivers/message/i2o/i2o_proc.c linux-2.6.33/drivers/message/i2o/i2o_proc.c
23949 --- linux-2.6.33/drivers/message/i2o/i2o_proc.c 2010-02-24 13:52:17.000000000 -0500
23950 +++ linux-2.6.33/drivers/message/i2o/i2o_proc.c 2010-03-07 12:23:36.029587202 -0500
23951 @@ -259,13 +259,6 @@ static char *scsi_devices[] = {
23952         "Array Controller Device"
23953  };
23954
23955 -static char *chtostr(u8 * chars, int n)
23956 -{
23957 -       char tmp[256];
23958 -       tmp[0] = 0;
23959 -       return strncat(tmp, (char *)chars, n);
23960 -}
23961 -
23962  static int i2o_report_query_status(struct seq_file *seq, int block_status,
23963                                    char *group)
23964  {
23965 @@ -842,8 +835,7 @@ static int i2o_seq_show_ddm_table(struct
23966
23967                 seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
23968                 seq_printf(seq, "%-#8x", ddm_table.module_id);
23969 -               seq_printf(seq, "%-29s",
23970 -                          chtostr(ddm_table.module_name_version, 28));
23971 +               seq_printf(seq, "%-.28s", ddm_table.module_name_version);
23972                 seq_printf(seq, "%9d  ", ddm_table.data_size);
23973                 seq_printf(seq, "%8d", ddm_table.code_size);
23974
23975 @@ -944,8 +936,8 @@ static int i2o_seq_show_drivers_stored(s
23976
23977                 seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
23978                 seq_printf(seq, "%-#8x", dst->module_id);
23979 -               seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
23980 -               seq_printf(seq, "%-9s", chtostr(dst->date, 8));
23981 +               seq_printf(seq, "%-.28s", dst->module_name_version);
23982 +               seq_printf(seq, "%-.8s", dst->date);
23983                 seq_printf(seq, "%8d ", dst->module_size);
23984                 seq_printf(seq, "%8d ", dst->mpb_size);
23985                 seq_printf(seq, "0x%04x", dst->module_flags);
23986 @@ -1276,14 +1268,10 @@ static int i2o_seq_show_dev_identity(str
23987         seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
23988         seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
23989         seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
23990 -       seq_printf(seq, "Vendor info   : %s\n",
23991 -                  chtostr((u8 *) (work32 + 2), 16));
23992 -       seq_printf(seq, "Product info  : %s\n",
23993 -                  chtostr((u8 *) (work32 + 6), 16));
23994 -       seq_printf(seq, "Description   : %s\n",
23995 -                  chtostr((u8 *) (work32 + 10), 16));
23996 -       seq_printf(seq, "Product rev.  : %s\n",
23997 -                  chtostr((u8 *) (work32 + 14), 8));
23998 +       seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
23999 +       seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
24000 +       seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
24001 +       seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
24002
24003         seq_printf(seq, "Serial number : ");
24004         print_serial_number(seq, (u8 *) (work32 + 16),
24005 @@ -1328,10 +1316,8 @@ static int i2o_seq_show_ddm_identity(str
24006         }
24007
24008         seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
24009 -       seq_printf(seq, "Module name         : %s\n",
24010 -                  chtostr(result.module_name, 24));
24011 -       seq_printf(seq, "Module revision     : %s\n",
24012 -                  chtostr(result.module_rev, 8));
24013 +       seq_printf(seq, "Module name         : %.24s\n", result.module_name);
24014 +       seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
24015
24016         seq_printf(seq, "Serial number       : ");
24017         print_serial_number(seq, result.serial_number, sizeof(result) - 36);
24018 @@ -1362,14 +1348,10 @@ static int i2o_seq_show_uinfo(struct seq
24019                 return 0;
24020         }
24021
24022 -       seq_printf(seq, "Device name     : %s\n",
24023 -                  chtostr(result.device_name, 64));
24024 -       seq_printf(seq, "Service name    : %s\n",
24025 -                  chtostr(result.service_name, 64));
24026 -       seq_printf(seq, "Physical name   : %s\n",
24027 -                  chtostr(result.physical_location, 64));
24028 -       seq_printf(seq, "Instance number : %s\n",
24029 -                  chtostr(result.instance_number, 4));
24030 +       seq_printf(seq, "Device name     : %.64s\n", result.device_name);
24031 +       seq_printf(seq, "Service name    : %.64s\n", result.service_name);
24032 +       seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
24033 +       seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
24034
24035         return 0;
24036  }
24037 diff -urNp linux-2.6.33/drivers/misc/kgdbts.c linux-2.6.33/drivers/misc/kgdbts.c
24038 --- linux-2.6.33/drivers/misc/kgdbts.c  2010-02-24 13:52:17.000000000 -0500
24039 +++ linux-2.6.33/drivers/misc/kgdbts.c  2010-03-07 12:23:36.029587202 -0500
24040 @@ -118,7 +118,7 @@
24041         } while (0)
24042  #define MAX_CONFIG_LEN         40
24043
24044 -static struct kgdb_io kgdbts_io_ops;
24045 +static const struct kgdb_io kgdbts_io_ops;
24046  static char get_buf[BUFMAX];
24047  static int get_buf_cnt;
24048  static char put_buf[BUFMAX];
24049 @@ -1108,7 +1108,7 @@ static void kgdbts_post_exp_handler(void
24050                 module_put(THIS_MODULE);
24051  }
24052
24053 -static struct kgdb_io kgdbts_io_ops = {
24054 +static const struct kgdb_io kgdbts_io_ops = {
24055         .name                   = "kgdbts",
24056         .read_char              = kgdbts_get_char,
24057         .write_char             = kgdbts_put_char,
24058 diff -urNp linux-2.6.33/drivers/misc/sgi-gru/gruhandles.c linux-2.6.33/drivers/misc/sgi-gru/gruhandles.c
24059 --- linux-2.6.33/drivers/misc/sgi-gru/gruhandles.c      2010-02-24 13:52:17.000000000 -0500
24060 +++ linux-2.6.33/drivers/misc/sgi-gru/gruhandles.c      2010-03-07 12:23:36.029587202 -0500
24061 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
24062         unsigned long nsec;
24063
24064         nsec = CLKS2NSEC(clks);
24065 -       atomic_long_inc(&mcs_op_statistics[op].count);
24066 -       atomic_long_add(nsec, &mcs_op_statistics[op].total);
24067 +       atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
24068 +       atomic_long_add_unchecked(nsec, &mcs_op_statistics[op].total);
24069         if (mcs_op_statistics[op].max < nsec)
24070                 mcs_op_statistics[op].max = nsec;
24071  }
24072 diff -urNp linux-2.6.33/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.33/drivers/misc/sgi-gru/gruprocfs.c
24073 --- linux-2.6.33/drivers/misc/sgi-gru/gruprocfs.c       2010-02-24 13:52:17.000000000 -0500
24074 +++ linux-2.6.33/drivers/misc/sgi-gru/gruprocfs.c       2010-03-07 12:23:36.029587202 -0500
24075 @@ -32,9 +32,9 @@
24076
24077  #define printstat(s, f)                printstat_val(s, &gru_stats.f, #f)
24078
24079 -static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
24080 +static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
24081  {
24082 -       unsigned long val = atomic_long_read(v);
24083 +       unsigned long val = atomic_long_read_unchecked(v);
24084
24085         seq_printf(s, "%16lu %s\n", val, id);
24086  }
24087 @@ -134,8 +134,8 @@ static int mcs_statistics_show(struct se
24088
24089         seq_printf(s, "%-20s%12s%12s%12s\n", "#id", "count", "aver-clks", "max-clks");
24090         for (op = 0; op < mcsop_last; op++) {
24091 -               count = atomic_long_read(&mcs_op_statistics[op].count);
24092 -               total = atomic_long_read(&mcs_op_statistics[op].total);
24093 +               count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
24094 +               total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
24095                 max = mcs_op_statistics[op].max;
24096                 seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
24097                            count ? total / count : 0, max);
24098 diff -urNp linux-2.6.33/drivers/misc/sgi-gru/grutables.h linux-2.6.33/drivers/misc/sgi-gru/grutables.h
24099 --- linux-2.6.33/drivers/misc/sgi-gru/grutables.h       2010-02-24 13:52:17.000000000 -0500
24100 +++ linux-2.6.33/drivers/misc/sgi-gru/grutables.h       2010-03-07 12:23:36.029587202 -0500
24101 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
24102   * GRU statistics.
24103   */
24104  struct gru_stats_s {
24105 -       atomic_long_t vdata_alloc;
24106 -       atomic_long_t vdata_free;
24107 -       atomic_long_t gts_alloc;
24108 -       atomic_long_t gts_free;
24109 -       atomic_long_t gms_alloc;
24110 -       atomic_long_t gms_free;
24111 -       atomic_long_t gts_double_allocate;
24112 -       atomic_long_t assign_context;
24113 -       atomic_long_t assign_context_failed;
24114 -       atomic_long_t free_context;
24115 -       atomic_long_t load_user_context;
24116 -       atomic_long_t load_kernel_context;
24117 -       atomic_long_t lock_kernel_context;
24118 -       atomic_long_t unlock_kernel_context;
24119 -       atomic_long_t steal_user_context;
24120 -       atomic_long_t steal_kernel_context;
24121 -       atomic_long_t steal_context_failed;
24122 -       atomic_long_t nopfn;
24123 -       atomic_long_t asid_new;
24124 -       atomic_long_t asid_next;
24125 -       atomic_long_t asid_wrap;
24126 -       atomic_long_t asid_reuse;
24127 -       atomic_long_t intr;
24128 -       atomic_long_t intr_cbr;
24129 -       atomic_long_t intr_tfh;
24130 -       atomic_long_t intr_spurious;
24131 -       atomic_long_t intr_mm_lock_failed;
24132 -       atomic_long_t call_os;
24133 -       atomic_long_t call_os_wait_queue;
24134 -       atomic_long_t user_flush_tlb;
24135 -       atomic_long_t user_unload_context;
24136 -       atomic_long_t user_exception;
24137 -       atomic_long_t set_context_option;
24138 -       atomic_long_t check_context_retarget_intr;
24139 -       atomic_long_t check_context_unload;
24140 -       atomic_long_t tlb_dropin;
24141 -       atomic_long_t tlb_preload_page;
24142 -       atomic_long_t tlb_dropin_fail_no_asid;
24143 -       atomic_long_t tlb_dropin_fail_upm;
24144 -       atomic_long_t tlb_dropin_fail_invalid;
24145 -       atomic_long_t tlb_dropin_fail_range_active;
24146 -       atomic_long_t tlb_dropin_fail_idle;
24147 -       atomic_long_t tlb_dropin_fail_fmm;
24148 -       atomic_long_t tlb_dropin_fail_no_exception;
24149 -       atomic_long_t tfh_stale_on_fault;
24150 -       atomic_long_t mmu_invalidate_range;
24151 -       atomic_long_t mmu_invalidate_page;
24152 -       atomic_long_t flush_tlb;
24153 -       atomic_long_t flush_tlb_gru;
24154 -       atomic_long_t flush_tlb_gru_tgh;
24155 -       atomic_long_t flush_tlb_gru_zero_asid;
24156 -
24157 -       atomic_long_t copy_gpa;
24158 -       atomic_long_t read_gpa;
24159 -
24160 -       atomic_long_t mesq_receive;
24161 -       atomic_long_t mesq_receive_none;
24162 -       atomic_long_t mesq_send;
24163 -       atomic_long_t mesq_send_failed;
24164 -       atomic_long_t mesq_noop;
24165 -       atomic_long_t mesq_send_unexpected_error;
24166 -       atomic_long_t mesq_send_lb_overflow;
24167 -       atomic_long_t mesq_send_qlimit_reached;
24168 -       atomic_long_t mesq_send_amo_nacked;
24169 -       atomic_long_t mesq_send_put_nacked;
24170 -       atomic_long_t mesq_page_overflow;
24171 -       atomic_long_t mesq_qf_locked;
24172 -       atomic_long_t mesq_qf_noop_not_full;
24173 -       atomic_long_t mesq_qf_switch_head_failed;
24174 -       atomic_long_t mesq_qf_unexpected_error;
24175 -       atomic_long_t mesq_noop_unexpected_error;
24176 -       atomic_long_t mesq_noop_lb_overflow;
24177 -       atomic_long_t mesq_noop_qlimit_reached;
24178 -       atomic_long_t mesq_noop_amo_nacked;
24179 -       atomic_long_t mesq_noop_put_nacked;
24180 -       atomic_long_t mesq_noop_page_overflow;
24181 +       atomic_long_unchecked_t vdata_alloc;
24182 +       atomic_long_unchecked_t vdata_free;
24183 +       atomic_long_unchecked_t gts_alloc;
24184 +       atomic_long_unchecked_t gts_free;
24185 +       atomic_long_unchecked_t gms_alloc;
24186 +       atomic_long_unchecked_t gms_free;
24187 +       atomic_long_unchecked_t gts_double_allocate;
24188 +       atomic_long_unchecked_t assign_context;
24189 +       atomic_long_unchecked_t assign_context_failed;
24190 +       atomic_long_unchecked_t free_context;
24191 +       atomic_long_unchecked_t load_user_context;
24192 +       atomic_long_unchecked_t load_kernel_context;
24193 +       atomic_long_unchecked_t lock_kernel_context;
24194 +       atomic_long_unchecked_t unlock_kernel_context;
24195 +       atomic_long_unchecked_t steal_user_context;
24196 +       atomic_long_unchecked_t steal_kernel_context;
24197 +       atomic_long_unchecked_t steal_context_failed;
24198 +       atomic_long_unchecked_t nopfn;
24199 +       atomic_long_unchecked_t asid_new;
24200 +       atomic_long_unchecked_t asid_next;
24201 +       atomic_long_unchecked_t asid_wrap;
24202 +       atomic_long_unchecked_t asid_reuse;
24203 +       atomic_long_unchecked_t intr;
24204 +       atomic_long_unchecked_t intr_cbr;
24205 +       atomic_long_unchecked_t intr_tfh;
24206 +       atomic_long_unchecked_t intr_spurious;
24207 +       atomic_long_unchecked_t intr_mm_lock_failed;
24208 +       atomic_long_unchecked_t call_os;
24209 +       atomic_long_unchecked_t call_os_wait_queue;
24210 +       atomic_long_unchecked_t user_flush_tlb;
24211 +       atomic_long_unchecked_t user_unload_context;
24212 +       atomic_long_unchecked_t user_exception;
24213 +       atomic_long_unchecked_t set_context_option;
24214 +       atomic_long_unchecked_t check_context_retarget_intr;
24215 +       atomic_long_unchecked_t check_context_unload;
24216 +       atomic_long_unchecked_t tlb_dropin;
24217 +       atomic_long_unchecked_t tlb_preload_page;
24218 +       atomic_long_unchecked_t tlb_dropin_fail_no_asid;
24219 +       atomic_long_unchecked_t tlb_dropin_fail_upm;
24220 +       atomic_long_unchecked_t tlb_dropin_fail_invalid;
24221 +       atomic_long_unchecked_t tlb_dropin_fail_range_active;
24222 +       atomic_long_unchecked_t tlb_dropin_fail_idle;
24223 +       atomic_long_unchecked_t tlb_dropin_fail_fmm;
24224 +       atomic_long_unchecked_t tlb_dropin_fail_no_exception;
24225 +       atomic_long_unchecked_t tfh_stale_on_fault;
24226 +       atomic_long_unchecked_t mmu_invalidate_range;
24227 +       atomic_long_unchecked_t mmu_invalidate_page;
24228 +       atomic_long_unchecked_t flush_tlb;
24229 +       atomic_long_unchecked_t flush_tlb_gru;
24230 +       atomic_long_unchecked_t flush_tlb_gru_tgh;
24231 +       atomic_long_unchecked_t flush_tlb_gru_zero_asid;
24232 +
24233 +       atomic_long_unchecked_t copy_gpa;
24234 +       atomic_long_unchecked_t read_gpa;
24235 +
24236 +       atomic_long_unchecked_t mesq_receive;
24237 +       atomic_long_unchecked_t mesq_receive_none;
24238 +       atomic_long_unchecked_t mesq_send;
24239 +       atomic_long_unchecked_t mesq_send_failed;
24240 +       atomic_long_unchecked_t mesq_noop;
24241 +       atomic_long_unchecked_t mesq_send_unexpected_error;
24242 +       atomic_long_unchecked_t mesq_send_lb_overflow;
24243 +       atomic_long_unchecked_t mesq_send_qlimit_reached;
24244 +       atomic_long_unchecked_t mesq_send_amo_nacked;
24245 +       atomic_long_unchecked_t mesq_send_put_nacked;
24246 +       atomic_long_unchecked_t mesq_page_overflow;
24247 +       atomic_long_unchecked_t mesq_qf_locked;
24248 +       atomic_long_unchecked_t mesq_qf_noop_not_full;
24249 +       atomic_long_unchecked_t mesq_qf_switch_head_failed;
24250 +       atomic_long_unchecked_t mesq_qf_unexpected_error;
24251 +       atomic_long_unchecked_t mesq_noop_unexpected_error;
24252 +       atomic_long_unchecked_t mesq_noop_lb_overflow;
24253 +       atomic_long_unchecked_t mesq_noop_qlimit_reached;
24254 +       atomic_long_unchecked_t mesq_noop_amo_nacked;
24255 +       atomic_long_unchecked_t mesq_noop_put_nacked;
24256 +       atomic_long_unchecked_t mesq_noop_page_overflow;
24257
24258  };
24259
24260 @@ -251,8 +251,8 @@ enum mcs_op {cchop_allocate, cchop_start
24261         tghop_invalidate, mcsop_last};
24262
24263  struct mcs_op_statistic {
24264 -       atomic_long_t   count;
24265 -       atomic_long_t   total;
24266 +       atomic_long_unchecked_t count;
24267 +       atomic_long_unchecked_t total;
24268         unsigned long   max;
24269  };
24270
24271 @@ -275,7 +275,7 @@ extern struct mcs_op_statistic mcs_op_st
24272
24273  #define STAT(id)       do {                                            \
24274                                 if (gru_options & OPT_STATS)            \
24275 -                                       atomic_long_inc(&gru_stats.id); \
24276 +                                       atomic_long_inc_unchecked(&gru_stats.id);       \
24277                         } while (0)
24278
24279  #ifdef CONFIG_SGI_GRU_DEBUG
24280 diff -urNp linux-2.6.33/drivers/mtd/devices/doc2000.c linux-2.6.33/drivers/mtd/devices/doc2000.c
24281 --- linux-2.6.33/drivers/mtd/devices/doc2000.c  2010-02-24 13:52:17.000000000 -0500
24282 +++ linux-2.6.33/drivers/mtd/devices/doc2000.c  2010-03-07 12:23:36.029587202 -0500
24283 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
24284
24285                 /* The ECC will not be calculated correctly if less than 512 is written */
24286  /* DBB-
24287 -               if (len != 0x200 && eccbuf)
24288 +               if (len != 0x200)
24289                         printk(KERN_WARNING
24290                                "ECC needs a full sector write (adr: %lx size %lx)\n",
24291                                (long) to, (long) len);
24292 diff -urNp linux-2.6.33/drivers/mtd/devices/doc2001.c linux-2.6.33/drivers/mtd/devices/doc2001.c
24293 --- linux-2.6.33/drivers/mtd/devices/doc2001.c  2010-02-24 13:52:17.000000000 -0500
24294 +++ linux-2.6.33/drivers/mtd/devices/doc2001.c  2010-03-07 12:23:36.029587202 -0500
24295 @@ -395,6 +395,8 @@ static int doc_read (struct mtd_info *mt
24296         /* Don't allow read past end of device */
24297         if (from >= this->totlen)
24298                 return -EINVAL;
24299 +       if (!len)
24300 +               return -EINVAL;
24301
24302         /* Don't allow a single read to cross a 512-byte block boundary */
24303         if (from + len > ((from | 0x1ff) + 1))
24304 diff -urNp linux-2.6.33/drivers/mtd/ubi/build.c linux-2.6.33/drivers/mtd/ubi/build.c
24305 --- linux-2.6.33/drivers/mtd/ubi/build.c        2010-02-24 13:52:17.000000000 -0500
24306 +++ linux-2.6.33/drivers/mtd/ubi/build.c        2010-03-07 12:23:36.029587202 -0500
24307 @@ -1255,7 +1255,7 @@ module_exit(ubi_exit);
24308  static int __init bytes_str_to_int(const char *str)
24309  {
24310         char *endp;
24311 -       unsigned long result;
24312 +       unsigned long result, scale = 1;
24313
24314         result = simple_strtoul(str, &endp, 0);
24315         if (str == endp || result >= INT_MAX) {
24316 @@ -1266,11 +1266,11 @@ static int __init bytes_str_to_int(const
24317
24318         switch (*endp) {
24319         case 'G':
24320 -               result *= 1024;
24321 +               scale *= 1024;
24322         case 'M':
24323 -               result *= 1024;
24324 +               scale *= 1024;
24325         case 'K':
24326 -               result *= 1024;
24327 +               scale *= 1024;
24328                 if (endp[1] == 'i' && endp[2] == 'B')
24329                         endp += 2;
24330         case '\0':
24331 @@ -1281,7 +1281,13 @@ static int __init bytes_str_to_int(const
24332                 return -EINVAL;
24333         }
24334
24335 -       return result;
24336 +       if ((intoverflow_t)result*scale >= INT_MAX) {
24337 +               printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
24338 +                      str);
24339 +               return -EINVAL;
24340 +       }
24341 +
24342 +       return result*scale;
24343  }
24344
24345  /**
24346 diff -urNp linux-2.6.33/drivers/net/e1000e/82571.c linux-2.6.33/drivers/net/e1000e/82571.c
24347 --- linux-2.6.33/drivers/net/e1000e/82571.c     2010-02-24 13:52:17.000000000 -0500
24348 +++ linux-2.6.33/drivers/net/e1000e/82571.c     2010-03-07 12:23:36.029587202 -0500
24349 @@ -207,6 +207,7 @@ static s32 e1000_init_mac_params_82571(s
24350  {
24351         struct e1000_hw *hw = &adapter->hw;
24352         struct e1000_mac_info *mac = &hw->mac;
24353 +       /* cannot be const */
24354         struct e1000_mac_operations *func = &mac->ops;
24355         u32 swsm = 0;
24356         u32 swsm2 = 0;
24357 @@ -1688,7 +1689,7 @@ static void e1000_clear_hw_cntrs_82571(s
24358         er32(ICRXDMTC);
24359  }
24360
24361 -static struct e1000_mac_operations e82571_mac_ops = {
24362 +static const struct e1000_mac_operations e82571_mac_ops = {
24363         /* .check_mng_mode: mac type dependent */
24364         /* .check_for_link: media type dependent */
24365         .id_led_init            = e1000e_id_led_init,
24366 @@ -1708,7 +1709,7 @@ static struct e1000_mac_operations e8257
24367         .setup_led              = e1000e_setup_led_generic,
24368  };
24369
24370 -static struct e1000_phy_operations e82_phy_ops_igp = {
24371 +static const struct e1000_phy_operations e82_phy_ops_igp = {
24372         .acquire                = e1000_get_hw_semaphore_82571,
24373         .check_polarity         = e1000_check_polarity_igp,
24374         .check_reset_block      = e1000e_check_reset_block_generic,
24375 @@ -1726,7 +1727,7 @@ static struct e1000_phy_operations e82_p
24376         .cfg_on_link_up         = NULL,
24377  };
24378
24379 -static struct e1000_phy_operations e82_phy_ops_m88 = {
24380 +static const struct e1000_phy_operations e82_phy_ops_m88 = {
24381         .acquire                = e1000_get_hw_semaphore_82571,
24382         .check_polarity         = e1000_check_polarity_m88,
24383         .check_reset_block      = e1000e_check_reset_block_generic,
24384 @@ -1744,7 +1745,7 @@ static struct e1000_phy_operations e82_p
24385         .cfg_on_link_up         = NULL,
24386  };
24387
24388 -static struct e1000_phy_operations e82_phy_ops_bm = {
24389 +static const struct e1000_phy_operations e82_phy_ops_bm = {
24390         .acquire                = e1000_get_hw_semaphore_82571,
24391         .check_polarity         = e1000_check_polarity_m88,
24392         .check_reset_block      = e1000e_check_reset_block_generic,
24393 @@ -1762,7 +1763,7 @@ static struct e1000_phy_operations e82_p
24394         .cfg_on_link_up         = NULL,
24395  };
24396
24397 -static struct e1000_nvm_operations e82571_nvm_ops = {
24398 +static const struct e1000_nvm_operations e82571_nvm_ops = {
24399         .acquire                = e1000_acquire_nvm_82571,
24400         .read                   = e1000e_read_nvm_eerd,
24401         .release                = e1000_release_nvm_82571,
24402 diff -urNp linux-2.6.33/drivers/net/e1000e/e1000.h linux-2.6.33/drivers/net/e1000e/e1000.h
24403 --- linux-2.6.33/drivers/net/e1000e/e1000.h     2010-02-24 13:52:17.000000000 -0500
24404 +++ linux-2.6.33/drivers/net/e1000e/e1000.h     2010-03-07 12:23:36.029587202 -0500
24405 @@ -379,9 +379,9 @@ struct e1000_info {
24406         u32                     pba;
24407         u32                     max_hw_frame_size;
24408         s32                     (*get_variants)(struct e1000_adapter *);
24409 -       struct e1000_mac_operations *mac_ops;
24410 -       struct e1000_phy_operations *phy_ops;
24411 -       struct e1000_nvm_operations *nvm_ops;
24412 +       const struct e1000_mac_operations *mac_ops;
24413 +       const struct e1000_phy_operations *phy_ops;
24414 +       const struct e1000_nvm_operations *nvm_ops;
24415  };
24416
24417  /* hardware capability, feature, and workaround flags */
24418 diff -urNp linux-2.6.33/drivers/net/e1000e/es2lan.c linux-2.6.33/drivers/net/e1000e/es2lan.c
24419 --- linux-2.6.33/drivers/net/e1000e/es2lan.c    2010-02-24 13:52:17.000000000 -0500
24420 +++ linux-2.6.33/drivers/net/e1000e/es2lan.c    2010-03-07 12:23:36.029587202 -0500
24421 @@ -205,6 +205,7 @@ static s32 e1000_init_mac_params_80003es
24422  {
24423         struct e1000_hw *hw = &adapter->hw;
24424         struct e1000_mac_info *mac = &hw->mac;
24425 +       /* cannot be const */
24426         struct e1000_mac_operations *func = &mac->ops;
24427
24428         /* Set media type */
24429 @@ -1402,7 +1403,7 @@ static void e1000_clear_hw_cntrs_80003es
24430         er32(ICRXDMTC);
24431  }
24432
24433 -static struct e1000_mac_operations es2_mac_ops = {
24434 +static const struct e1000_mac_operations es2_mac_ops = {
24435         .id_led_init            = e1000e_id_led_init,
24436         .check_mng_mode         = e1000e_check_mng_mode_generic,
24437         /* check_for_link dependent on media type */
24438 @@ -1422,7 +1423,7 @@ static struct e1000_mac_operations es2_m
24439         .setup_led              = e1000e_setup_led_generic,
24440  };
24441
24442 -static struct e1000_phy_operations es2_phy_ops = {
24443 +static const struct e1000_phy_operations es2_phy_ops = {
24444         .acquire                = e1000_acquire_phy_80003es2lan,
24445         .check_polarity         = e1000_check_polarity_m88,
24446         .check_reset_block      = e1000e_check_reset_block_generic,
24447 @@ -1440,7 +1441,7 @@ static struct e1000_phy_operations es2_p
24448         .cfg_on_link_up         = e1000_cfg_on_link_up_80003es2lan,
24449  };
24450
24451 -static struct e1000_nvm_operations es2_nvm_ops = {
24452 +static const struct e1000_nvm_operations es2_nvm_ops = {
24453         .acquire                = e1000_acquire_nvm_80003es2lan,
24454         .read                   = e1000e_read_nvm_eerd,
24455         .release                = e1000_release_nvm_80003es2lan,
24456 diff -urNp linux-2.6.33/drivers/net/e1000e/hw.h linux-2.6.33/drivers/net/e1000e/hw.h
24457 --- linux-2.6.33/drivers/net/e1000e/hw.h        2010-02-24 13:52:17.000000000 -0500
24458 +++ linux-2.6.33/drivers/net/e1000e/hw.h        2010-03-07 12:23:36.029587202 -0500
24459 @@ -783,13 +783,13 @@ struct e1000_phy_operations {
24460
24461  /* Function pointers for the NVM. */
24462  struct e1000_nvm_operations {
24463 -       s32  (*acquire)(struct e1000_hw *);
24464 -       s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
24465 -       void (*release)(struct e1000_hw *);
24466 -       s32  (*update)(struct e1000_hw *);
24467 -       s32  (*valid_led_default)(struct e1000_hw *, u16 *);
24468 -       s32  (*validate)(struct e1000_hw *);
24469 -       s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
24470 +       s32  (* const acquire)(struct e1000_hw *);
24471 +       s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
24472 +       void (* const release)(struct e1000_hw *);
24473 +       s32  (* const update)(struct e1000_hw *);
24474 +       s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
24475 +       s32  (* const validate)(struct e1000_hw *);
24476 +       s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
24477  };
24478
24479  struct e1000_mac_info {
24480 @@ -864,6 +864,7 @@ struct e1000_phy_info {
24481  };
24482
24483  struct e1000_nvm_info {
24484 +       /* cannot be const */
24485         struct e1000_nvm_operations ops;
24486
24487         enum e1000_nvm_type type;
24488 diff -urNp linux-2.6.33/drivers/net/e1000e/ich8lan.c linux-2.6.33/drivers/net/e1000e/ich8lan.c
24489 --- linux-2.6.33/drivers/net/e1000e/ich8lan.c   2010-02-24 13:52:17.000000000 -0500
24490 +++ linux-2.6.33/drivers/net/e1000e/ich8lan.c   2010-03-07 12:23:36.033711222 -0500
24491 @@ -3361,7 +3361,7 @@ static void e1000_clear_hw_cntrs_ich8lan
24492         }
24493  }
24494
24495 -static struct e1000_mac_operations ich8_mac_ops = {
24496 +static const struct e1000_mac_operations ich8_mac_ops = {
24497         .id_led_init            = e1000e_id_led_init,
24498         .check_mng_mode         = e1000_check_mng_mode_ich8lan,
24499         .check_for_link         = e1000_check_for_copper_link_ich8lan,
24500 @@ -3379,7 +3379,7 @@ static struct e1000_mac_operations ich8_
24501         /* id_led_init dependent on mac type */
24502  };
24503
24504 -static struct e1000_phy_operations ich8_phy_ops = {
24505 +static const struct e1000_phy_operations ich8_phy_ops = {
24506         .acquire                = e1000_acquire_swflag_ich8lan,
24507         .check_reset_block      = e1000_check_reset_block_ich8lan,
24508         .commit                 = NULL,
24509 @@ -3393,7 +3393,7 @@ static struct e1000_phy_operations ich8_
24510         .write_reg              = e1000e_write_phy_reg_igp,
24511  };
24512
24513 -static struct e1000_nvm_operations ich8_nvm_ops = {
24514 +static const struct e1000_nvm_operations ich8_nvm_ops = {
24515         .acquire                = e1000_acquire_nvm_ich8lan,
24516         .read                   = e1000_read_nvm_ich8lan,
24517         .release                = e1000_release_nvm_ich8lan,
24518 diff -urNp linux-2.6.33/drivers/net/ibmveth.c linux-2.6.33/drivers/net/ibmveth.c
24519 --- linux-2.6.33/drivers/net/ibmveth.c  2010-02-24 13:52:17.000000000 -0500
24520 +++ linux-2.6.33/drivers/net/ibmveth.c  2010-03-07 12:23:36.033711222 -0500
24521 @@ -1577,7 +1577,7 @@ static struct attribute * veth_pool_attr
24522         NULL,
24523  };
24524
24525 -static struct sysfs_ops veth_pool_ops = {
24526 +static const struct sysfs_ops veth_pool_ops = {
24527         .show   = veth_pool_show,
24528         .store  = veth_pool_store,
24529  };
24530 diff -urNp linux-2.6.33/drivers/net/igb/e1000_82575.c linux-2.6.33/drivers/net/igb/e1000_82575.c
24531 --- linux-2.6.33/drivers/net/igb/e1000_82575.c  2010-02-24 13:52:17.000000000 -0500
24532 +++ linux-2.6.33/drivers/net/igb/e1000_82575.c  2010-03-07 12:23:36.033711222 -0500
24533 @@ -1583,7 +1583,7 @@ u16 igb_rxpbs_adjust_82580(u32 data)
24534         return ret_val;
24535  }
24536
24537 -static struct e1000_mac_operations e1000_mac_ops_82575 = {
24538 +static const struct e1000_mac_operations e1000_mac_ops_82575 = {
24539         .init_hw              = igb_init_hw_82575,
24540         .check_for_link       = igb_check_for_link_82575,
24541         .rar_set              = igb_rar_set,
24542 @@ -1591,13 +1591,13 @@ static struct e1000_mac_operations e1000
24543         .get_speed_and_duplex = igb_get_speed_and_duplex_copper,
24544  };
24545
24546 -static struct e1000_phy_operations e1000_phy_ops_82575 = {
24547 +static const struct e1000_phy_operations e1000_phy_ops_82575 = {
24548         .acquire              = igb_acquire_phy_82575,
24549         .get_cfg_done         = igb_get_cfg_done_82575,
24550         .release              = igb_release_phy_82575,
24551  };
24552
24553 -static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
24554 +static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
24555         .acquire              = igb_acquire_nvm_82575,
24556         .read                 = igb_read_nvm_eerd,
24557         .release              = igb_release_nvm_82575,
24558 diff -urNp linux-2.6.33/drivers/net/igb/e1000_hw.h linux-2.6.33/drivers/net/igb/e1000_hw.h
24559 --- linux-2.6.33/drivers/net/igb/e1000_hw.h     2010-02-24 13:52:17.000000000 -0500
24560 +++ linux-2.6.33/drivers/net/igb/e1000_hw.h     2010-03-07 12:23:36.033711222 -0500
24561 @@ -316,17 +316,17 @@ struct e1000_phy_operations {
24562  };
24563
24564  struct e1000_nvm_operations {
24565 -       s32  (*acquire)(struct e1000_hw *);
24566 -       s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
24567 -       void (*release)(struct e1000_hw *);
24568 -       s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
24569 +       s32  (* const acquire)(struct e1000_hw *);
24570 +       s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
24571 +       void (* const release)(struct e1000_hw *);
24572 +       s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
24573  };
24574
24575  struct e1000_info {
24576         s32 (*get_invariants)(struct e1000_hw *);
24577 -       struct e1000_mac_operations *mac_ops;
24578 -       struct e1000_phy_operations *phy_ops;
24579 -       struct e1000_nvm_operations *nvm_ops;
24580 +       const struct e1000_mac_operations *mac_ops;
24581 +       const struct e1000_phy_operations *phy_ops;
24582 +       const struct e1000_nvm_operations *nvm_ops;
24583  };
24584
24585  extern const struct e1000_info e1000_82575_info;
24586 @@ -412,6 +412,7 @@ struct e1000_phy_info {
24587  };
24588
24589  struct e1000_nvm_info {
24590 +       /* cannot be const */
24591         struct e1000_nvm_operations ops;
24592
24593         enum e1000_nvm_type type;
24594 diff -urNp linux-2.6.33/drivers/net/irda/vlsi_ir.c linux-2.6.33/drivers/net/irda/vlsi_ir.c
24595 --- linux-2.6.33/drivers/net/irda/vlsi_ir.c     2010-02-24 13:52:17.000000000 -0500
24596 +++ linux-2.6.33/drivers/net/irda/vlsi_ir.c     2010-03-07 12:23:36.033711222 -0500
24597 @@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
24598                         /* no race - tx-ring already empty */
24599                         vlsi_set_baud(idev, iobase);
24600                         netif_wake_queue(ndev);
24601 -               }
24602 -               else
24603 -                       ;
24604 +               } else {
24605                         /* keep the speed change pending like it would
24606                          * for any len>0 packet. tx completion interrupt
24607                          * will apply it when the tx ring becomes empty.
24608                          */
24609 +               }
24610                 spin_unlock_irqrestore(&idev->lock, flags);
24611                 dev_kfree_skb_any(skb);
24612                 return NETDEV_TX_OK;
24613 diff -urNp linux-2.6.33/drivers/net/iseries_veth.c linux-2.6.33/drivers/net/iseries_veth.c
24614 --- linux-2.6.33/drivers/net/iseries_veth.c     2010-02-24 13:52:17.000000000 -0500
24615 +++ linux-2.6.33/drivers/net/iseries_veth.c     2010-03-07 12:23:36.033711222 -0500
24616 @@ -384,7 +384,7 @@ static struct attribute *veth_cnx_defaul
24617         NULL
24618  };
24619
24620 -static struct sysfs_ops veth_cnx_sysfs_ops = {
24621 +static const struct sysfs_ops veth_cnx_sysfs_ops = {
24622                 .show = veth_cnx_attribute_show
24623  };
24624
24625 @@ -441,7 +441,7 @@ static struct attribute *veth_port_defau
24626         NULL
24627  };
24628
24629 -static struct sysfs_ops veth_port_sysfs_ops = {
24630 +static const struct sysfs_ops veth_port_sysfs_ops = {
24631         .show = veth_port_attribute_show
24632  };
24633
24634 diff -urNp linux-2.6.33/drivers/net/pcnet32.c linux-2.6.33/drivers/net/pcnet32.c
24635 --- linux-2.6.33/drivers/net/pcnet32.c  2010-02-24 13:52:17.000000000 -0500
24636 +++ linux-2.6.33/drivers/net/pcnet32.c  2010-03-07 12:23:36.033711222 -0500
24637 @@ -80,7 +80,7 @@ static int cards_found;
24638  /*
24639   * VLB I/O addresses
24640   */
24641 -static unsigned int pcnet32_portlist[] __initdata =
24642 +static unsigned int pcnet32_portlist[] __devinitdata =
24643      { 0x300, 0x320, 0x340, 0x360, 0 };
24644
24645  static int pcnet32_debug = 0;
24646 diff -urNp linux-2.6.33/drivers/net/ppp_generic.c linux-2.6.33/drivers/net/ppp_generic.c
24647 --- linux-2.6.33/drivers/net/ppp_generic.c      2010-02-24 13:52:17.000000000 -0500
24648 +++ linux-2.6.33/drivers/net/ppp_generic.c      2010-03-07 12:23:36.033711222 -0500
24649 @@ -988,7 +988,6 @@ ppp_net_ioctl(struct net_device *dev, st
24650         void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
24651         struct ppp_stats stats;
24652         struct ppp_comp_stats cstats;
24653 -       char *vers;
24654
24655         switch (cmd) {
24656         case SIOCGPPPSTATS:
24657 @@ -1010,8 +1009,7 @@ ppp_net_ioctl(struct net_device *dev, st
24658                 break;
24659
24660         case SIOCGPPPVER:
24661 -               vers = PPP_VERSION;
24662 -               if (copy_to_user(addr, vers, strlen(vers) + 1))
24663 +               if (copy_to_user(addr, PPP_VERSION, sizeof(PPP_VERSION)))
24664                         break;
24665                 err = 0;
24666                 break;
24667 diff -urNp linux-2.6.33/drivers/net/tg3.h linux-2.6.33/drivers/net/tg3.h
24668 --- linux-2.6.33/drivers/net/tg3.h      2010-02-24 13:52:17.000000000 -0500
24669 +++ linux-2.6.33/drivers/net/tg3.h      2010-03-07 12:23:36.033711222 -0500
24670 @@ -101,6 +101,7 @@
24671  #define  CHIPREV_ID_5750_A0             0x4000
24672  #define  CHIPREV_ID_5750_A1             0x4001
24673  #define  CHIPREV_ID_5750_A3             0x4003
24674 +#define  CHIPREV_ID_5750_C1             0x4201
24675  #define  CHIPREV_ID_5750_C2             0x4202
24676  #define  CHIPREV_ID_5752_A0_HW          0x5000
24677  #define  CHIPREV_ID_5752_A0             0x6000
24678 diff -urNp linux-2.6.33/drivers/net/tulip/de4x5.c linux-2.6.33/drivers/net/tulip/de4x5.c
24679 --- linux-2.6.33/drivers/net/tulip/de4x5.c      2010-02-24 13:52:17.000000000 -0500
24680 +++ linux-2.6.33/drivers/net/tulip/de4x5.c      2010-03-07 12:23:36.037634971 -0500
24681 @@ -5472,7 +5472,7 @@ de4x5_ioctl(struct net_device *dev, stru
24682         for (i=0; i<ETH_ALEN; i++) {
24683             tmp.addr[i] = dev->dev_addr[i];
24684         }
24685 -       if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
24686 +       if (ioc->len > sizeof(tmp.addr) || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
24687         break;
24688
24689      case DE4X5_SET_HWADDR:           /* Set the hardware address */
24690 @@ -5512,7 +5512,7 @@ de4x5_ioctl(struct net_device *dev, stru
24691         spin_lock_irqsave(&lp->lock, flags);
24692         memcpy(&statbuf, &lp->pktStats, ioc->len);
24693         spin_unlock_irqrestore(&lp->lock, flags);
24694 -       if (copy_to_user(ioc->data, &statbuf, ioc->len))
24695 +       if (ioc->len > sizeof(statbuf) || copy_to_user(ioc->data, &statbuf, ioc->len))
24696                 return -EFAULT;
24697         break;
24698      }
24699 diff -urNp linux-2.6.33/drivers/net/usb/hso.c linux-2.6.33/drivers/net/usb/hso.c
24700 --- linux-2.6.33/drivers/net/usb/hso.c  2010-02-24 13:52:17.000000000 -0500
24701 +++ linux-2.6.33/drivers/net/usb/hso.c  2010-03-07 12:23:36.037634971 -0500
24702 @@ -258,7 +258,7 @@ struct hso_serial {
24703
24704         /* from usb_serial_port */
24705         struct tty_struct *tty;
24706 -       int open_count;
24707 +       atomic_t open_count;
24708         spinlock_t serial_lock;
24709
24710         int (*write_data) (struct hso_serial *serial);
24711 @@ -1203,7 +1203,7 @@ static void put_rxbuf_data_and_resubmit_
24712         struct urb *urb;
24713
24714         urb = serial->rx_urb[0];
24715 -       if (serial->open_count > 0) {
24716 +       if (atomic_read(&serial->open_count) > 0) {
24717                 count = put_rxbuf_data(urb, serial);
24718                 if (count == -1)
24719                         return;
24720 @@ -1239,7 +1239,7 @@ static void hso_std_serial_read_bulk_cal
24721         DUMP1(urb->transfer_buffer, urb->actual_length);
24722
24723         /* Anyone listening? */
24724 -       if (serial->open_count == 0)
24725 +       if (atomic_read(&serial->open_count) == 0)
24726                 return;
24727
24728         if (status == 0) {
24729 @@ -1334,8 +1334,7 @@ static int hso_serial_open(struct tty_st
24730         spin_unlock_irq(&serial->serial_lock);
24731
24732         /* check for port already opened, if not set the termios */
24733 -       serial->open_count++;
24734 -       if (serial->open_count == 1) {
24735 +       if (atomic_inc_return(&serial->open_count) == 1) {
24736                 tty->low_latency = 1;
24737                 serial->rx_state = RX_IDLE;
24738                 /* Force default termio settings */
24739 @@ -1348,7 +1347,7 @@ static int hso_serial_open(struct tty_st
24740                 result = hso_start_serial_device(serial->parent, GFP_KERNEL);
24741                 if (result) {
24742                         hso_stop_serial_device(serial->parent);
24743 -                       serial->open_count--;
24744 +                       atomic_dec(&serial->open_count);
24745                         kref_put(&serial->parent->ref, hso_serial_ref_free);
24746                 }
24747         } else {
24748 @@ -1385,10 +1384,10 @@ static void hso_serial_close(struct tty_
24749
24750         /* reset the rts and dtr */
24751         /* do the actual close */
24752 -       serial->open_count--;
24753 +       atomic_dec(&serial->open_count);
24754
24755 -       if (serial->open_count <= 0) {
24756 -               serial->open_count = 0;
24757 +       if (atomic_read(&serial->open_count) <= 0) {
24758 +               atomic_set(&serial->open_count,  0);
24759                 spin_lock_irq(&serial->serial_lock);
24760                 if (serial->tty == tty) {
24761                         serial->tty->driver_data = NULL;
24762 @@ -1470,7 +1469,7 @@ static void hso_serial_set_termios(struc
24763
24764         /* the actual setup */
24765         spin_lock_irqsave(&serial->serial_lock, flags);
24766 -       if (serial->open_count)
24767 +       if (atomic_read(&serial->open_count))
24768                 _hso_serial_set_termios(tty, old);
24769         else
24770                 tty->termios = old;
24771 @@ -1933,7 +1932,7 @@ static void intr_callback(struct urb *ur
24772                                 D1("Pending read interrupt on port %d\n", i);
24773                                 spin_lock(&serial->serial_lock);
24774                                 if (serial->rx_state == RX_IDLE &&
24775 -                                       serial->open_count > 0) {
24776 +                                       atomic_read(&serial->open_count) > 0) {
24777                                         /* Setup and send a ctrl req read on
24778                                          * port i */
24779                                         if (!serial->rx_urb_filled[0]) {
24780 @@ -3124,7 +3123,7 @@ static int hso_resume(struct usb_interfa
24781         /* Start all serial ports */
24782         for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
24783                 if (serial_table[i] && (serial_table[i]->interface == iface)) {
24784 -                       if (dev2ser(serial_table[i])->open_count) {
24785 +                       if (atomic_read(&dev2ser(serial_table[i])->open_count)) {
24786                                 result =
24787                                     hso_start_serial_device(serial_table[i], GFP_NOIO);
24788                                 hso_kick_transmit(dev2ser(serial_table[i]));
24789 diff -urNp linux-2.6.33/drivers/net/wireless/b43/debugfs.c linux-2.6.33/drivers/net/wireless/b43/debugfs.c
24790 --- linux-2.6.33/drivers/net/wireless/b43/debugfs.c     2010-02-24 13:52:17.000000000 -0500
24791 +++ linux-2.6.33/drivers/net/wireless/b43/debugfs.c     2010-03-07 12:23:36.037634971 -0500
24792 @@ -43,7 +43,7 @@ static struct dentry *rootdir;
24793  struct b43_debugfs_fops {
24794         ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
24795         int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
24796 -       struct file_operations fops;
24797 +       const struct file_operations fops;
24798         /* Offset of struct b43_dfs_file in struct b43_dfsentry */
24799         size_t file_struct_offset;
24800  };
24801 diff -urNp linux-2.6.33/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.33/drivers/net/wireless/b43legacy/debugfs.c
24802 --- linux-2.6.33/drivers/net/wireless/b43legacy/debugfs.c       2010-02-24 13:52:17.000000000 -0500
24803 +++ linux-2.6.33/drivers/net/wireless/b43legacy/debugfs.c       2010-03-07 12:23:36.037634971 -0500
24804 @@ -44,7 +44,7 @@ static struct dentry *rootdir;
24805  struct b43legacy_debugfs_fops {
24806         ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
24807         int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
24808 -       struct file_operations fops;
24809 +       const struct file_operations fops;
24810         /* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
24811         size_t file_struct_offset;
24812         /* Take wl->irq_lock before calling read/write? */
24813 diff -urNp linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-1000.c
24814 --- linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-1000.c        2010-02-24 13:52:17.000000000 -0500
24815 +++ linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-1000.c        2010-03-07 12:23:36.037634971 -0500
24816 @@ -140,7 +140,7 @@ static struct iwl_lib_ops iwl1000_lib =
24817          },
24818  };
24819
24820 -static struct iwl_ops iwl1000_ops = {
24821 +static const struct iwl_ops iwl1000_ops = {
24822         .ucode = &iwl5000_ucode,
24823         .lib = &iwl1000_lib,
24824         .hcmd = &iwl5000_hcmd,
24825 diff -urNp linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-3945.c
24826 --- linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-3945.c        2010-02-24 13:52:17.000000000 -0500
24827 +++ linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-3945.c        2010-03-07 12:23:36.037634971 -0500
24828 @@ -2804,7 +2804,7 @@ static struct iwl_hcmd_utils_ops iwl3945
24829         .rts_tx_cmd_flag = iwlcore_rts_tx_cmd_flag,
24830  };
24831
24832 -static struct iwl_ops iwl3945_ops = {
24833 +static const struct iwl_ops iwl3945_ops = {
24834         .ucode = &iwl3945_ucode,
24835         .lib = &iwl3945_lib,
24836         .hcmd = &iwl3945_hcmd,
24837 diff -urNp linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-4965.c
24838 --- linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-4965.c        2010-02-24 13:52:17.000000000 -0500
24839 +++ linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-4965.c        2010-03-07 12:23:36.037634971 -0500
24840 @@ -2208,7 +2208,7 @@ static struct iwl_lib_ops iwl4965_lib =
24841         },
24842  };
24843
24844 -static struct iwl_ops iwl4965_ops = {
24845 +static const struct iwl_ops iwl4965_ops = {
24846         .ucode = &iwl4965_ucode,
24847         .lib = &iwl4965_lib,
24848         .hcmd = &iwl4965_hcmd,
24849 diff -urNp linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-5000.c
24850 --- linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-5000.c        2010-02-24 13:52:17.000000000 -0500
24851 +++ linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-5000.c        2010-03-07 12:23:36.037634971 -0500
24852 @@ -1553,7 +1553,7 @@ static struct iwl_lib_ops iwl5150_lib =
24853          },
24854  };
24855
24856 -static struct iwl_ops iwl5000_ops = {
24857 +static const struct iwl_ops iwl5000_ops = {
24858         .ucode = &iwl5000_ucode,
24859         .lib = &iwl5000_lib,
24860         .hcmd = &iwl5000_hcmd,
24861 @@ -1561,7 +1561,7 @@ static struct iwl_ops iwl5000_ops = {
24862         .led = &iwlagn_led_ops,
24863  };
24864
24865 -static struct iwl_ops iwl5150_ops = {
24866 +static const struct iwl_ops iwl5150_ops = {
24867         .ucode = &iwl5000_ucode,
24868         .lib = &iwl5150_lib,
24869         .hcmd = &iwl5000_hcmd,
24870 diff -urNp linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-6000.c
24871 --- linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-6000.c        2010-02-24 13:52:17.000000000 -0500
24872 +++ linux-2.6.33/drivers/net/wireless/iwlwifi/iwl-6000.c        2010-03-07 12:23:36.037634971 -0500
24873 @@ -252,7 +252,7 @@ static struct iwl_lib_ops iwl6000_lib =
24874          },
24875  };
24876
24877 -static struct iwl_ops iwl6000_ops = {
24878 +static const struct iwl_ops iwl6000_ops = {
24879         .ucode = &iwl5000_ucode,
24880         .lib = &iwl6000_lib,
24881         .hcmd = &iwl5000_hcmd,
24882 @@ -267,7 +267,7 @@ static struct iwl_hcmd_utils_ops iwl6050
24883         .calc_rssi = iwl5000_calc_rssi,
24884  };
24885
24886 -static struct iwl_ops iwl6050_ops = {
24887 +static const struct iwl_ops iwl6050_ops = {
24888         .ucode = &iwl5000_ucode,
24889         .lib = &iwl6000_lib,
24890         .hcmd = &iwl5000_hcmd,
24891 diff -urNp linux-2.6.33/drivers/net/wireless/libertas/debugfs.c linux-2.6.33/drivers/net/wireless/libertas/debugfs.c
24892 --- linux-2.6.33/drivers/net/wireless/libertas/debugfs.c        2010-02-24 13:52:17.000000000 -0500
24893 +++ linux-2.6.33/drivers/net/wireless/libertas/debugfs.c        2010-03-07 12:23:36.041708139 -0500
24894 @@ -717,7 +717,7 @@ out_unlock:
24895  struct lbs_debugfs_files {
24896         const char *name;
24897         int perm;
24898 -       struct file_operations fops;
24899 +       const struct file_operations fops;
24900  };
24901
24902  static const struct lbs_debugfs_files debugfs_files[] = {
24903 diff -urNp linux-2.6.33/drivers/oprofile/buffer_sync.c linux-2.6.33/drivers/oprofile/buffer_sync.c
24904 --- linux-2.6.33/drivers/oprofile/buffer_sync.c 2010-02-24 13:52:17.000000000 -0500
24905 +++ linux-2.6.33/drivers/oprofile/buffer_sync.c 2010-03-07 12:23:36.041708139 -0500
24906 @@ -340,7 +340,7 @@ static void add_data(struct op_entry *en
24907                 if (cookie == NO_COOKIE)
24908                         offset = pc;
24909                 if (cookie == INVALID_COOKIE) {
24910 -                       atomic_inc(&oprofile_stats.sample_lost_no_mapping);
24911 +                       atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
24912                         offset = pc;
24913                 }
24914                 if (cookie != last_cookie) {
24915 @@ -384,14 +384,14 @@ add_sample(struct mm_struct *mm, struct
24916         /* add userspace sample */
24917
24918         if (!mm) {
24919 -               atomic_inc(&oprofile_stats.sample_lost_no_mm);
24920 +               atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
24921                 return 0;
24922         }
24923
24924         cookie = lookup_dcookie(mm, s->eip, &offset);
24925
24926         if (cookie == INVALID_COOKIE) {
24927 -               atomic_inc(&oprofile_stats.sample_lost_no_mapping);
24928 +               atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
24929                 return 0;
24930         }
24931
24932 @@ -560,7 +560,7 @@ void sync_buffer(int cpu)
24933                 /* ignore backtraces if failed to add a sample */
24934                 if (state == sb_bt_start) {
24935                         state = sb_bt_ignore;
24936 -                       atomic_inc(&oprofile_stats.bt_lost_no_mapping);
24937 +                       atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
24938                 }
24939         }
24940         release_mm(mm);
24941 diff -urNp linux-2.6.33/drivers/oprofile/event_buffer.c linux-2.6.33/drivers/oprofile/event_buffer.c
24942 --- linux-2.6.33/drivers/oprofile/event_buffer.c        2010-02-24 13:52:17.000000000 -0500
24943 +++ linux-2.6.33/drivers/oprofile/event_buffer.c        2010-03-07 12:23:36.041708139 -0500
24944 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
24945         }
24946
24947         if (buffer_pos == buffer_size) {
24948 -               atomic_inc(&oprofile_stats.event_lost_overflow);
24949 +               atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
24950                 return;
24951         }
24952
24953 diff -urNp linux-2.6.33/drivers/oprofile/oprof.c linux-2.6.33/drivers/oprofile/oprof.c
24954 --- linux-2.6.33/drivers/oprofile/oprof.c       2010-02-24 13:52:17.000000000 -0500
24955 +++ linux-2.6.33/drivers/oprofile/oprof.c       2010-03-07 12:23:36.041708139 -0500
24956 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
24957         if (oprofile_ops.switch_events())
24958                 return;
24959
24960 -       atomic_inc(&oprofile_stats.multiplex_counter);
24961 +       atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
24962         start_switch_worker();
24963  }
24964
24965 diff -urNp linux-2.6.33/drivers/oprofile/oprofilefs.c linux-2.6.33/drivers/oprofile/oprofilefs.c
24966 --- linux-2.6.33/drivers/oprofile/oprofilefs.c  2010-02-24 13:52:17.000000000 -0500
24967 +++ linux-2.6.33/drivers/oprofile/oprofilefs.c  2010-03-07 12:23:36.041708139 -0500
24968 @@ -187,7 +187,7 @@ static const struct file_operations atom
24969
24970
24971  int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
24972 -       char const *name, atomic_t *val)
24973 +       char const *name, atomic_unchecked_t *val)
24974  {
24975         struct dentry *d = __oprofilefs_create_file(sb, root, name,
24976                                                      &atomic_ro_fops, 0444);
24977 diff -urNp linux-2.6.33/drivers/oprofile/oprofile_stats.c linux-2.6.33/drivers/oprofile/oprofile_stats.c
24978 --- linux-2.6.33/drivers/oprofile/oprofile_stats.c      2010-02-24 13:52:17.000000000 -0500
24979 +++ linux-2.6.33/drivers/oprofile/oprofile_stats.c      2010-03-07 12:23:36.041708139 -0500
24980 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
24981                 cpu_buf->sample_invalid_eip = 0;
24982         }
24983
24984 -       atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
24985 -       atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
24986 -       atomic_set(&oprofile_stats.event_lost_overflow, 0);
24987 -       atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
24988 -       atomic_set(&oprofile_stats.multiplex_counter, 0);
24989 +       atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
24990 +       atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
24991 +       atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
24992 +       atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
24993 +       atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
24994  }
24995
24996
24997 diff -urNp linux-2.6.33/drivers/oprofile/oprofile_stats.h linux-2.6.33/drivers/oprofile/oprofile_stats.h
24998 --- linux-2.6.33/drivers/oprofile/oprofile_stats.h      2010-02-24 13:52:17.000000000 -0500
24999 +++ linux-2.6.33/drivers/oprofile/oprofile_stats.h      2010-03-07 12:23:36.041708139 -0500
25000 @@ -13,11 +13,11 @@
25001  #include <asm/atomic.h>
25002
25003  struct oprofile_stat_struct {
25004 -       atomic_t sample_lost_no_mm;
25005 -       atomic_t sample_lost_no_mapping;
25006 -       atomic_t bt_lost_no_mapping;
25007 -       atomic_t event_lost_overflow;
25008 -       atomic_t multiplex_counter;
25009 +       atomic_unchecked_t sample_lost_no_mm;
25010 +       atomic_unchecked_t sample_lost_no_mapping;
25011 +       atomic_unchecked_t bt_lost_no_mapping;
25012 +       atomic_unchecked_t event_lost_overflow;
25013 +       atomic_unchecked_t multiplex_counter;
25014  };
25015
25016  extern struct oprofile_stat_struct oprofile_stats;
25017 diff -urNp linux-2.6.33/drivers/parisc/pdc_stable.c linux-2.6.33/drivers/parisc/pdc_stable.c
25018 --- linux-2.6.33/drivers/parisc/pdc_stable.c    2010-02-24 13:52:17.000000000 -0500
25019 +++ linux-2.6.33/drivers/parisc/pdc_stable.c    2010-03-07 12:23:36.041708139 -0500
25020 @@ -481,7 +481,7 @@ pdcspath_attr_store(struct kobject *kobj
25021         return ret;
25022  }
25023
25024 -static struct sysfs_ops pdcspath_attr_ops = {
25025 +static const struct sysfs_ops pdcspath_attr_ops = {
25026         .show = pdcspath_attr_show,
25027         .store = pdcspath_attr_store,
25028  };
25029 diff -urNp linux-2.6.33/drivers/parport/procfs.c linux-2.6.33/drivers/parport/procfs.c
25030 --- linux-2.6.33/drivers/parport/procfs.c       2010-02-24 13:52:17.000000000 -0500
25031 +++ linux-2.6.33/drivers/parport/procfs.c       2010-03-07 12:23:36.041708139 -0500
25032 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
25033
25034         *ppos += len;
25035
25036 -       return copy_to_user(result, buffer, len) ? -EFAULT : 0;
25037 +       return (len > sizeof(buffer) || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
25038  }
25039
25040  #ifdef CONFIG_PARPORT_1284
25041 @@ -106,7 +106,7 @@ static int do_autoprobe(ctl_table *table
25042
25043         *ppos += len;
25044
25045 -       return copy_to_user (result, buffer, len) ? -EFAULT : 0;
25046 +       return (len > sizeof(buffer) || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
25047  }
25048  #endif /* IEEE1284.3 support. */
25049
25050 diff -urNp linux-2.6.33/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.33/drivers/pci/hotplug/acpiphp_glue.c
25051 --- linux-2.6.33/drivers/pci/hotplug/acpiphp_glue.c     2010-02-24 13:52:17.000000000 -0500
25052 +++ linux-2.6.33/drivers/pci/hotplug/acpiphp_glue.c     2010-03-07 12:23:36.041708139 -0500
25053 @@ -109,7 +109,7 @@ static int post_dock_fixups(struct notif
25054  }
25055
25056
25057 -static struct acpi_dock_ops acpiphp_dock_ops = {
25058 +static const struct acpi_dock_ops acpiphp_dock_ops = {
25059         .handler = handle_hotplug_event_func,
25060  };
25061
25062 diff -urNp linux-2.6.33/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.33/drivers/pci/hotplug/cpqphp_nvram.c
25063 --- linux-2.6.33/drivers/pci/hotplug/cpqphp_nvram.c     2010-02-24 13:52:17.000000000 -0500
25064 +++ linux-2.6.33/drivers/pci/hotplug/cpqphp_nvram.c     2010-03-07 12:23:36.041708139 -0500
25065 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
25066
25067  void compaq_nvram_init (void __iomem *rom_start)
25068  {
25069 +
25070 +#ifndef CONFIG_PAX_KERNEXEC
25071         if (rom_start) {
25072                 compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
25073         }
25074 +#endif
25075 +
25076         dbg("int15 entry  = %p\n", compaq_int15_entry_point);
25077
25078         /* initialize our int15 lock */
25079 diff -urNp linux-2.6.33/drivers/pci/hotplug/fakephp.c linux-2.6.33/drivers/pci/hotplug/fakephp.c
25080 --- linux-2.6.33/drivers/pci/hotplug/fakephp.c  2010-02-24 13:52:17.000000000 -0500
25081 +++ linux-2.6.33/drivers/pci/hotplug/fakephp.c  2010-03-07 12:23:36.041708139 -0500
25082 @@ -73,7 +73,7 @@ static void legacy_release(struct kobjec
25083  }
25084
25085  static struct kobj_type legacy_ktype = {
25086 -       .sysfs_ops = &(struct sysfs_ops){
25087 +       .sysfs_ops = &(const struct sysfs_ops){
25088                 .store = legacy_store, .show = legacy_show
25089         },
25090         .release = &legacy_release,
25091 diff -urNp linux-2.6.33/drivers/pci/intel-iommu.c linux-2.6.33/drivers/pci/intel-iommu.c
25092 --- linux-2.6.33/drivers/pci/intel-iommu.c      2010-02-24 13:52:17.000000000 -0500
25093 +++ linux-2.6.33/drivers/pci/intel-iommu.c      2010-03-07 12:23:36.041708139 -0500
25094 @@ -2940,7 +2940,7 @@ static int intel_mapping_error(struct de
25095         return !dma_addr;
25096  }
25097
25098 -struct dma_map_ops intel_dma_ops = {
25099 +const struct dma_map_ops intel_dma_ops = {
25100         .alloc_coherent = intel_alloc_coherent,
25101         .free_coherent = intel_free_coherent,
25102         .map_sg = intel_map_sg,
25103 diff -urNp linux-2.6.33/drivers/pci/pcie/portdrv_pci.c linux-2.6.33/drivers/pci/pcie/portdrv_pci.c
25104 --- linux-2.6.33/drivers/pci/pcie/portdrv_pci.c 2010-02-24 13:52:17.000000000 -0500
25105 +++ linux-2.6.33/drivers/pci/pcie/portdrv_pci.c 2010-03-07 12:23:36.041708139 -0500
25106 @@ -250,7 +250,7 @@ static void pcie_portdrv_err_resume(stru
25107  static const struct pci_device_id port_pci_ids[] = { {
25108         /* handle any PCI-Express port */
25109         PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
25110 -       }, { /* end: all zeroes */ }
25111 +       }, { 0, 0, 0, 0, 0, 0, 0 }
25112  };
25113  MODULE_DEVICE_TABLE(pci, port_pci_ids);
25114
25115 diff -urNp linux-2.6.33/drivers/pci/proc.c linux-2.6.33/drivers/pci/proc.c
25116 --- linux-2.6.33/drivers/pci/proc.c     2010-02-24 13:52:17.000000000 -0500
25117 +++ linux-2.6.33/drivers/pci/proc.c     2010-03-07 12:23:36.041708139 -0500
25118 @@ -480,7 +480,16 @@ static const struct file_operations proc
25119  static int __init pci_proc_init(void)
25120  {
25121         struct pci_dev *dev = NULL;
25122 +
25123 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
25124 +#ifdef CONFIG_GRKERNSEC_PROC_USER
25125 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
25126 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
25127 +       proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
25128 +#endif
25129 +#else
25130         proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
25131 +#endif
25132         proc_create("devices", 0, proc_bus_pci_dir,
25133                     &proc_bus_pci_dev_operations);
25134         proc_initialized = 1;
25135 diff -urNp linux-2.6.33/drivers/pci/slot.c linux-2.6.33/drivers/pci/slot.c
25136 --- linux-2.6.33/drivers/pci/slot.c     2010-02-24 13:52:17.000000000 -0500
25137 +++ linux-2.6.33/drivers/pci/slot.c     2010-03-07 12:23:36.041708139 -0500
25138 @@ -29,7 +29,7 @@ static ssize_t pci_slot_attr_store(struc
25139         return attribute->store ? attribute->store(slot, buf, len) : -EIO;
25140  }
25141
25142 -static struct sysfs_ops pci_slot_sysfs_ops = {
25143 +static const struct sysfs_ops pci_slot_sysfs_ops = {
25144         .show = pci_slot_attr_show,
25145         .store = pci_slot_attr_store,
25146  };
25147 diff -urNp linux-2.6.33/drivers/pcmcia/ti113x.h linux-2.6.33/drivers/pcmcia/ti113x.h
25148 --- linux-2.6.33/drivers/pcmcia/ti113x.h        2010-02-24 13:52:17.000000000 -0500
25149 +++ linux-2.6.33/drivers/pcmcia/ti113x.h        2010-03-07 12:23:36.041708139 -0500
25150 @@ -903,7 +903,7 @@ static struct pci_device_id ene_tune_tbl
25151         DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
25152                 ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
25153
25154 -       {}
25155 +       { 0, 0, 0, 0, 0, 0, 0 }
25156  };
25157
25158  static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
25159 diff -urNp linux-2.6.33/drivers/pcmcia/yenta_socket.c linux-2.6.33/drivers/pcmcia/yenta_socket.c
25160 --- linux-2.6.33/drivers/pcmcia/yenta_socket.c  2010-02-24 13:52:17.000000000 -0500
25161 +++ linux-2.6.33/drivers/pcmcia/yenta_socket.c  2010-03-07 12:23:36.041708139 -0500
25162 @@ -1432,7 +1432,7 @@ static struct pci_device_id yenta_table[
25163
25164         /* match any cardbus bridge */
25165         CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
25166 -       { /* all zeroes */ }
25167 +       { 0, 0, 0, 0, 0, 0, 0 }
25168  };
25169  MODULE_DEVICE_TABLE(pci, yenta_table);
25170
25171 diff -urNp linux-2.6.33/drivers/platform/x86/acer-wmi.c linux-2.6.33/drivers/platform/x86/acer-wmi.c
25172 --- linux-2.6.33/drivers/platform/x86/acer-wmi.c        2010-02-24 13:52:17.000000000 -0500
25173 +++ linux-2.6.33/drivers/platform/x86/acer-wmi.c        2010-03-07 12:23:36.045616323 -0500
25174 @@ -915,7 +915,7 @@ static int update_bl_status(struct backl
25175         return 0;
25176  }
25177
25178 -static struct backlight_ops acer_bl_ops = {
25179 +static const struct backlight_ops acer_bl_ops = {
25180         .get_brightness = read_brightness,
25181         .update_status = update_bl_status,
25182  };
25183 diff -urNp linux-2.6.33/drivers/platform/x86/asus_acpi.c linux-2.6.33/drivers/platform/x86/asus_acpi.c
25184 --- linux-2.6.33/drivers/platform/x86/asus_acpi.c       2010-02-24 13:52:17.000000000 -0500
25185 +++ linux-2.6.33/drivers/platform/x86/asus_acpi.c       2010-03-07 12:23:36.045616323 -0500
25186 @@ -1464,7 +1464,7 @@ static int asus_hotk_remove(struct acpi_
25187         return 0;
25188  }
25189
25190 -static struct backlight_ops asus_backlight_data = {
25191 +static const struct backlight_ops asus_backlight_data = {
25192         .get_brightness = read_brightness,
25193         .update_status  = set_brightness_status,
25194  };
25195 diff -urNp linux-2.6.33/drivers/platform/x86/asus-laptop.c linux-2.6.33/drivers/platform/x86/asus-laptop.c
25196 --- linux-2.6.33/drivers/platform/x86/asus-laptop.c     2010-02-24 13:52:17.000000000 -0500
25197 +++ linux-2.6.33/drivers/platform/x86/asus-laptop.c     2010-03-07 12:23:36.045616323 -0500
25198 @@ -251,7 +251,7 @@ static struct backlight_device *asus_bac
25199   */
25200  static int read_brightness(struct backlight_device *bd);
25201  static int update_bl_status(struct backlight_device *bd);
25202 -static struct backlight_ops asusbl_ops = {
25203 +static const struct backlight_ops asusbl_ops = {
25204         .get_brightness = read_brightness,
25205         .update_status = update_bl_status,
25206  };
25207 diff -urNp linux-2.6.33/drivers/platform/x86/classmate-laptop.c linux-2.6.33/drivers/platform/x86/classmate-laptop.c
25208 --- linux-2.6.33/drivers/platform/x86/classmate-laptop.c        2010-02-24 13:52:17.000000000 -0500
25209 +++ linux-2.6.33/drivers/platform/x86/classmate-laptop.c        2010-03-07 12:23:36.045616323 -0500
25210 @@ -452,7 +452,7 @@ static int cmpc_bl_update_status(struct
25211                 return -1;
25212  }
25213
25214 -static struct backlight_ops cmpc_bl_ops = {
25215 +static const struct backlight_ops cmpc_bl_ops = {
25216         .get_brightness = cmpc_bl_get_brightness,
25217         .update_status = cmpc_bl_update_status
25218  };
25219 diff -urNp linux-2.6.33/drivers/platform/x86/compal-laptop.c linux-2.6.33/drivers/platform/x86/compal-laptop.c
25220 --- linux-2.6.33/drivers/platform/x86/compal-laptop.c   2010-02-24 13:52:17.000000000 -0500
25221 +++ linux-2.6.33/drivers/platform/x86/compal-laptop.c   2010-03-07 12:23:36.045616323 -0500
25222 @@ -162,7 +162,7 @@ static int bl_update_status(struct backl
25223         return set_lcd_level(b->props.brightness);
25224  }
25225
25226 -static struct backlight_ops compalbl_ops = {
25227 +static const struct backlight_ops compalbl_ops = {
25228         .get_brightness = bl_get_brightness,
25229         .update_status  = bl_update_status,
25230  };
25231 diff -urNp linux-2.6.33/drivers/platform/x86/dell-laptop.c linux-2.6.33/drivers/platform/x86/dell-laptop.c
25232 --- linux-2.6.33/drivers/platform/x86/dell-laptop.c     2010-02-24 13:52:17.000000000 -0500
25233 +++ linux-2.6.33/drivers/platform/x86/dell-laptop.c     2010-03-07 12:23:36.045616323 -0500
25234 @@ -333,7 +333,7 @@ static int dell_get_intensity(struct bac
25235         return buffer.output[1];
25236  }
25237
25238 -static struct backlight_ops dell_ops = {
25239 +static const struct backlight_ops dell_ops = {
25240         .get_brightness = dell_get_intensity,
25241         .update_status  = dell_send_intensity,
25242  };
25243 diff -urNp linux-2.6.33/drivers/platform/x86/eeepc-laptop.c linux-2.6.33/drivers/platform/x86/eeepc-laptop.c
25244 --- linux-2.6.33/drivers/platform/x86/eeepc-laptop.c    2010-02-24 13:52:17.000000000 -0500
25245 +++ linux-2.6.33/drivers/platform/x86/eeepc-laptop.c    2010-03-07 12:23:36.045616323 -0500
25246 @@ -1096,7 +1096,7 @@ static int update_bl_status(struct backl
25247         return set_brightness(bd, bd->props.brightness);
25248  }
25249
25250 -static struct backlight_ops eeepcbl_ops = {
25251 +static const struct backlight_ops eeepcbl_ops = {
25252         .get_brightness = read_brightness,
25253         .update_status = update_bl_status,
25254  };
25255 diff -urNp linux-2.6.33/drivers/platform/x86/fujitsu-laptop.c linux-2.6.33/drivers/platform/x86/fujitsu-laptop.c
25256 --- linux-2.6.33/drivers/platform/x86/fujitsu-laptop.c  2010-02-24 13:52:17.000000000 -0500
25257 +++ linux-2.6.33/drivers/platform/x86/fujitsu-laptop.c  2010-03-07 12:23:36.045616323 -0500
25258 @@ -436,7 +436,7 @@ static int bl_update_status(struct backl
25259         return ret;
25260  }
25261
25262 -static struct backlight_ops fujitsubl_ops = {
25263 +static const struct backlight_ops fujitsubl_ops = {
25264         .get_brightness = bl_get_brightness,
25265         .update_status = bl_update_status,
25266  };
25267 diff -urNp linux-2.6.33/drivers/platform/x86/msi-laptop.c linux-2.6.33/drivers/platform/x86/msi-laptop.c
25268 --- linux-2.6.33/drivers/platform/x86/msi-laptop.c      2010-02-24 13:52:17.000000000 -0500
25269 +++ linux-2.6.33/drivers/platform/x86/msi-laptop.c      2010-03-07 12:23:36.045616323 -0500
25270 @@ -161,7 +161,7 @@ static int bl_update_status(struct backl
25271         return set_lcd_level(b->props.brightness);
25272  }
25273
25274 -static struct backlight_ops msibl_ops = {
25275 +static const struct backlight_ops msibl_ops = {
25276         .get_brightness = bl_get_brightness,
25277         .update_status  = bl_update_status,
25278  };
25279 diff -urNp linux-2.6.33/drivers/platform/x86/msi-wmi.c linux-2.6.33/drivers/platform/x86/msi-wmi.c
25280 --- linux-2.6.33/drivers/platform/x86/msi-wmi.c 2010-02-24 13:52:17.000000000 -0500
25281 +++ linux-2.6.33/drivers/platform/x86/msi-wmi.c 2010-03-07 12:23:36.045616323 -0500
25282 @@ -138,7 +138,7 @@ static int bl_set_status(struct backligh
25283         return msi_wmi_set_block(0, backlight_map[bright]);
25284  }
25285
25286 -static struct backlight_ops msi_backlight_ops = {
25287 +static const struct backlight_ops msi_backlight_ops = {
25288         .get_brightness = bl_get,
25289         .update_status  = bl_set_status,
25290  };
25291 diff -urNp linux-2.6.33/drivers/platform/x86/panasonic-laptop.c linux-2.6.33/drivers/platform/x86/panasonic-laptop.c
25292 --- linux-2.6.33/drivers/platform/x86/panasonic-laptop.c        2010-02-24 13:52:17.000000000 -0500
25293 +++ linux-2.6.33/drivers/platform/x86/panasonic-laptop.c        2010-03-07 12:23:36.045616323 -0500
25294 @@ -352,7 +352,7 @@ static int bl_set_status(struct backligh
25295         return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
25296  }
25297
25298 -static struct backlight_ops pcc_backlight_ops = {
25299 +static const struct backlight_ops pcc_backlight_ops = {
25300         .get_brightness = bl_get,
25301         .update_status  = bl_set_status,
25302  };
25303 diff -urNp linux-2.6.33/drivers/platform/x86/sony-laptop.c linux-2.6.33/drivers/platform/x86/sony-laptop.c
25304 --- linux-2.6.33/drivers/platform/x86/sony-laptop.c     2010-02-24 13:52:17.000000000 -0500
25305 +++ linux-2.6.33/drivers/platform/x86/sony-laptop.c     2010-03-07 12:23:36.045616323 -0500
25306 @@ -853,7 +853,7 @@ static int sony_backlight_get_brightness
25307  }
25308
25309  static struct backlight_device *sony_backlight_device;
25310 -static struct backlight_ops sony_backlight_ops = {
25311 +static const struct backlight_ops sony_backlight_ops = {
25312         .update_status = sony_backlight_update_status,
25313         .get_brightness = sony_backlight_get_brightness,
25314  };
25315 diff -urNp linux-2.6.33/drivers/platform/x86/thinkpad_acpi.c linux-2.6.33/drivers/platform/x86/thinkpad_acpi.c
25316 --- linux-2.6.33/drivers/platform/x86/thinkpad_acpi.c   2010-02-24 13:52:17.000000000 -0500
25317 +++ linux-2.6.33/drivers/platform/x86/thinkpad_acpi.c   2010-03-07 12:23:36.049684703 -0500
25318 @@ -6112,7 +6112,7 @@ static void tpacpi_brightness_notify_cha
25319                                BACKLIGHT_UPDATE_HOTKEY);
25320  }
25321
25322 -static struct backlight_ops ibm_backlight_data = {
25323 +static const struct backlight_ops ibm_backlight_data = {
25324         .get_brightness = brightness_get,
25325         .update_status  = brightness_update_status,
25326  };
25327 diff -urNp linux-2.6.33/drivers/platform/x86/toshiba_acpi.c linux-2.6.33/drivers/platform/x86/toshiba_acpi.c
25328 --- linux-2.6.33/drivers/platform/x86/toshiba_acpi.c    2010-02-24 13:52:17.000000000 -0500
25329 +++ linux-2.6.33/drivers/platform/x86/toshiba_acpi.c    2010-03-07 12:23:36.049684703 -0500
25330 @@ -706,7 +706,7 @@ static acpi_status remove_device(void)
25331         return AE_OK;
25332  }
25333
25334 -static struct backlight_ops toshiba_backlight_data = {
25335 +static const struct backlight_ops toshiba_backlight_data = {
25336          .get_brightness = get_lcd,
25337          .update_status  = set_lcd_status,
25338  };
25339 diff -urNp linux-2.6.33/drivers/pnp/pnpbios/bioscalls.c linux-2.6.33/drivers/pnp/pnpbios/bioscalls.c
25340 --- linux-2.6.33/drivers/pnp/pnpbios/bioscalls.c        2010-02-24 13:52:17.000000000 -0500
25341 +++ linux-2.6.33/drivers/pnp/pnpbios/bioscalls.c        2010-03-07 12:23:36.049684703 -0500
25342 @@ -60,7 +60,7 @@ do { \
25343         set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
25344  } while(0)
25345
25346 -static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
25347 +static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
25348                         (unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
25349
25350  /*
25351 @@ -97,7 +97,10 @@ static inline u16 call_pnp_bios(u16 func
25352
25353         cpu = get_cpu();
25354         save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
25355 +
25356 +       pax_open_kernel();
25357         get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
25358 +       pax_close_kernel();
25359
25360         /* On some boxes IRQ's during PnP BIOS calls are deadly.  */
25361         spin_lock_irqsave(&pnp_bios_lock, flags);
25362 @@ -135,7 +138,10 @@ static inline u16 call_pnp_bios(u16 func
25363                              :"memory");
25364         spin_unlock_irqrestore(&pnp_bios_lock, flags);
25365
25366 +       pax_open_kernel();
25367         get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
25368 +       pax_close_kernel();
25369 +
25370         put_cpu();
25371
25372         /* If we get here and this is set then the PnP BIOS faulted on us. */
25373 @@ -469,7 +475,7 @@ int pnp_bios_read_escd(char *data, u32 n
25374         return status;
25375  }
25376
25377 -void pnpbios_calls_init(union pnp_bios_install_struct *header)
25378 +void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
25379  {
25380         int i;
25381
25382 @@ -477,6 +483,8 @@ void pnpbios_calls_init(union pnp_bios_i
25383         pnp_bios_callpoint.offset = header->fields.pm16offset;
25384         pnp_bios_callpoint.segment = PNP_CS16;
25385
25386 +       pax_open_kernel();
25387 +
25388         for_each_possible_cpu(i) {
25389                 struct desc_struct *gdt = get_cpu_gdt_table(i);
25390                 if (!gdt)
25391 @@ -488,4 +496,6 @@ void pnpbios_calls_init(union pnp_bios_i
25392                 set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
25393                          (unsigned long)__va(header->fields.pm16dseg));
25394         }
25395 +
25396 +       pax_close_kernel();
25397  }
25398 diff -urNp linux-2.6.33/drivers/pnp/quirks.c linux-2.6.33/drivers/pnp/quirks.c
25399 --- linux-2.6.33/drivers/pnp/quirks.c   2010-02-24 13:52:17.000000000 -0500
25400 +++ linux-2.6.33/drivers/pnp/quirks.c   2010-03-07 12:23:36.049684703 -0500
25401 @@ -322,7 +322,7 @@ static struct pnp_fixup pnp_fixups[] = {
25402         /* PnP resources that might overlap PCI BARs */
25403         {"PNP0c01", quirk_system_pci_resources},
25404         {"PNP0c02", quirk_system_pci_resources},
25405 -       {""}
25406 +       {"", NULL}
25407  };
25408
25409  void pnp_fixup_device(struct pnp_dev *dev)
25410 diff -urNp linux-2.6.33/drivers/pnp/resource.c linux-2.6.33/drivers/pnp/resource.c
25411 --- linux-2.6.33/drivers/pnp/resource.c 2010-02-24 13:52:17.000000000 -0500
25412 +++ linux-2.6.33/drivers/pnp/resource.c 2010-03-07 12:23:36.049684703 -0500
25413 @@ -355,7 +355,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
25414                 return 1;
25415
25416         /* check if the resource is valid */
25417 -       if (*irq < 0 || *irq > 15)
25418 +       if (*irq > 15)
25419                 return 0;
25420
25421         /* check if the resource is reserved */
25422 @@ -419,7 +419,7 @@ int pnp_check_dma(struct pnp_dev *dev, s
25423                 return 1;
25424
25425         /* check if the resource is valid */
25426 -       if (*dma < 0 || *dma == 4 || *dma > 7)
25427 +       if (*dma == 4 || *dma > 7)
25428                 return 0;
25429
25430         /* check if the resource is reserved */
25431 diff -urNp linux-2.6.33/drivers/s390/cio/qdio_debug.c linux-2.6.33/drivers/s390/cio/qdio_debug.c
25432 --- linux-2.6.33/drivers/s390/cio/qdio_debug.c  2010-02-24 13:52:17.000000000 -0500
25433 +++ linux-2.6.33/drivers/s390/cio/qdio_debug.c  2010-03-07 12:23:36.049684703 -0500
25434 @@ -215,7 +215,7 @@ static int qperf_seq_open(struct inode *
25435                            filp->f_path.dentry->d_inode->i_private);
25436  }
25437
25438 -static struct file_operations debugfs_perf_fops = {
25439 +static const struct file_operations debugfs_perf_fops = {
25440         .owner   = THIS_MODULE,
25441         .open    = qperf_seq_open,
25442         .read    = seq_read,
25443 diff -urNp linux-2.6.33/drivers/scsi/ipr.c linux-2.6.33/drivers/scsi/ipr.c
25444 --- linux-2.6.33/drivers/scsi/ipr.c     2010-02-24 13:52:17.000000000 -0500
25445 +++ linux-2.6.33/drivers/scsi/ipr.c     2010-03-07 12:23:36.049684703 -0500
25446 @@ -5291,7 +5291,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
25447         return true;
25448  }
25449
25450 -static struct ata_port_operations ipr_sata_ops = {
25451 +static const struct ata_port_operations ipr_sata_ops = {
25452         .phy_reset = ipr_ata_phy_reset,
25453         .hardreset = ipr_sata_reset,
25454         .post_internal_cmd = ipr_ata_post_internal,
25455 diff -urNp linux-2.6.33/drivers/scsi/libfc/fc_exch.c linux-2.6.33/drivers/scsi/libfc/fc_exch.c
25456 --- linux-2.6.33/drivers/scsi/libfc/fc_exch.c   2010-02-24 13:52:17.000000000 -0500
25457 +++ linux-2.6.33/drivers/scsi/libfc/fc_exch.c   2010-03-07 12:23:36.049684703 -0500
25458 @@ -100,12 +100,12 @@ struct fc_exch_mgr {
25459          * all together if not used XXX
25460          */
25461         struct {
25462 -               atomic_t no_free_exch;
25463 -               atomic_t no_free_exch_xid;
25464 -               atomic_t xid_not_found;
25465 -               atomic_t xid_busy;
25466 -               atomic_t seq_not_found;
25467 -               atomic_t non_bls_resp;
25468 +               atomic_unchecked_t no_free_exch;
25469 +               atomic_unchecked_t no_free_exch_xid;
25470 +               atomic_unchecked_t xid_not_found;
25471 +               atomic_unchecked_t xid_busy;
25472 +               atomic_unchecked_t seq_not_found;
25473 +               atomic_unchecked_t non_bls_resp;
25474         } stats;
25475  };
25476  #define        fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
25477 @@ -671,7 +671,7 @@ static struct fc_exch *fc_exch_em_alloc(
25478         /* allocate memory for exchange */
25479         ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
25480         if (!ep) {
25481 -               atomic_inc(&mp->stats.no_free_exch);
25482 +               atomic_inc_unchecked(&mp->stats.no_free_exch);
25483                 goto out;
25484         }
25485         memset(ep, 0, sizeof(*ep));
25486 @@ -718,7 +718,7 @@ out:
25487         return ep;
25488  err:
25489         spin_unlock_bh(&pool->lock);
25490 -       atomic_inc(&mp->stats.no_free_exch_xid);
25491 +       atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
25492         mempool_free(ep, mp->ep_pool);
25493         return NULL;
25494  }
25495 @@ -868,7 +868,7 @@ static enum fc_pf_rjt_reason fc_seq_look
25496                 xid = ntohs(fh->fh_ox_id);      /* we originated exch */
25497                 ep = fc_exch_find(mp, xid);
25498                 if (!ep) {
25499 -                       atomic_inc(&mp->stats.xid_not_found);
25500 +                       atomic_inc_unchecked(&mp->stats.xid_not_found);
25501                         reject = FC_RJT_OX_ID;
25502                         goto out;
25503                 }
25504 @@ -898,7 +898,7 @@ static enum fc_pf_rjt_reason fc_seq_look
25505                 ep = fc_exch_find(mp, xid);
25506                 if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
25507                         if (ep) {
25508 -                               atomic_inc(&mp->stats.xid_busy);
25509 +                               atomic_inc_unchecked(&mp->stats.xid_busy);
25510                                 reject = FC_RJT_RX_ID;
25511                                 goto rel;
25512                         }
25513 @@ -909,7 +909,7 @@ static enum fc_pf_rjt_reason fc_seq_look
25514                         }
25515                         xid = ep->xid;  /* get our XID */
25516                 } else if (!ep) {
25517 -                       atomic_inc(&mp->stats.xid_not_found);
25518 +                       atomic_inc_unchecked(&mp->stats.xid_not_found);
25519                         reject = FC_RJT_RX_ID;  /* XID not found */
25520                         goto out;
25521                 }
25522 @@ -930,7 +930,7 @@ static enum fc_pf_rjt_reason fc_seq_look
25523         } else {
25524                 sp = &ep->seq;
25525                 if (sp->id != fh->fh_seq_id) {
25526 -                       atomic_inc(&mp->stats.seq_not_found);
25527 +                       atomic_inc_unchecked(&mp->stats.seq_not_found);
25528                         reject = FC_RJT_SEQ_ID; /* sequence/exch should exist */
25529                         goto rel;
25530                 }
25531 @@ -1317,22 +1317,22 @@ static void fc_exch_recv_seq_resp(struct
25532
25533         ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
25534         if (!ep) {
25535 -               atomic_inc(&mp->stats.xid_not_found);
25536 +               atomic_inc_unchecked(&mp->stats.xid_not_found);
25537                 goto out;
25538         }
25539         if (ep->esb_stat & ESB_ST_COMPLETE) {
25540 -               atomic_inc(&mp->stats.xid_not_found);
25541 +               atomic_inc_unchecked(&mp->stats.xid_not_found);
25542                 goto out;
25543         }
25544         if (ep->rxid == FC_XID_UNKNOWN)
25545                 ep->rxid = ntohs(fh->fh_rx_id);
25546         if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
25547 -               atomic_inc(&mp->stats.xid_not_found);
25548 +               atomic_inc_unchecked(&mp->stats.xid_not_found);
25549                 goto rel;
25550         }
25551         if (ep->did != ntoh24(fh->fh_s_id) &&
25552             ep->did != FC_FID_FLOGI) {
25553 -               atomic_inc(&mp->stats.xid_not_found);
25554 +               atomic_inc_unchecked(&mp->stats.xid_not_found);
25555                 goto rel;
25556         }
25557         sof = fr_sof(fp);
25558 @@ -1343,7 +1343,7 @@ static void fc_exch_recv_seq_resp(struct
25559         } else {
25560                 sp = &ep->seq;
25561                 if (sp->id != fh->fh_seq_id) {
25562 -                       atomic_inc(&mp->stats.seq_not_found);
25563 +                       atomic_inc_unchecked(&mp->stats.seq_not_found);
25564                         goto rel;
25565                 }
25566         }
25567 @@ -1406,9 +1406,9 @@ static void fc_exch_recv_resp(struct fc_
25568         sp = fc_seq_lookup_orig(mp, fp);        /* doesn't hold sequence */
25569
25570         if (!sp)
25571 -               atomic_inc(&mp->stats.xid_not_found);
25572 +               atomic_inc_unchecked(&mp->stats.xid_not_found);
25573         else
25574 -               atomic_inc(&mp->stats.non_bls_resp);
25575 +               atomic_inc_unchecked(&mp->stats.non_bls_resp);
25576
25577         fc_frame_free(fp);
25578  }
25579 diff -urNp linux-2.6.33/drivers/scsi/libsas/sas_ata.c linux-2.6.33/drivers/scsi/libsas/sas_ata.c
25580 --- linux-2.6.33/drivers/scsi/libsas/sas_ata.c  2010-02-24 13:52:17.000000000 -0500
25581 +++ linux-2.6.33/drivers/scsi/libsas/sas_ata.c  2010-03-07 12:23:36.049684703 -0500
25582 @@ -343,7 +343,7 @@ static int sas_ata_scr_read(struct ata_l
25583         }
25584  }
25585
25586 -static struct ata_port_operations sas_sata_ops = {
25587 +static const struct ata_port_operations sas_sata_ops = {
25588         .phy_reset              = sas_ata_phy_reset,
25589         .post_internal_cmd      = sas_ata_post_internal,
25590         .qc_prep                = ata_noop_qc_prep,
25591 diff -urNp linux-2.6.33/drivers/scsi/scsi_logging.h linux-2.6.33/drivers/scsi/scsi_logging.h
25592 --- linux-2.6.33/drivers/scsi/scsi_logging.h    2010-02-24 13:52:17.000000000 -0500
25593 +++ linux-2.6.33/drivers/scsi/scsi_logging.h    2010-03-07 12:23:36.049684703 -0500
25594 @@ -51,7 +51,7 @@ do {                                                          \
25595                 } while (0);                                    \
25596  } while (0)
25597  #else
25598 -#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
25599 +#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
25600  #endif /* CONFIG_SCSI_LOGGING */
25601
25602  /*
25603 diff -urNp linux-2.6.33/drivers/scsi/sg.c linux-2.6.33/drivers/scsi/sg.c
25604 --- linux-2.6.33/drivers/scsi/sg.c      2010-02-24 13:52:17.000000000 -0500
25605 +++ linux-2.6.33/drivers/scsi/sg.c      2010-03-07 12:23:36.053722379 -0500
25606 @@ -2292,7 +2292,7 @@ struct sg_proc_leaf {
25607         const struct file_operations * fops;
25608  };
25609
25610 -static struct sg_proc_leaf sg_proc_leaf_arr[] = {
25611 +static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
25612         {"allow_dio", &adio_fops},
25613         {"debug", &debug_fops},
25614         {"def_reserved_size", &dressz_fops},
25615 @@ -2307,7 +2307,7 @@ sg_proc_init(void)
25616  {
25617         int k, mask;
25618         int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
25619 -       struct sg_proc_leaf * leaf;
25620 +       const struct sg_proc_leaf * leaf;
25621
25622         sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
25623         if (!sg_proc_sgp)
25624 diff -urNp linux-2.6.33/drivers/serial/8250_pci.c linux-2.6.33/drivers/serial/8250_pci.c
25625 --- linux-2.6.33/drivers/serial/8250_pci.c      2010-02-24 13:52:17.000000000 -0500
25626 +++ linux-2.6.33/drivers/serial/8250_pci.c      2010-03-07 12:23:36.053722379 -0500
25627 @@ -3664,7 +3664,7 @@ static struct pci_device_id serial_pci_t
25628                 PCI_ANY_ID, PCI_ANY_ID,
25629                 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
25630                 0xffff00, pbn_default },
25631 -       { 0, }
25632 +       { 0, 0, 0, 0, 0, 0, 0 }
25633  };
25634
25635  static struct pci_driver serial_pci_driver = {
25636 diff -urNp linux-2.6.33/drivers/serial/kgdboc.c linux-2.6.33/drivers/serial/kgdboc.c
25637 --- linux-2.6.33/drivers/serial/kgdboc.c        2010-02-24 13:52:17.000000000 -0500
25638 +++ linux-2.6.33/drivers/serial/kgdboc.c        2010-03-07 12:23:36.053722379 -0500
25639 @@ -18,7 +18,7 @@
25640
25641  #define MAX_CONFIG_LEN         40
25642
25643 -static struct kgdb_io          kgdboc_io_ops;
25644 +static const struct kgdb_io    kgdboc_io_ops;
25645
25646  /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
25647  static int configured          = -1;
25648 @@ -154,7 +154,7 @@ static void kgdboc_post_exp_handler(void
25649                 module_put(THIS_MODULE);
25650  }
25651
25652 -static struct kgdb_io kgdboc_io_ops = {
25653 +static const struct kgdb_io kgdboc_io_ops = {
25654         .name                   = "kgdboc",
25655         .read_char              = kgdboc_get_char,
25656         .write_char             = kgdboc_put_char,
25657 diff -urNp linux-2.6.33/drivers/staging/b3dfg/b3dfg.c linux-2.6.33/drivers/staging/b3dfg/b3dfg.c
25658 --- linux-2.6.33/drivers/staging/b3dfg/b3dfg.c  2010-02-24 13:52:17.000000000 -0500
25659 +++ linux-2.6.33/drivers/staging/b3dfg/b3dfg.c  2010-03-07 12:23:36.053722379 -0500
25660 @@ -455,7 +455,7 @@ static int b3dfg_vma_fault(struct vm_are
25661         return VM_FAULT_NOPAGE;
25662  }
25663
25664 -static struct vm_operations_struct b3dfg_vm_ops = {
25665 +static const struct vm_operations_struct b3dfg_vm_ops = {
25666         .fault = b3dfg_vma_fault,
25667  };
25668
25669 @@ -836,7 +836,7 @@ static int b3dfg_mmap(struct file *filp,
25670         return r;
25671  }
25672
25673 -static struct file_operations b3dfg_fops = {
25674 +static const struct file_operations b3dfg_fops = {
25675         .owner = THIS_MODULE,
25676         .open = b3dfg_open,
25677         .release = b3dfg_release,
25678 diff -urNp linux-2.6.33/drivers/staging/comedi/comedi_fops.c linux-2.6.33/drivers/staging/comedi/comedi_fops.c
25679 --- linux-2.6.33/drivers/staging/comedi/comedi_fops.c   2010-02-24 13:52:17.000000000 -0500
25680 +++ linux-2.6.33/drivers/staging/comedi/comedi_fops.c   2010-03-07 12:23:36.053722379 -0500
25681 @@ -1384,7 +1384,7 @@ void comedi_unmap(struct vm_area_struct
25682         mutex_unlock(&dev->mutex);
25683  }
25684
25685 -static struct vm_operations_struct comedi_vm_ops = {
25686 +static const struct vm_operations_struct comedi_vm_ops = {
25687         .close = comedi_unmap,
25688  };
25689
25690 diff -urNp linux-2.6.33/drivers/staging/dream/pmem.c linux-2.6.33/drivers/staging/dream/pmem.c
25691 --- linux-2.6.33/drivers/staging/dream/pmem.c   2010-02-24 13:52:17.000000000 -0500
25692 +++ linux-2.6.33/drivers/staging/dream/pmem.c   2010-03-07 12:23:36.053722379 -0500
25693 @@ -174,7 +174,7 @@ static int pmem_mmap(struct file *, stru
25694  static int pmem_open(struct inode *, struct file *);
25695  static long pmem_ioctl(struct file *, unsigned int, unsigned long);
25696
25697 -struct file_operations pmem_fops = {
25698 +const struct file_operations pmem_fops = {
25699         .release = pmem_release,
25700         .mmap = pmem_mmap,
25701         .open = pmem_open,
25702 @@ -1202,7 +1202,7 @@ static ssize_t debug_read(struct file *f
25703         return simple_read_from_buffer(buf, count, ppos, buffer, n);
25704  }
25705
25706 -static struct file_operations debug_fops = {
25707 +static const struct file_operations debug_fops = {
25708         .read = debug_read,
25709         .open = debug_open,
25710  };
25711 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.33/drivers/staging/dream/qdsp5/adsp_driver.c
25712 --- linux-2.6.33/drivers/staging/dream/qdsp5/adsp_driver.c      2010-02-24 13:52:17.000000000 -0500
25713 +++ linux-2.6.33/drivers/staging/dream/qdsp5/adsp_driver.c      2010-03-07 12:23:36.053722379 -0500
25714 @@ -576,7 +576,7 @@ static struct adsp_device *inode_to_devi
25715  static dev_t adsp_devno;
25716  static struct class *adsp_class;
25717
25718 -static struct file_operations adsp_fops = {
25719 +static const struct file_operations adsp_fops = {
25720         .owner = THIS_MODULE,
25721         .open = adsp_open,
25722         .unlocked_ioctl = adsp_ioctl,
25723 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_aac.c
25724 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_aac.c        2010-02-24 13:52:17.000000000 -0500
25725 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_aac.c        2010-03-07 12:23:36.053722379 -0500
25726 @@ -1022,7 +1022,7 @@ done:
25727         return rc;
25728  }
25729
25730 -static struct file_operations audio_aac_fops = {
25731 +static const struct file_operations audio_aac_fops = {
25732         .owner = THIS_MODULE,
25733         .open = audio_open,
25734         .release = audio_release,
25735 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_amrnb.c
25736 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_amrnb.c      2010-02-24 13:52:17.000000000 -0500
25737 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_amrnb.c      2010-03-07 12:23:36.053722379 -0500
25738 @@ -833,7 +833,7 @@ done:
25739         return rc;
25740  }
25741
25742 -static struct file_operations audio_amrnb_fops = {
25743 +static const struct file_operations audio_amrnb_fops = {
25744         .owner = THIS_MODULE,
25745         .open = audamrnb_open,
25746         .release = audamrnb_release,
25747 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_evrc.c
25748 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_evrc.c       2010-02-24 13:52:17.000000000 -0500
25749 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_evrc.c       2010-03-07 12:23:36.053722379 -0500
25750 @@ -805,7 +805,7 @@ dma_fail:
25751         return rc;
25752  }
25753
25754 -static struct file_operations audio_evrc_fops = {
25755 +static const struct file_operations audio_evrc_fops = {
25756         .owner = THIS_MODULE,
25757         .open = audevrc_open,
25758         .release = audevrc_release,
25759 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_in.c
25760 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_in.c 2010-02-24 13:52:17.000000000 -0500
25761 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_in.c 2010-03-07 12:23:36.053722379 -0500
25762 @@ -913,7 +913,7 @@ static int audpre_open(struct inode *ino
25763         return 0;
25764  }
25765
25766 -static struct file_operations audio_fops = {
25767 +static const struct file_operations audio_fops = {
25768         .owner          = THIS_MODULE,
25769         .open           = audio_in_open,
25770         .release        = audio_in_release,
25771 @@ -922,7 +922,7 @@ static struct file_operations audio_fops
25772         .unlocked_ioctl = audio_in_ioctl,
25773  };
25774
25775 -static struct file_operations audpre_fops = {
25776 +static const struct file_operations audpre_fops = {
25777         .owner          = THIS_MODULE,
25778         .open           = audpre_open,
25779         .unlocked_ioctl = audpre_ioctl,
25780 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_mp3.c
25781 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_mp3.c        2010-02-24 13:52:17.000000000 -0500
25782 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_mp3.c        2010-03-07 12:23:36.053722379 -0500
25783 @@ -941,7 +941,7 @@ done:
25784         return rc;
25785  }
25786
25787 -static struct file_operations audio_mp3_fops = {
25788 +static const struct file_operations audio_mp3_fops = {
25789         .owner          = THIS_MODULE,
25790         .open           = audio_open,
25791         .release        = audio_release,
25792 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_out.c
25793 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_out.c        2010-02-24 13:52:17.000000000 -0500
25794 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_out.c        2010-03-07 12:23:36.053722379 -0500
25795 @@ -806,7 +806,7 @@ static int audpp_open(struct inode *inod
25796         return 0;
25797  }
25798
25799 -static struct file_operations audio_fops = {
25800 +static const struct file_operations audio_fops = {
25801         .owner          = THIS_MODULE,
25802         .open           = audio_open,
25803         .release        = audio_release,
25804 @@ -815,7 +815,7 @@ static struct file_operations audio_fops
25805         .unlocked_ioctl = audio_ioctl,
25806  };
25807
25808 -static struct file_operations audpp_fops = {
25809 +static const struct file_operations audpp_fops = {
25810         .owner          = THIS_MODULE,
25811         .open           = audpp_open,
25812         .unlocked_ioctl = audpp_ioctl,
25813 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.33/drivers/staging/dream/qdsp5/audio_qcelp.c
25814 --- linux-2.6.33/drivers/staging/dream/qdsp5/audio_qcelp.c      2010-02-24 13:52:17.000000000 -0500
25815 +++ linux-2.6.33/drivers/staging/dream/qdsp5/audio_qcelp.c      2010-03-07 12:23:36.053722379 -0500
25816 @@ -816,7 +816,7 @@ err:
25817         return rc;
25818  }
25819
25820 -static struct file_operations audio_qcelp_fops = {
25821 +static const struct file_operations audio_qcelp_fops = {
25822         .owner = THIS_MODULE,
25823         .open = audqcelp_open,
25824         .release = audqcelp_release,
25825 diff -urNp linux-2.6.33/drivers/staging/dream/qdsp5/snd.c linux-2.6.33/drivers/staging/dream/qdsp5/snd.c
25826 --- linux-2.6.33/drivers/staging/dream/qdsp5/snd.c      2010-02-24 13:52:17.000000000 -0500
25827 +++ linux-2.6.33/drivers/staging/dream/qdsp5/snd.c      2010-03-07 12:23:36.057707663 -0500
25828 @@ -242,7 +242,7 @@ err:
25829         return rc;
25830  }
25831
25832 -static struct file_operations snd_fops = {
25833 +static const struct file_operations snd_fops = {
25834         .owner          = THIS_MODULE,
25835         .open           = snd_open,
25836         .release        = snd_release,
25837 diff -urNp linux-2.6.33/drivers/staging/dream/smd/smd_qmi.c linux-2.6.33/drivers/staging/dream/smd/smd_qmi.c
25838 --- linux-2.6.33/drivers/staging/dream/smd/smd_qmi.c    2010-02-24 13:52:17.000000000 -0500
25839 +++ linux-2.6.33/drivers/staging/dream/smd/smd_qmi.c    2010-03-07 12:23:36.057707663 -0500
25840 @@ -788,7 +788,7 @@ static int qmi_release(struct inode *ip,
25841         return 0;
25842  }
25843
25844 -static struct file_operations qmi_fops = {
25845 +static const struct file_operations qmi_fops = {
25846         .owner = THIS_MODULE,
25847         .read = qmi_read,
25848         .write = qmi_write,
25849 diff -urNp linux-2.6.33/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.33/drivers/staging/dream/smd/smd_rpcrouter_device.c
25850 --- linux-2.6.33/drivers/staging/dream/smd/smd_rpcrouter_device.c       2010-02-24 13:52:17.000000000 -0500
25851 +++ linux-2.6.33/drivers/staging/dream/smd/smd_rpcrouter_device.c       2010-03-07 12:23:36.057707663 -0500
25852 @@ -214,7 +214,7 @@ static long rpcrouter_ioctl(struct file
25853         return rc;
25854  }
25855
25856 -static struct file_operations rpcrouter_server_fops = {
25857 +static const struct file_operations rpcrouter_server_fops = {
25858         .owner   = THIS_MODULE,
25859         .open    = rpcrouter_open,
25860         .release = rpcrouter_release,
25861 @@ -224,7 +224,7 @@ static struct file_operations rpcrouter_
25862         .unlocked_ioctl  = rpcrouter_ioctl,
25863  };
25864
25865 -static struct file_operations rpcrouter_router_fops = {
25866 +static const struct file_operations rpcrouter_router_fops = {
25867         .owner   = THIS_MODULE,
25868         .open    = rpcrouter_open,
25869         .release = rpcrouter_release,
25870 diff -urNp linux-2.6.33/drivers/staging/go7007/go7007-v4l2.c linux-2.6.33/drivers/staging/go7007/go7007-v4l2.c
25871 --- linux-2.6.33/drivers/staging/go7007/go7007-v4l2.c   2010-02-24 13:52:17.000000000 -0500
25872 +++ linux-2.6.33/drivers/staging/go7007/go7007-v4l2.c   2010-03-07 12:23:36.057707663 -0500
25873 @@ -1674,7 +1674,7 @@ static int go7007_vm_fault(struct vm_are
25874         return 0;
25875  }
25876
25877 -static struct vm_operations_struct go7007_vm_ops = {
25878 +static const struct vm_operations_struct go7007_vm_ops = {
25879         .open   = go7007_vm_open,
25880         .close  = go7007_vm_close,
25881         .fault  = go7007_vm_fault,
25882 diff -urNp linux-2.6.33/drivers/staging/hv/blkvsc_drv.c linux-2.6.33/drivers/staging/hv/blkvsc_drv.c
25883 --- linux-2.6.33/drivers/staging/hv/blkvsc_drv.c        2010-02-24 13:52:17.000000000 -0500
25884 +++ linux-2.6.33/drivers/staging/hv/blkvsc_drv.c        2010-03-07 12:23:36.057707663 -0500
25885 @@ -153,7 +153,7 @@ static int blkvsc_ringbuffer_size = BLKV
25886  /* The one and only one */
25887  static struct blkvsc_driver_context g_blkvsc_drv;
25888
25889 -static struct block_device_operations block_ops = {
25890 +static const struct block_device_operations block_ops = {
25891         .owner = THIS_MODULE,
25892         .open = blkvsc_open,
25893         .release = blkvsc_release,
25894 diff -urNp linux-2.6.33/drivers/staging/panel/panel.c linux-2.6.33/drivers/staging/panel/panel.c
25895 --- linux-2.6.33/drivers/staging/panel/panel.c  2010-02-24 13:52:17.000000000 -0500
25896 +++ linux-2.6.33/drivers/staging/panel/panel.c  2010-03-07 12:23:36.057707663 -0500
25897 @@ -1305,7 +1305,7 @@ static int lcd_release(struct inode *ino
25898         return 0;
25899  }
25900
25901 -static struct file_operations lcd_fops = {
25902 +static const struct file_operations lcd_fops = {
25903         .write   = lcd_write,
25904         .open    = lcd_open,
25905         .release = lcd_release,
25906 @@ -1565,7 +1565,7 @@ static int keypad_release(struct inode *
25907         return 0;
25908  }
25909
25910 -static struct file_operations keypad_fops = {
25911 +static const struct file_operations keypad_fops = {
25912         .read    = keypad_read,         /* read */
25913         .open    = keypad_open,         /* open */
25914         .release = keypad_release,      /* close */
25915 diff -urNp linux-2.6.33/drivers/staging/phison/phison.c linux-2.6.33/drivers/staging/phison/phison.c
25916 --- linux-2.6.33/drivers/staging/phison/phison.c        2010-02-24 13:52:17.000000000 -0500
25917 +++ linux-2.6.33/drivers/staging/phison/phison.c        2010-03-07 12:23:36.057707663 -0500
25918 @@ -43,7 +43,7 @@ static struct scsi_host_template phison_
25919         ATA_BMDMA_SHT(DRV_NAME),
25920  };
25921
25922 -static struct ata_port_operations phison_ops = {
25923 +static const struct ata_port_operations phison_ops = {
25924         .inherits               = &ata_bmdma_port_ops,
25925         .prereset               = phison_pre_reset,
25926  };
25927 diff -urNp linux-2.6.33/drivers/staging/poch/poch.c linux-2.6.33/drivers/staging/poch/poch.c
25928 --- linux-2.6.33/drivers/staging/poch/poch.c    2010-02-24 13:52:17.000000000 -0500
25929 +++ linux-2.6.33/drivers/staging/poch/poch.c    2010-03-07 12:23:36.057707663 -0500
25930 @@ -1032,7 +1032,7 @@ static int poch_ioctl(struct inode *inod
25931         return 0;
25932  }
25933
25934 -static struct file_operations poch_fops = {
25935 +static const struct file_operations poch_fops = {
25936         .owner = THIS_MODULE,
25937         .open = poch_open,
25938         .release = poch_release,
25939 diff -urNp linux-2.6.33/drivers/staging/pohmelfs/inode.c linux-2.6.33/drivers/staging/pohmelfs/inode.c
25940 --- linux-2.6.33/drivers/staging/pohmelfs/inode.c       2010-02-24 13:52:17.000000000 -0500
25941 +++ linux-2.6.33/drivers/staging/pohmelfs/inode.c       2010-03-07 12:23:36.057707663 -0500
25942 @@ -1840,7 +1840,7 @@ static int pohmelfs_fill_super(struct su
25943         mutex_init(&psb->mcache_lock);
25944         psb->mcache_root = RB_ROOT;
25945         psb->mcache_timeout = msecs_to_jiffies(5000);
25946 -       atomic_long_set(&psb->mcache_gen, 0);
25947 +       atomic_long_set_unchecked(&psb->mcache_gen, 0);
25948
25949         psb->trans_max_pages = 100;
25950
25951 diff -urNp linux-2.6.33/drivers/staging/pohmelfs/mcache.c linux-2.6.33/drivers/staging/pohmelfs/mcache.c
25952 --- linux-2.6.33/drivers/staging/pohmelfs/mcache.c      2010-02-24 13:52:17.000000000 -0500
25953 +++ linux-2.6.33/drivers/staging/pohmelfs/mcache.c      2010-03-07 12:23:36.057707663 -0500
25954 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
25955         m->data = data;
25956         m->start = start;
25957         m->size = size;
25958 -       m->gen = atomic_long_inc_return(&psb->mcache_gen);
25959 +       m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
25960
25961         mutex_lock(&psb->mcache_lock);
25962         err = pohmelfs_mcache_insert(psb, m);
25963 diff -urNp linux-2.6.33/drivers/staging/pohmelfs/netfs.h linux-2.6.33/drivers/staging/pohmelfs/netfs.h
25964 --- linux-2.6.33/drivers/staging/pohmelfs/netfs.h       2010-02-24 13:52:17.000000000 -0500
25965 +++ linux-2.6.33/drivers/staging/pohmelfs/netfs.h       2010-03-07 12:23:36.057707663 -0500
25966 @@ -570,7 +570,7 @@ struct pohmelfs_config;
25967  struct pohmelfs_sb {
25968         struct rb_root          mcache_root;
25969         struct mutex            mcache_lock;
25970 -       atomic_long_t           mcache_gen;
25971 +       atomic_long_unchecked_t mcache_gen;
25972         unsigned long           mcache_timeout;
25973
25974         unsigned int            idx;
25975 diff -urNp linux-2.6.33/drivers/staging/ramzswap/ramzswap_drv.c linux-2.6.33/drivers/staging/ramzswap/ramzswap_drv.c
25976 --- linux-2.6.33/drivers/staging/ramzswap/ramzswap_drv.c        2010-02-24 13:52:17.000000000 -0500
25977 +++ linux-2.6.33/drivers/staging/ramzswap/ramzswap_drv.c        2010-03-07 12:23:36.057707663 -0500
25978 @@ -1288,7 +1288,7 @@ out:
25979         return ret;
25980  }
25981
25982 -static struct block_device_operations ramzswap_devops = {
25983 +static const struct block_device_operations ramzswap_devops = {
25984         .ioctl = ramzswap_ioctl,
25985         .owner = THIS_MODULE,
25986  };
25987 diff -urNp linux-2.6.33/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.33/drivers/staging/rtl8192u/ieee80211/proc.c
25988 --- linux-2.6.33/drivers/staging/rtl8192u/ieee80211/proc.c      2010-02-24 13:52:17.000000000 -0500
25989 +++ linux-2.6.33/drivers/staging/rtl8192u/ieee80211/proc.c      2010-03-07 12:23:36.057707663 -0500
25990 @@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
25991         return seq_open(file, &crypto_seq_ops);
25992  }
25993
25994 -static struct file_operations proc_crypto_ops = {
25995 +static const struct file_operations proc_crypto_ops = {
25996         .open           = crypto_info_open,
25997         .read           = seq_read,
25998         .llseek         = seq_lseek,
25999 diff -urNp linux-2.6.33/drivers/staging/samsung-laptop/samsung-laptop.c linux-2.6.33/drivers/staging/samsung-laptop/samsung-laptop.c
26000 --- linux-2.6.33/drivers/staging/samsung-laptop/samsung-laptop.c        2010-02-24 13:52:17.000000000 -0500
26001 +++ linux-2.6.33/drivers/staging/samsung-laptop/samsung-laptop.c        2010-03-07 12:23:36.057707663 -0500
26002 @@ -268,7 +268,7 @@ static int update_status(struct backligh
26003         return 0;
26004  }
26005
26006 -static struct backlight_ops backlight_ops = {
26007 +static const struct backlight_ops backlight_ops = {
26008         .get_brightness = get_brightness,
26009         .update_status  = update_status,
26010  };
26011 diff -urNp linux-2.6.33/drivers/staging/sep/sep_driver.c linux-2.6.33/drivers/staging/sep/sep_driver.c
26012 --- linux-2.6.33/drivers/staging/sep/sep_driver.c       2010-02-24 13:52:17.000000000 -0500
26013 +++ linux-2.6.33/drivers/staging/sep/sep_driver.c       2010-03-07 12:23:36.061712127 -0500
26014 @@ -2605,7 +2605,7 @@ static struct pci_driver sep_pci_driver
26015  static dev_t sep_devno;
26016
26017  /* the files operations structure of the driver */
26018 -static struct file_operations sep_file_operations = {
26019 +static const struct file_operations sep_file_operations = {
26020         .owner = THIS_MODULE,
26021         .ioctl = sep_ioctl,
26022         .poll = sep_poll,
26023 diff -urNp linux-2.6.33/drivers/staging/vme/devices/vme_user.c linux-2.6.33/drivers/staging/vme/devices/vme_user.c
26024 --- linux-2.6.33/drivers/staging/vme/devices/vme_user.c 2010-02-24 13:52:17.000000000 -0500
26025 +++ linux-2.6.33/drivers/staging/vme/devices/vme_user.c 2010-03-07 12:23:36.061712127 -0500
26026 @@ -135,7 +135,7 @@ static int vme_user_ioctl(struct inode *
26027  static int __init vme_user_probe(struct device *, int, int);
26028  static int __exit vme_user_remove(struct device *, int, int);
26029
26030 -static struct file_operations vme_user_fops = {
26031 +static const struct file_operations vme_user_fops = {
26032          .open = vme_user_open,
26033          .release = vme_user_release,
26034          .read = vme_user_read,
26035 diff -urNp linux-2.6.33/drivers/uio/uio.c linux-2.6.33/drivers/uio/uio.c
26036 --- linux-2.6.33/drivers/uio/uio.c      2010-02-24 13:52:17.000000000 -0500
26037 +++ linux-2.6.33/drivers/uio/uio.c      2010-03-07 12:23:36.061712127 -0500
26038 @@ -129,7 +129,7 @@ static ssize_t map_type_show(struct kobj
26039         return entry->show(mem, buf);
26040  }
26041
26042 -static struct sysfs_ops map_sysfs_ops = {
26043 +static const struct sysfs_ops map_sysfs_ops = {
26044         .show = map_type_show,
26045  };
26046
26047 @@ -217,7 +217,7 @@ static ssize_t portio_type_show(struct k
26048         return entry->show(port, buf);
26049  }
26050
26051 -static struct sysfs_ops portio_sysfs_ops = {
26052 +static const struct sysfs_ops portio_sysfs_ops = {
26053         .show = portio_type_show,
26054  };
26055
26056 diff -urNp linux-2.6.33/drivers/usb/atm/usbatm.c linux-2.6.33/drivers/usb/atm/usbatm.c
26057 --- linux-2.6.33/drivers/usb/atm/usbatm.c       2010-02-24 13:52:17.000000000 -0500
26058 +++ linux-2.6.33/drivers/usb/atm/usbatm.c       2010-03-07 12:23:36.061712127 -0500
26059 @@ -333,7 +333,7 @@ static void usbatm_extract_one_cell(stru
26060                 if (printk_ratelimit())
26061                         atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
26062                                 __func__, vpi, vci);
26063 -               atomic_inc(&vcc->stats->rx_err);
26064 +               atomic_inc_unchecked(&vcc->stats->rx_err);
26065                 return;
26066         }
26067
26068 @@ -361,7 +361,7 @@ static void usbatm_extract_one_cell(stru
26069                 if (length > ATM_MAX_AAL5_PDU) {
26070                         atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
26071                                   __func__, length, vcc);
26072 -                       atomic_inc(&vcc->stats->rx_err);
26073 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
26074                         goto out;
26075                 }
26076
26077 @@ -370,14 +370,14 @@ static void usbatm_extract_one_cell(stru
26078                 if (sarb->len < pdu_length) {
26079                         atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
26080                                   __func__, pdu_length, sarb->len, vcc);
26081 -                       atomic_inc(&vcc->stats->rx_err);
26082 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
26083                         goto out;
26084                 }
26085
26086                 if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
26087                         atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
26088                                   __func__, vcc);
26089 -                       atomic_inc(&vcc->stats->rx_err);
26090 +                       atomic_inc_unchecked(&vcc->stats->rx_err);
26091                         goto out;
26092                 }
26093
26094 @@ -387,7 +387,7 @@ static void usbatm_extract_one_cell(stru
26095                         if (printk_ratelimit())
26096                                 atm_err(instance, "%s: no memory for skb (length: %u)!\n",
26097                                         __func__, length);
26098 -                       atomic_inc(&vcc->stats->rx_drop);
26099 +                       atomic_inc_unchecked(&vcc->stats->rx_drop);
26100                         goto out;
26101                 }
26102
26103 @@ -412,7 +412,7 @@ static void usbatm_extract_one_cell(stru
26104
26105                 vcc->push(vcc, skb);
26106
26107 -               atomic_inc(&vcc->stats->rx);
26108 +               atomic_inc_unchecked(&vcc->stats->rx);
26109         out:
26110                 skb_trim(sarb, 0);
26111         }
26112 @@ -616,7 +616,7 @@ static void usbatm_tx_process(unsigned l
26113                         struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
26114
26115                         usbatm_pop(vcc, skb);
26116 -                       atomic_inc(&vcc->stats->tx);
26117 +                       atomic_inc_unchecked(&vcc->stats->tx);
26118
26119                         skb = skb_dequeue(&instance->sndqueue);
26120                 }
26121 @@ -775,11 +775,11 @@ static int usbatm_atm_proc_read(struct a
26122         if (!left--)
26123                 return sprintf(page,
26124                                "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
26125 -                              atomic_read(&atm_dev->stats.aal5.tx),
26126 -                              atomic_read(&atm_dev->stats.aal5.tx_err),
26127 -                              atomic_read(&atm_dev->stats.aal5.rx),
26128 -                              atomic_read(&atm_dev->stats.aal5.rx_err),
26129 -                              atomic_read(&atm_dev->stats.aal5.rx_drop));
26130 +                              atomic_read_unchecked(&atm_dev->stats.aal5.tx),
26131 +                              atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
26132 +                              atomic_read_unchecked(&atm_dev->stats.aal5.rx),
26133 +                              atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
26134 +                              atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
26135
26136         if (!left--) {
26137                 if (instance->disconnected)
26138 diff -urNp linux-2.6.33/drivers/usb/class/cdc-acm.c linux-2.6.33/drivers/usb/class/cdc-acm.c
26139 --- linux-2.6.33/drivers/usb/class/cdc-acm.c    2010-02-24 13:52:17.000000000 -0500
26140 +++ linux-2.6.33/drivers/usb/class/cdc-acm.c    2010-03-07 12:23:36.061712127 -0500
26141 @@ -1590,7 +1590,7 @@ static struct usb_device_id acm_ids[] =
26142         { USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
26143                 USB_CDC_ACM_PROTO_AT_CDMA) },
26144
26145 -       { }
26146 +       { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
26147  };
26148
26149  MODULE_DEVICE_TABLE(usb, acm_ids);
26150 diff -urNp linux-2.6.33/drivers/usb/class/usblp.c linux-2.6.33/drivers/usb/class/usblp.c
26151 --- linux-2.6.33/drivers/usb/class/usblp.c      2010-02-24 13:52:17.000000000 -0500
26152 +++ linux-2.6.33/drivers/usb/class/usblp.c      2010-03-07 12:23:36.061712127 -0500
26153 @@ -228,7 +228,7 @@ static const struct quirk_printer_struct
26154         { 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
26155         { 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
26156         { 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
26157 -       { 0, 0 }
26158 +       { 0, 0, 0 }
26159  };
26160
26161  static int usblp_wwait(struct usblp *usblp, int nonblock);
26162 @@ -1412,7 +1412,7 @@ static struct usb_device_id usblp_ids []
26163         { USB_INTERFACE_INFO(7, 1, 2) },
26164         { USB_INTERFACE_INFO(7, 1, 3) },
26165         { USB_DEVICE(0x04b8, 0x0202) }, /* Seiko Epson Receipt Printer M129C */
26166 -       { }                                             /* Terminating entry */
26167 +       { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }          /* Terminating entry */
26168  };
26169
26170  MODULE_DEVICE_TABLE (usb, usblp_ids);
26171 diff -urNp linux-2.6.33/drivers/usb/core/hcd.c linux-2.6.33/drivers/usb/core/hcd.c
26172 --- linux-2.6.33/drivers/usb/core/hcd.c 2010-02-24 13:52:17.000000000 -0500
26173 +++ linux-2.6.33/drivers/usb/core/hcd.c 2010-03-07 12:23:36.061712127 -0500
26174 @@ -2266,7 +2266,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
26175
26176  #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
26177
26178 -struct usb_mon_operations *mon_ops;
26179 +const struct usb_mon_operations *mon_ops;
26180
26181  /*
26182   * The registration is unlocked.
26183 @@ -2276,7 +2276,7 @@ struct usb_mon_operations *mon_ops;
26184   * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
26185   */
26186
26187 -int usb_mon_register (struct usb_mon_operations *ops)
26188 +int usb_mon_register (const struct usb_mon_operations *ops)
26189  {
26190
26191         if (mon_ops)
26192 diff -urNp linux-2.6.33/drivers/usb/core/hcd.h linux-2.6.33/drivers/usb/core/hcd.h
26193 --- linux-2.6.33/drivers/usb/core/hcd.h 2010-02-24 13:52:17.000000000 -0500
26194 +++ linux-2.6.33/drivers/usb/core/hcd.h 2010-03-07 12:23:36.061712127 -0500
26195 @@ -501,13 +501,13 @@ static inline void usbfs_cleanup(void) {
26196  #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
26197
26198  struct usb_mon_operations {
26199 -       void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
26200 -       void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
26201 -       void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
26202 +       void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
26203 +       void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
26204 +       void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
26205         /* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
26206  };
26207
26208 -extern struct usb_mon_operations *mon_ops;
26209 +extern const struct usb_mon_operations *mon_ops;
26210
26211  static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
26212  {
26213 @@ -529,7 +529,7 @@ static inline void usbmon_urb_complete(s
26214                 (*mon_ops->urb_complete)(bus, urb, status);
26215  }
26216
26217 -int usb_mon_register(struct usb_mon_operations *ops);
26218 +int usb_mon_register(const struct usb_mon_operations *ops);
26219  void usb_mon_deregister(void);
26220
26221  #else
26222 diff -urNp linux-2.6.33/drivers/usb/core/hub.c linux-2.6.33/drivers/usb/core/hub.c
26223 --- linux-2.6.33/drivers/usb/core/hub.c 2010-02-24 13:52:17.000000000 -0500
26224 +++ linux-2.6.33/drivers/usb/core/hub.c 2010-03-07 12:23:36.061712127 -0500
26225 @@ -3450,7 +3450,7 @@ static struct usb_device_id hub_id_table
26226        .bDeviceClass = USB_CLASS_HUB},
26227      { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
26228        .bInterfaceClass = USB_CLASS_HUB},
26229 -    { }                                                /* Terminating entry */
26230 +    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }                                             /* Terminating entry */
26231  };
26232
26233  MODULE_DEVICE_TABLE (usb, hub_id_table);
26234 diff -urNp linux-2.6.33/drivers/usb/core/message.c linux-2.6.33/drivers/usb/core/message.c
26235 --- linux-2.6.33/drivers/usb/core/message.c     2010-02-24 13:52:17.000000000 -0500
26236 +++ linux-2.6.33/drivers/usb/core/message.c     2010-03-07 12:23:36.061712127 -0500
26237 @@ -909,8 +909,8 @@ char *usb_cache_string(struct usb_device
26238         buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
26239         if (buf) {
26240                 len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
26241 -               if (len > 0) {
26242 -                       smallbuf = kmalloc(++len, GFP_NOIO);
26243 +               if (len++ > 0) {
26244 +                       smallbuf = kmalloc(len, GFP_NOIO);
26245                         if (!smallbuf)
26246                                 return buf;
26247                         memcpy(smallbuf, buf, len);
26248 diff -urNp linux-2.6.33/drivers/usb/host/ehci-pci.c linux-2.6.33/drivers/usb/host/ehci-pci.c
26249 --- linux-2.6.33/drivers/usb/host/ehci-pci.c    2010-02-24 13:52:17.000000000 -0500
26250 +++ linux-2.6.33/drivers/usb/host/ehci-pci.c    2010-03-07 12:23:36.061712127 -0500
26251 @@ -422,7 +422,7 @@ static const struct pci_device_id pci_id
26252         PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
26253         .driver_data =  (unsigned long) &ehci_pci_hc_driver,
26254         },
26255 -       { /* end: all zeroes */ }
26256 +       { 0, 0, 0, 0, 0, 0, 0 }
26257  };
26258  MODULE_DEVICE_TABLE(pci, pci_ids);
26259
26260 diff -urNp linux-2.6.33/drivers/usb/host/uhci-hcd.c linux-2.6.33/drivers/usb/host/uhci-hcd.c
26261 --- linux-2.6.33/drivers/usb/host/uhci-hcd.c    2010-02-24 13:52:17.000000000 -0500
26262 +++ linux-2.6.33/drivers/usb/host/uhci-hcd.c    2010-03-07 12:23:36.061712127 -0500
26263 @@ -940,7 +940,7 @@ static const struct pci_device_id uhci_p
26264         /* handle any USB UHCI controller */
26265         PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
26266         .driver_data =  (unsigned long) &uhci_driver,
26267 -       }, { /* end: all zeroes */ }
26268 +       }, { 0, 0, 0, 0, 0, 0, 0 }
26269  };
26270
26271  MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
26272 diff -urNp linux-2.6.33/drivers/usb/misc/appledisplay.c linux-2.6.33/drivers/usb/misc/appledisplay.c
26273 --- linux-2.6.33/drivers/usb/misc/appledisplay.c        2010-02-24 13:52:17.000000000 -0500
26274 +++ linux-2.6.33/drivers/usb/misc/appledisplay.c        2010-03-07 12:23:36.065707381 -0500
26275 @@ -179,7 +179,7 @@ static int appledisplay_bl_get_brightnes
26276                 return pdata->msgdata[1];
26277  }
26278
26279 -static struct backlight_ops appledisplay_bl_data = {
26280 +static const struct backlight_ops appledisplay_bl_data = {
26281         .get_brightness = appledisplay_bl_get_brightness,
26282         .update_status  = appledisplay_bl_update_status,
26283  };
26284 diff -urNp linux-2.6.33/drivers/usb/mon/mon_main.c linux-2.6.33/drivers/usb/mon/mon_main.c
26285 --- linux-2.6.33/drivers/usb/mon/mon_main.c     2010-02-24 13:52:17.000000000 -0500
26286 +++ linux-2.6.33/drivers/usb/mon/mon_main.c     2010-03-07 12:23:36.065707381 -0500
26287 @@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
26288  /*
26289   * Ops
26290   */
26291 -static struct usb_mon_operations mon_ops_0 = {
26292 +static const struct usb_mon_operations mon_ops_0 = {
26293         .urb_submit =   mon_submit,
26294         .urb_submit_error = mon_submit_error,
26295         .urb_complete = mon_complete,
26296 diff -urNp linux-2.6.33/drivers/usb/storage/debug.h linux-2.6.33/drivers/usb/storage/debug.h
26297 --- linux-2.6.33/drivers/usb/storage/debug.h    2010-02-24 13:52:17.000000000 -0500
26298 +++ linux-2.6.33/drivers/usb/storage/debug.h    2010-03-07 12:23:36.065707381 -0500
26299 @@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char
26300  #define US_DEBUGPX(x...) printk( x )
26301  #define US_DEBUG(x) x
26302  #else
26303 -#define US_DEBUGP(x...)
26304 -#define US_DEBUGPX(x...)
26305 -#define US_DEBUG(x)
26306 +#define US_DEBUGP(x...) do {} while (0)
26307 +#define US_DEBUGPX(x...) do {} while (0)
26308 +#define US_DEBUG(x) do {} while (0)
26309  #endif
26310
26311  #endif
26312 diff -urNp linux-2.6.33/drivers/usb/storage/usb.c linux-2.6.33/drivers/usb/storage/usb.c
26313 --- linux-2.6.33/drivers/usb/storage/usb.c      2010-02-24 13:52:17.000000000 -0500
26314 +++ linux-2.6.33/drivers/usb/storage/usb.c      2010-03-07 12:23:36.065707381 -0500
26315 @@ -122,7 +122,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
26316
26317  static struct us_unusual_dev us_unusual_dev_list[] = {
26318  #      include "unusual_devs.h"
26319 -       { }             /* Terminating entry */
26320 +       { NULL, NULL, 0, 0, NULL } /* Terminating entry */
26321  };
26322
26323  #undef UNUSUAL_DEV
26324 diff -urNp linux-2.6.33/drivers/usb/storage/usual-tables.c linux-2.6.33/drivers/usb/storage/usual-tables.c
26325 --- linux-2.6.33/drivers/usb/storage/usual-tables.c     2010-02-24 13:52:17.000000000 -0500
26326 +++ linux-2.6.33/drivers/usb/storage/usual-tables.c     2010-03-07 12:23:36.065707381 -0500
26327 @@ -48,7 +48,7 @@
26328
26329  struct usb_device_id usb_storage_usb_ids[] = {
26330  #      include "unusual_devs.h"
26331 -       { }             /* Terminating entry */
26332 +       { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }          /* Terminating entry */
26333  };
26334  EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
26335
26336 diff -urNp linux-2.6.33/drivers/uwb/wlp/messages.c linux-2.6.33/drivers/uwb/wlp/messages.c
26337 --- linux-2.6.33/drivers/uwb/wlp/messages.c     2010-02-24 13:52:17.000000000 -0500
26338 +++ linux-2.6.33/drivers/uwb/wlp/messages.c     2010-03-07 12:23:36.065707381 -0500
26339 @@ -903,7 +903,7 @@ int wlp_parse_f0(struct wlp *wlp, struct
26340         size_t len = skb->len;
26341         size_t used;
26342         ssize_t result;
26343 -       struct wlp_nonce enonce, rnonce;
26344 +       struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
26345         enum wlp_assc_error assc_err;
26346         char enonce_buf[WLP_WSS_NONCE_STRSIZE];
26347         char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
26348 diff -urNp linux-2.6.33/drivers/uwb/wlp/sysfs.c linux-2.6.33/drivers/uwb/wlp/sysfs.c
26349 --- linux-2.6.33/drivers/uwb/wlp/sysfs.c        2010-02-24 13:52:17.000000000 -0500
26350 +++ linux-2.6.33/drivers/uwb/wlp/sysfs.c        2010-03-07 12:23:36.065707381 -0500
26351 @@ -615,8 +615,7 @@ ssize_t wlp_wss_attr_store(struct kobjec
26352         return ret;
26353  }
26354
26355 -static
26356 -struct sysfs_ops wss_sysfs_ops = {
26357 +static const struct sysfs_ops wss_sysfs_ops = {
26358         .show   = wlp_wss_attr_show,
26359         .store  = wlp_wss_attr_store,
26360  };
26361 diff -urNp linux-2.6.33/drivers/video/atmel_lcdfb.c linux-2.6.33/drivers/video/atmel_lcdfb.c
26362 --- linux-2.6.33/drivers/video/atmel_lcdfb.c    2010-02-24 13:52:17.000000000 -0500
26363 +++ linux-2.6.33/drivers/video/atmel_lcdfb.c    2010-03-07 12:23:36.065707381 -0500
26364 @@ -110,7 +110,7 @@ static int atmel_bl_get_brightness(struc
26365         return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
26366  }
26367
26368 -static struct backlight_ops atmel_lcdc_bl_ops = {
26369 +static const struct backlight_ops atmel_lcdc_bl_ops = {
26370         .update_status = atmel_bl_update_status,
26371         .get_brightness = atmel_bl_get_brightness,
26372  };
26373 diff -urNp linux-2.6.33/drivers/video/aty/aty128fb.c linux-2.6.33/drivers/video/aty/aty128fb.c
26374 --- linux-2.6.33/drivers/video/aty/aty128fb.c   2010-02-24 13:52:17.000000000 -0500
26375 +++ linux-2.6.33/drivers/video/aty/aty128fb.c   2010-03-07 12:23:36.065707381 -0500
26376 @@ -1787,7 +1787,7 @@ static int aty128_bl_get_brightness(stru
26377         return bd->props.brightness;
26378  }
26379
26380 -static struct backlight_ops aty128_bl_data = {
26381 +static const struct backlight_ops aty128_bl_data = {
26382         .get_brightness = aty128_bl_get_brightness,
26383         .update_status  = aty128_bl_update_status,
26384  };
26385 diff -urNp linux-2.6.33/drivers/video/aty/atyfb_base.c linux-2.6.33/drivers/video/aty/atyfb_base.c
26386 --- linux-2.6.33/drivers/video/aty/atyfb_base.c 2010-02-24 13:52:17.000000000 -0500
26387 +++ linux-2.6.33/drivers/video/aty/atyfb_base.c 2010-03-07 12:23:36.065707381 -0500
26388 @@ -2225,7 +2225,7 @@ static int aty_bl_get_brightness(struct
26389         return bd->props.brightness;
26390  }
26391
26392 -static struct backlight_ops aty_bl_data = {
26393 +static const struct backlight_ops aty_bl_data = {
26394         .get_brightness = aty_bl_get_brightness,
26395         .update_status  = aty_bl_update_status,
26396  };
26397 diff -urNp linux-2.6.33/drivers/video/aty/radeon_backlight.c linux-2.6.33/drivers/video/aty/radeon_backlight.c
26398 --- linux-2.6.33/drivers/video/aty/radeon_backlight.c   2010-02-24 13:52:17.000000000 -0500
26399 +++ linux-2.6.33/drivers/video/aty/radeon_backlight.c   2010-03-07 12:23:36.065707381 -0500
26400 @@ -127,7 +127,7 @@ static int radeon_bl_get_brightness(stru
26401         return bd->props.brightness;
26402  }
26403
26404 -static struct backlight_ops radeon_bl_data = {
26405 +static const struct backlight_ops radeon_bl_data = {
26406         .get_brightness = radeon_bl_get_brightness,
26407         .update_status  = radeon_bl_update_status,
26408  };
26409 diff -urNp linux-2.6.33/drivers/video/bf54x-lq043fb.c linux-2.6.33/drivers/video/bf54x-lq043fb.c
26410 --- linux-2.6.33/drivers/video/bf54x-lq043fb.c  2010-02-24 13:52:17.000000000 -0500
26411 +++ linux-2.6.33/drivers/video/bf54x-lq043fb.c  2010-03-07 12:23:36.065707381 -0500
26412 @@ -463,7 +463,7 @@ static int bl_get_brightness(struct back
26413         return 0;
26414  }
26415
26416 -static struct backlight_ops bfin_lq043fb_bl_ops = {
26417 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
26418         .get_brightness = bl_get_brightness,
26419  };
26420
26421 diff -urNp linux-2.6.33/drivers/video/bfin-t350mcqb-fb.c linux-2.6.33/drivers/video/bfin-t350mcqb-fb.c
26422 --- linux-2.6.33/drivers/video/bfin-t350mcqb-fb.c       2010-02-24 13:52:17.000000000 -0500
26423 +++ linux-2.6.33/drivers/video/bfin-t350mcqb-fb.c       2010-03-07 12:23:36.065707381 -0500
26424 @@ -381,7 +381,7 @@ static int bl_get_brightness(struct back
26425         return 0;
26426  }
26427
26428 -static struct backlight_ops bfin_lq043fb_bl_ops = {
26429 +static const struct backlight_ops bfin_lq043fb_bl_ops = {
26430         .get_brightness = bl_get_brightness,
26431  };
26432
26433 diff -urNp linux-2.6.33/drivers/video/fbmem.c linux-2.6.33/drivers/video/fbmem.c
26434 --- linux-2.6.33/drivers/video/fbmem.c  2010-02-24 13:52:17.000000000 -0500
26435 +++ linux-2.6.33/drivers/video/fbmem.c  2010-03-07 12:23:36.065707381 -0500
26436 @@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
26437                         image->dx += image->width + 8;
26438                 }
26439         } else if (rotate == FB_ROTATE_UD) {
26440 -               for (x = 0; x < num && image->dx >= 0; x++) {
26441 +               for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
26442                         info->fbops->fb_imageblit(info, image);
26443                         image->dx -= image->width + 8;
26444                 }
26445 @@ -415,7 +415,7 @@ static void fb_do_show_logo(struct fb_in
26446                         image->dy += image->height + 8;
26447                 }
26448         } else if (rotate == FB_ROTATE_CCW) {
26449 -               for (x = 0; x < num && image->dy >= 0; x++) {
26450 +               for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
26451                         info->fbops->fb_imageblit(info, image);
26452                         image->dy -= image->height + 8;
26453                 }
26454 @@ -1119,7 +1119,7 @@ static long do_fb_ioctl(struct fb_info *
26455                         return -EFAULT;
26456                 if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
26457                         return -EINVAL;
26458 -               if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
26459 +               if (con2fb.framebuffer >= FB_MAX)
26460                         return -EINVAL;
26461                 if (!registered_fb[con2fb.framebuffer])
26462                         request_module("fb%d", con2fb.framebuffer);
26463 diff -urNp linux-2.6.33/drivers/video/fbmon.c linux-2.6.33/drivers/video/fbmon.c
26464 --- linux-2.6.33/drivers/video/fbmon.c  2010-02-24 13:52:17.000000000 -0500
26465 +++ linux-2.6.33/drivers/video/fbmon.c  2010-03-07 12:23:36.065707381 -0500
26466 @@ -45,7 +45,7 @@
26467  #ifdef DEBUG
26468  #define DPRINTK(fmt, args...) printk(fmt,## args)
26469  #else
26470 -#define DPRINTK(fmt, args...)
26471 +#define DPRINTK(fmt, args...) do {} while (0)
26472  #endif
26473
26474  #define FBMON_FIX_HEADER  1
26475 diff -urNp linux-2.6.33/drivers/video/i810/i810_accel.c linux-2.6.33/drivers/video/i810/i810_accel.c
26476 --- linux-2.6.33/drivers/video/i810/i810_accel.c        2010-02-24 13:52:17.000000000 -0500
26477 +++ linux-2.6.33/drivers/video/i810/i810_accel.c        2010-03-07 12:23:36.065707381 -0500
26478 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct
26479                 }
26480         }
26481         printk("ringbuffer lockup!!!\n");
26482 +       printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
26483         i810_report_error(mmio);
26484         par->dev_flags |= LOCKUP;
26485         info->pixmap.scan_align = 1;
26486 diff -urNp linux-2.6.33/drivers/video/i810/i810_main.c linux-2.6.33/drivers/video/i810/i810_main.c
26487 --- linux-2.6.33/drivers/video/i810/i810_main.c 2010-02-24 13:52:17.000000000 -0500
26488 +++ linux-2.6.33/drivers/video/i810/i810_main.c 2010-03-07 12:23:36.069651738 -0500
26489 @@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
26490           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
26491         { PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
26492           PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
26493 -       { 0 },
26494 +       { 0, 0, 0, 0, 0, 0, 0 },
26495  };
26496
26497  static struct pci_driver i810fb_driver = {
26498 diff -urNp linux-2.6.33/drivers/video/modedb.c linux-2.6.33/drivers/video/modedb.c
26499 --- linux-2.6.33/drivers/video/modedb.c 2010-02-24 13:52:17.000000000 -0500
26500 +++ linux-2.6.33/drivers/video/modedb.c 2010-03-07 12:23:36.069651738 -0500
26501 @@ -39,240 +39,240 @@ static const struct fb_videomode modedb[
26502      {
26503         /* 640x400 @ 70 Hz, 31.5 kHz hsync */
26504         NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2,
26505 -       0, FB_VMODE_NONINTERLACED
26506 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26507      }, {
26508         /* 640x480 @ 60 Hz, 31.5 kHz hsync */
26509         NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,
26510 -       0, FB_VMODE_NONINTERLACED
26511 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26512      }, {
26513         /* 800x600 @ 56 Hz, 35.15 kHz hsync */
26514         NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,
26515 -       0, FB_VMODE_NONINTERLACED
26516 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26517      }, {
26518         /* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
26519         NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8,
26520 -       0, FB_VMODE_INTERLACED
26521 +       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
26522      }, {
26523         /* 640x400 @ 85 Hz, 37.86 kHz hsync */
26524         NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
26525 -       FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26526 +       FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26527      }, {
26528         /* 640x480 @ 72 Hz, 36.5 kHz hsync */
26529         NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3,
26530 -       0, FB_VMODE_NONINTERLACED
26531 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26532      }, {
26533         /* 640x480 @ 75 Hz, 37.50 kHz hsync */
26534         NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,
26535 -       0, FB_VMODE_NONINTERLACED
26536 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26537      }, {
26538         /* 800x600 @ 60 Hz, 37.8 kHz hsync */
26539         NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
26540 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26541 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26542      }, {
26543         /* 640x480 @ 85 Hz, 43.27 kHz hsync */
26544         NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3,
26545 -       0, FB_VMODE_NONINTERLACED
26546 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26547      }, {
26548         /* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
26549         NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10,
26550 -       0, FB_VMODE_INTERLACED
26551 +       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
26552      }, {
26553         /* 800x600 @ 72 Hz, 48.0 kHz hsync */
26554         NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
26555 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26556 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26557      }, {
26558         /* 1024x768 @ 60 Hz, 48.4 kHz hsync */
26559         NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6,
26560 -       0, FB_VMODE_NONINTERLACED
26561 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26562      }, {
26563         /* 640x480 @ 100 Hz, 53.01 kHz hsync */
26564         NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,
26565 -       0, FB_VMODE_NONINTERLACED
26566 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26567      }, {
26568         /* 1152x864 @ 60 Hz, 53.5 kHz hsync */
26569         NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8,
26570 -       0, FB_VMODE_NONINTERLACED
26571 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26572      }, {
26573         /* 800x600 @ 85 Hz, 55.84 kHz hsync */
26574         NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5,
26575 -       0, FB_VMODE_NONINTERLACED
26576 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26577      }, {
26578         /* 1024x768 @ 70 Hz, 56.5 kHz hsync */
26579         NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6,
26580 -       0, FB_VMODE_NONINTERLACED
26581 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26582      }, {
26583         /* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
26584         NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,
26585 -       0, FB_VMODE_INTERLACED
26586 +       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
26587      }, {
26588         /* 800x600 @ 100 Hz, 64.02 kHz hsync */
26589         NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6,
26590 -       0, FB_VMODE_NONINTERLACED
26591 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26592      }, {
26593         /* 1024x768 @ 76 Hz, 62.5 kHz hsync */
26594         NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3,
26595 -       0, FB_VMODE_NONINTERLACED
26596 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26597      }, {
26598         /* 1152x864 @ 70 Hz, 62.4 kHz hsync */
26599         NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10,
26600 -       0, FB_VMODE_NONINTERLACED
26601 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26602      }, {
26603         /* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
26604         NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3,
26605 -       0, FB_VMODE_NONINTERLACED
26606 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26607      }, {
26608         /* 1400x1050 @ 60Hz, 63.9 kHz hsync */
26609         NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3,
26610 -       0, FB_VMODE_NONINTERLACED
26611 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26612      }, {
26613         /* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
26614         NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
26615 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26616 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26617      }, {
26618         /* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
26619          NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
26620 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26621 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26622      }, {
26623         /* 1024x768 @ 85 Hz, 70.24 kHz hsync */
26624         NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6,
26625 -       0, FB_VMODE_NONINTERLACED
26626 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26627      }, {
26628         /* 1152x864 @ 78 Hz, 70.8 kHz hsync */
26629         NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12,
26630 -       0, FB_VMODE_NONINTERLACED
26631 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26632      }, {
26633         /* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
26634         NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8,
26635 -       0, FB_VMODE_NONINTERLACED
26636 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26637      }, {
26638         /* 1600x1200 @ 60Hz, 75.00 kHz hsync */
26639         NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
26640 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26641 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26642      }, {
26643         /* 1152x864 @ 84 Hz, 76.0 kHz hsync */
26644         NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12,
26645 -       0, FB_VMODE_NONINTERLACED
26646 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26647      }, {
26648         /* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
26649         NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3,
26650 -       0, FB_VMODE_NONINTERLACED
26651 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26652      }, {
26653         /* 1024x768 @ 100Hz, 80.21 kHz hsync */
26654         NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10,
26655 -       0, FB_VMODE_NONINTERLACED
26656 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26657      }, {
26658         /* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
26659         NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3,
26660 -       0, FB_VMODE_NONINTERLACED
26661 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26662      }, {
26663         /* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
26664         NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3,
26665 -       0, FB_VMODE_NONINTERLACED
26666 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26667      }, {
26668         /* 1152x864 @ 100 Hz, 89.62 kHz hsync */
26669         NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19,
26670 -       0, FB_VMODE_NONINTERLACED
26671 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26672      }, {
26673         /* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
26674         NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
26675 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26676 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26677      }, {
26678         /* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
26679         NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
26680 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26681 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26682      }, {
26683         /* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
26684         NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
26685 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26686 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26687      }, {
26688         /* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
26689         NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
26690 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26691 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26692      }, {
26693         /* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
26694         NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15,
26695 -       0, FB_VMODE_NONINTERLACED
26696 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26697      }, {
26698         /* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
26699         NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
26700 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26701 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26702      }, {
26703         /* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
26704         NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
26705 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26706 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26707      }, {
26708         /* 512x384 @ 78 Hz, 31.50 kHz hsync */
26709         NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3,
26710 -       0, FB_VMODE_NONINTERLACED
26711 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26712      }, {
26713         /* 512x384 @ 85 Hz, 34.38 kHz hsync */
26714         NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3,
26715 -       0, FB_VMODE_NONINTERLACED
26716 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26717      }, {
26718         /* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
26719         NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1,
26720 -       0, FB_VMODE_DOUBLE
26721 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26722      }, {
26723         /* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
26724         NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1,
26725 -       0, FB_VMODE_DOUBLE
26726 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26727      }, {
26728         /* 320x240 @ 72 Hz, 36.5 kHz hsync */
26729         NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2,
26730 -       0, FB_VMODE_DOUBLE
26731 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26732      }, {
26733         /* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
26734         NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1,
26735 -       0, FB_VMODE_DOUBLE
26736 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26737      }, {
26738         /* 400x300 @ 60 Hz, 37.8 kHz hsync */
26739         NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2,
26740 -       0, FB_VMODE_DOUBLE
26741 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26742      }, {
26743         /* 400x300 @ 72 Hz, 48.0 kHz hsync */
26744         NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,
26745 -       0, FB_VMODE_DOUBLE
26746 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26747      }, {
26748         /* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
26749         NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1,
26750 -       0, FB_VMODE_DOUBLE
26751 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26752      }, {
26753         /* 480x300 @ 60 Hz, 37.8 kHz hsync */
26754         NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2,
26755 -       0, FB_VMODE_DOUBLE
26756 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26757      }, {
26758         /* 480x300 @ 63 Hz, 39.6 kHz hsync */
26759         NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2,
26760 -       0, FB_VMODE_DOUBLE
26761 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26762      }, {
26763         /* 480x300 @ 72 Hz, 48.0 kHz hsync */
26764         NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3,
26765 -       0, FB_VMODE_DOUBLE
26766 +       0, FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN
26767      }, {
26768         /* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
26769         NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
26770         FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
26771 -       FB_VMODE_NONINTERLACED
26772 +       FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26773      }, {
26774         /* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
26775         NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
26776 -       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED
26777 +       FB_SYNC_HOR_HIGH_ACT|FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26778      }, {
26779         /* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
26780         NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5,
26781 -       0, FB_VMODE_NONINTERLACED
26782 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26783     }, {
26784         /* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
26785         NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3,
26786 -       0, FB_VMODE_NONINTERLACED
26787 +       0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN
26788      }, {
26789         /* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
26790         NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5,
26791 -       0, FB_VMODE_INTERLACED
26792 +       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
26793      }, {
26794         /* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
26795         NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5,
26796 -       0, FB_VMODE_INTERLACED
26797 +       0, FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN
26798      },
26799  };
26800
26801 diff -urNp linux-2.6.33/drivers/video/nvidia/nv_backlight.c linux-2.6.33/drivers/video/nvidia/nv_backlight.c
26802 --- linux-2.6.33/drivers/video/nvidia/nv_backlight.c    2010-02-24 13:52:17.000000000 -0500
26803 +++ linux-2.6.33/drivers/video/nvidia/nv_backlight.c    2010-03-07 12:23:36.069651738 -0500
26804 @@ -87,7 +87,7 @@ static int nvidia_bl_get_brightness(stru
26805         return bd->props.brightness;
26806  }
26807
26808 -static struct backlight_ops nvidia_bl_ops = {
26809 +static const struct backlight_ops nvidia_bl_ops = {
26810         .get_brightness = nvidia_bl_get_brightness,
26811         .update_status  = nvidia_bl_update_status,
26812  };
26813 diff -urNp linux-2.6.33/drivers/video/omap2/displays/panel-taal.c linux-2.6.33/drivers/video/omap2/displays/panel-taal.c
26814 --- linux-2.6.33/drivers/video/omap2/displays/panel-taal.c      2010-02-24 13:52:17.000000000 -0500
26815 +++ linux-2.6.33/drivers/video/omap2/displays/panel-taal.c      2010-03-07 12:23:36.069651738 -0500
26816 @@ -313,7 +313,7 @@ static int taal_bl_get_intensity(struct
26817         return 0;
26818  }
26819
26820 -static struct backlight_ops taal_bl_ops = {
26821 +static const struct backlight_ops taal_bl_ops = {
26822         .get_brightness = taal_bl_get_intensity,
26823         .update_status  = taal_bl_update_status,
26824  };
26825 diff -urNp linux-2.6.33/drivers/video/omap2/dss/manager.c linux-2.6.33/drivers/video/omap2/dss/manager.c
26826 --- linux-2.6.33/drivers/video/omap2/dss/manager.c      2010-02-24 13:52:17.000000000 -0500
26827 +++ linux-2.6.33/drivers/video/omap2/dss/manager.c      2010-03-07 12:23:36.069651738 -0500
26828 @@ -341,7 +341,7 @@ static ssize_t manager_attr_store(struct
26829         return manager_attr->store(manager, buf, size);
26830  }
26831
26832 -static struct sysfs_ops manager_sysfs_ops = {
26833 +static const struct sysfs_ops manager_sysfs_ops = {
26834         .show = manager_attr_show,
26835         .store = manager_attr_store,
26836  };
26837 diff -urNp linux-2.6.33/drivers/video/omap2/dss/overlay.c linux-2.6.33/drivers/video/omap2/dss/overlay.c
26838 --- linux-2.6.33/drivers/video/omap2/dss/overlay.c      2010-02-24 13:52:17.000000000 -0500
26839 +++ linux-2.6.33/drivers/video/omap2/dss/overlay.c      2010-03-07 12:23:36.069651738 -0500
26840 @@ -320,7 +320,7 @@ static ssize_t overlay_attr_store(struct
26841         return overlay_attr->store(overlay, buf, size);
26842  }
26843
26844 -static struct sysfs_ops overlay_sysfs_ops = {
26845 +static const struct sysfs_ops overlay_sysfs_ops = {
26846         .show = overlay_attr_show,
26847         .store = overlay_attr_store,
26848  };
26849 diff -urNp linux-2.6.33/drivers/video/riva/fbdev.c linux-2.6.33/drivers/video/riva/fbdev.c
26850 --- linux-2.6.33/drivers/video/riva/fbdev.c     2010-02-24 13:52:17.000000000 -0500
26851 +++ linux-2.6.33/drivers/video/riva/fbdev.c     2010-03-07 12:23:36.069651738 -0500
26852 @@ -331,7 +331,7 @@ static int riva_bl_get_brightness(struct
26853         return bd->props.brightness;
26854  }
26855
26856 -static struct backlight_ops riva_bl_ops = {
26857 +static const struct backlight_ops riva_bl_ops = {
26858         .get_brightness = riva_bl_get_brightness,
26859         .update_status  = riva_bl_update_status,
26860  };
26861 diff -urNp linux-2.6.33/drivers/video/uvesafb.c linux-2.6.33/drivers/video/uvesafb.c
26862 --- linux-2.6.33/drivers/video/uvesafb.c        2010-02-24 13:52:17.000000000 -0500
26863 +++ linux-2.6.33/drivers/video/uvesafb.c        2010-03-07 12:23:36.069651738 -0500
26864 @@ -18,6 +18,7 @@
26865  #include <linux/fb.h>
26866  #include <linux/io.h>
26867  #include <linux/mutex.h>
26868 +#include <linux/moduleloader.h>
26869  #include <video/edid.h>
26870  #include <video/uvesafb.h>
26871  #ifdef CONFIG_X86
26872 @@ -120,7 +121,7 @@ static int uvesafb_helper_start(void)
26873                 NULL,
26874         };
26875
26876 -       return call_usermodehelper(v86d_path, argv, envp, 1);
26877 +       return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
26878  }
26879
26880  /*
26881 @@ -568,10 +569,32 @@ static int __devinit uvesafb_vbe_getpmi(
26882         if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
26883                 par->pmi_setpal = par->ypan = 0;
26884         } else {
26885 +
26886 +#ifdef CONFIG_PAX_KERNEXEC
26887 +#ifdef CONFIG_MODULES
26888 +               par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
26889 +#endif
26890 +               if (!par->pmi_code) {
26891 +                       par->pmi_setpal = par->ypan = 0;
26892 +                       return 0;
26893 +               }
26894 +#endif
26895 +
26896                 par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
26897                                                 + task->t.regs.edi);
26898 +
26899 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
26900 +               pax_open_kernel();
26901 +               memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
26902 +               pax_close_kernel();
26903 +
26904 +               par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
26905 +               par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
26906 +#else
26907                 par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
26908                 par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
26909 +#endif
26910 +
26911                 printk(KERN_INFO "uvesafb: protected mode interface info at "
26912                                  "%04x:%04x\n",
26913                                  (u16)task->t.regs.es, (u16)task->t.regs.edi);
26914 @@ -1799,6 +1822,11 @@ out:
26915         if (par->vbe_modes)
26916                 kfree(par->vbe_modes);
26917
26918 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
26919 +       if (par->pmi_code)
26920 +               module_free_exec(NULL, par->pmi_code);
26921 +#endif
26922 +
26923         framebuffer_release(info);
26924         return err;
26925  }
26926 @@ -1825,6 +1853,12 @@ static int uvesafb_remove(struct platfor
26927                                 kfree(par->vbe_state_orig);
26928                         if (par->vbe_state_saved)
26929                                 kfree(par->vbe_state_saved);
26930 +
26931 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
26932 +                       if (par->pmi_code)
26933 +                               module_free_exec(NULL, par->pmi_code);
26934 +#endif
26935 +
26936                 }
26937
26938                 framebuffer_release(info);
26939 diff -urNp linux-2.6.33/drivers/video/vesafb.c linux-2.6.33/drivers/video/vesafb.c
26940 --- linux-2.6.33/drivers/video/vesafb.c 2010-02-24 13:52:17.000000000 -0500
26941 +++ linux-2.6.33/drivers/video/vesafb.c 2010-03-07 12:23:36.069651738 -0500
26942 @@ -9,6 +9,7 @@
26943   */
26944
26945  #include <linux/module.h>
26946 +#include <linux/moduleloader.h>
26947  #include <linux/kernel.h>
26948  #include <linux/errno.h>
26949  #include <linux/string.h>
26950 @@ -53,8 +54,8 @@ static int   vram_remap __initdata;           /*
26951  static int   vram_total __initdata;            /* Set total amount of memory */
26952  static int   pmi_setpal __read_mostly = 1;     /* pmi for palette changes ??? */
26953  static int   ypan       __read_mostly;         /* 0..nothing, 1..ypan, 2..ywrap */
26954 -static void  (*pmi_start)(void) __read_mostly;
26955 -static void  (*pmi_pal)  (void) __read_mostly;
26956 +static void  (*pmi_start)(void) __read_only;
26957 +static void  (*pmi_pal)  (void) __read_only;
26958  static int   depth      __read_mostly;
26959  static int   vga_compat __read_mostly;
26960  /* --------------------------------------------------------------------- */
26961 @@ -233,6 +234,7 @@ static int __init vesafb_probe(struct pl
26962         unsigned int size_vmode;
26963         unsigned int size_remap;
26964         unsigned int size_total;
26965 +       void *pmi_code = NULL;
26966
26967         if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
26968                 return -ENODEV;
26969 @@ -275,10 +277,6 @@ static int __init vesafb_probe(struct pl
26970                 size_remap = size_total;
26971         vesafb_fix.smem_len = size_remap;
26972
26973 -#ifndef __i386__
26974 -       screen_info.vesapm_seg = 0;
26975 -#endif
26976 -
26977         if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
26978                 printk(KERN_WARNING
26979                        "vesafb: cannot reserve video memory at 0x%lx\n",
26980 @@ -315,9 +313,21 @@ static int __init vesafb_probe(struct pl
26981         printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
26982                vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
26983
26984 +#ifdef __i386__
26985 +
26986 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
26987 +       pmi_code = module_alloc_exec(screen_info.vesapm_size);
26988 +       if (!pmi_code)
26989 +#elif !defined(CONFIG_PAX_KERNEXEC)
26990 +       if (0)
26991 +#endif
26992 +
26993 +#endif
26994 +       screen_info.vesapm_seg = 0;
26995 +
26996         if (screen_info.vesapm_seg) {
26997 -               printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
26998 -                      screen_info.vesapm_seg,screen_info.vesapm_off);
26999 +               printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
27000 +                      screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
27001         }
27002
27003         if (screen_info.vesapm_seg < 0xc000)
27004 @@ -325,9 +335,25 @@ static int __init vesafb_probe(struct pl
27005
27006         if (ypan || pmi_setpal) {
27007                 unsigned short *pmi_base;
27008 -               pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
27009 -               pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
27010 -               pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
27011 +
27012 +               pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
27013 +
27014 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
27015 +               pax_open_kernel();
27016 +               memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
27017 +#else
27018 +               pmi_code = pmi_base;
27019 +#endif
27020 +
27021 +               pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
27022 +               pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
27023 +
27024 +#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
27025 +               pmi_start = ktva_ktla(pmi_start);
27026 +               pmi_pal = ktva_ktla(pmi_pal);
27027 +               pax_close_kernel();
27028 +#endif
27029 +
27030                 printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
27031                 if (pmi_base[3]) {
27032                         printk(KERN_INFO "vesafb: pmi: ports = ");
27033 @@ -469,6 +495,11 @@ static int __init vesafb_probe(struct pl
27034                info->node, info->fix.id);
27035         return 0;
27036  err:
27037 +
27038 +#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
27039 +       module_free_exec(NULL, pmi_code);
27040 +#endif
27041 +
27042         if (info->screen_base)
27043                 iounmap(info->screen_base);
27044         framebuffer_release(info);
27045 diff -urNp linux-2.6.33/drivers/xen/sys-hypervisor.c linux-2.6.33/drivers/xen/sys-hypervisor.c
27046 --- linux-2.6.33/drivers/xen/sys-hypervisor.c   2010-02-24 13:52:17.000000000 -0500
27047 +++ linux-2.6.33/drivers/xen/sys-hypervisor.c   2010-03-07 12:23:36.069651738 -0500
27048 @@ -426,7 +426,7 @@ static ssize_t hyp_sysfs_store(struct ko
27049         return 0;
27050  }
27051
27052 -static struct sysfs_ops hyp_sysfs_ops = {
27053 +static const struct sysfs_ops hyp_sysfs_ops = {
27054         .show = hyp_sysfs_show,
27055         .store = hyp_sysfs_store,
27056  };
27057 diff -urNp linux-2.6.33/fs/9p/vfs_inode.c linux-2.6.33/fs/9p/vfs_inode.c
27058 --- linux-2.6.33/fs/9p/vfs_inode.c      2010-02-24 13:52:17.000000000 -0500
27059 +++ linux-2.6.33/fs/9p/vfs_inode.c      2010-03-07 12:23:36.069651738 -0500
27060 @@ -1041,7 +1041,7 @@ static void *v9fs_vfs_follow_link(struct
27061  static void
27062  v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
27063  {
27064 -       char *s = nd_get_link(nd);
27065 +       const char *s = nd_get_link(nd);
27066
27067         P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
27068                 IS_ERR(s) ? "<error>" : s);
27069 diff -urNp linux-2.6.33/fs/aio.c linux-2.6.33/fs/aio.c
27070 --- linux-2.6.33/fs/aio.c       2010-02-24 13:52:17.000000000 -0500
27071 +++ linux-2.6.33/fs/aio.c       2010-03-07 12:23:36.069651738 -0500
27072 @@ -129,7 +129,7 @@ static int aio_setup_ring(struct kioctx
27073         size += sizeof(struct io_event) * nr_events;
27074         nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
27075
27076 -       if (nr_pages < 0)
27077 +       if (nr_pages <= 0)
27078                 return -EINVAL;
27079
27080         nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
27081 diff -urNp linux-2.6.33/fs/attr.c linux-2.6.33/fs/attr.c
27082 --- linux-2.6.33/fs/attr.c      2010-02-24 13:52:17.000000000 -0500
27083 +++ linux-2.6.33/fs/attr.c      2010-03-07 12:23:36.069651738 -0500
27084 @@ -83,6 +83,7 @@ int inode_newsize_ok(const struct inode
27085                 unsigned long limit;
27086
27087                 limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
27088 +               gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
27089                 if (limit != RLIM_INFINITY && offset > limit)
27090                         goto out_sig;
27091                 if (offset > inode->i_sb->s_maxbytes)
27092 diff -urNp linux-2.6.33/fs/autofs/root.c linux-2.6.33/fs/autofs/root.c
27093 --- linux-2.6.33/fs/autofs/root.c       2010-02-24 13:52:17.000000000 -0500
27094 +++ linux-2.6.33/fs/autofs/root.c       2010-03-07 12:23:36.069651738 -0500
27095 @@ -299,7 +299,8 @@ static int autofs_root_symlink(struct in
27096         set_bit(n,sbi->symlink_bitmap);
27097         sl = &sbi->symlink[n];
27098         sl->len = strlen(symname);
27099 -       sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
27100 +       slsize = sl->len+1;
27101 +       sl->data = kmalloc(slsize, GFP_KERNEL);
27102         if (!sl->data) {
27103                 clear_bit(n,sbi->symlink_bitmap);
27104                 unlock_kernel();
27105 diff -urNp linux-2.6.33/fs/autofs4/symlink.c linux-2.6.33/fs/autofs4/symlink.c
27106 --- linux-2.6.33/fs/autofs4/symlink.c   2010-02-24 13:52:17.000000000 -0500
27107 +++ linux-2.6.33/fs/autofs4/symlink.c   2010-03-07 12:23:36.069651738 -0500
27108 @@ -15,7 +15,7 @@
27109  static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
27110  {
27111         struct autofs_info *ino = autofs4_dentry_ino(dentry);
27112 -       nd_set_link(nd, (char *)ino->u.symlink);
27113 +       nd_set_link(nd, ino->u.symlink);
27114         return NULL;
27115  }
27116
27117 diff -urNp linux-2.6.33/fs/befs/linuxvfs.c linux-2.6.33/fs/befs/linuxvfs.c
27118 --- linux-2.6.33/fs/befs/linuxvfs.c     2010-02-24 13:52:17.000000000 -0500
27119 +++ linux-2.6.33/fs/befs/linuxvfs.c     2010-03-07 12:23:36.073720428 -0500
27120 @@ -493,7 +493,7 @@ static void befs_put_link(struct dentry
27121  {
27122         befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
27123         if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
27124 -               char *link = nd_get_link(nd);
27125 +               const char *link = nd_get_link(nd);
27126                 if (!IS_ERR(link))
27127                         kfree(link);
27128         }
27129 diff -urNp linux-2.6.33/fs/binfmt_aout.c linux-2.6.33/fs/binfmt_aout.c
27130 --- linux-2.6.33/fs/binfmt_aout.c       2010-02-24 13:52:17.000000000 -0500
27131 +++ linux-2.6.33/fs/binfmt_aout.c       2010-03-07 12:23:36.073720428 -0500
27132 @@ -16,6 +16,7 @@
27133  #include <linux/string.h>
27134  #include <linux/fs.h>
27135  #include <linux/file.h>
27136 +#include <linux/security.h>
27137  #include <linux/stat.h>
27138  #include <linux/fcntl.h>
27139  #include <linux/ptrace.h>
27140 @@ -114,10 +115,12 @@ static int aout_core_dump(struct coredum
27141
27142  /* If the size of the dump file exceeds the rlimit, then see what would happen
27143     if we wrote the stack, but not the data area.  */
27144 +       gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
27145         if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > cprm->limit)
27146                 dump.u_dsize = 0;
27147
27148  /* Make sure we have enough room to write the stack and data areas. */
27149 +       gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
27150         if ((dump.u_ssize + 1) * PAGE_SIZE > cprm->limit)
27151                 dump.u_ssize = 0;
27152
27153 @@ -250,6 +253,8 @@ static int load_aout_binary(struct linux
27154         rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
27155         if (rlim >= RLIM_INFINITY)
27156                 rlim = ~0;
27157 +
27158 +       gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
27159         if (ex.a_data + ex.a_bss > rlim)
27160                 return -ENOMEM;
27161
27162 @@ -278,6 +283,27 @@ static int load_aout_binary(struct linux
27163         install_exec_creds(bprm);
27164         current->flags &= ~PF_FORKNOEXEC;
27165
27166 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
27167 +       current->mm->pax_flags = 0UL;
27168 +#endif
27169 +
27170 +#ifdef CONFIG_PAX_PAGEEXEC
27171 +       if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
27172 +               current->mm->pax_flags |= MF_PAX_PAGEEXEC;
27173 +
27174 +#ifdef CONFIG_PAX_EMUTRAMP
27175 +               if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
27176 +                       current->mm->pax_flags |= MF_PAX_EMUTRAMP;
27177 +#endif
27178 +
27179 +#ifdef CONFIG_PAX_MPROTECT
27180 +               if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
27181 +                       current->mm->pax_flags |= MF_PAX_MPROTECT;
27182 +#endif
27183 +
27184 +       }
27185 +#endif
27186 +
27187         if (N_MAGIC(ex) == OMAGIC) {
27188                 unsigned long text_addr, map_size;
27189                 loff_t pos;
27190 @@ -350,7 +376,7 @@ static int load_aout_binary(struct linux
27191
27192                 down_write(&current->mm->mmap_sem);
27193                 error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
27194 -                               PROT_READ | PROT_WRITE | PROT_EXEC,
27195 +                               PROT_READ | PROT_WRITE,
27196                                 MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
27197                                 fd_offset + ex.a_text);
27198                 up_write(&current->mm->mmap_sem);
27199 diff -urNp linux-2.6.33/fs/binfmt_elf.c linux-2.6.33/fs/binfmt_elf.c
27200 --- linux-2.6.33/fs/binfmt_elf.c        2010-02-24 13:52:17.000000000 -0500
27201 +++ linux-2.6.33/fs/binfmt_elf.c        2010-03-07 12:23:36.073720428 -0500
27202 @@ -50,6 +50,10 @@ static int elf_core_dump(struct coredump
27203  #define elf_core_dump  NULL
27204  #endif
27205
27206 +#ifdef CONFIG_PAX_MPROTECT
27207 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
27208 +#endif
27209 +
27210  #if ELF_EXEC_PAGESIZE > PAGE_SIZE
27211  #define ELF_MIN_ALIGN  ELF_EXEC_PAGESIZE
27212  #else
27213 @@ -69,6 +73,11 @@ static struct linux_binfmt elf_format =
27214                 .load_binary    = load_elf_binary,
27215                 .load_shlib     = load_elf_library,
27216                 .core_dump      = elf_core_dump,
27217 +
27218 +#ifdef CONFIG_PAX_MPROTECT
27219 +               .handle_mprotect= elf_handle_mprotect,
27220 +#endif
27221 +
27222                 .min_coredump   = ELF_EXEC_PAGESIZE,
27223                 .hasvdso        = 1
27224  };
27225 @@ -77,6 +86,8 @@ static struct linux_binfmt elf_format =
27226
27227  static int set_brk(unsigned long start, unsigned long end)
27228  {
27229 +       unsigned long e = end;
27230 +
27231         start = ELF_PAGEALIGN(start);
27232         end = ELF_PAGEALIGN(end);
27233         if (end > start) {
27234 @@ -87,7 +98,7 @@ static int set_brk(unsigned long start,
27235                 if (BAD_ADDR(addr))
27236                         return addr;
27237         }
27238 -       current->mm->start_brk = current->mm->brk = end;
27239 +       current->mm->start_brk = current->mm->brk = e;
27240         return 0;
27241  }
27242
27243 @@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
27244         elf_addr_t __user *u_rand_bytes;
27245         const char *k_platform = ELF_PLATFORM;
27246         const char *k_base_platform = ELF_BASE_PLATFORM;
27247 -       unsigned char k_rand_bytes[16];
27248 +       u32 k_rand_bytes[4];
27249         int items;
27250         elf_addr_t *elf_info;
27251         int ei_index = 0;
27252 @@ -195,6 +206,10 @@ create_elf_tables(struct linux_binprm *b
27253          * Generate 16 random bytes for userspace PRNG seeding.
27254          */
27255         get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
27256 +       srandom32(k_rand_bytes[0] ^ random32());
27257 +       srandom32(k_rand_bytes[1] ^ random32());
27258 +       srandom32(k_rand_bytes[2] ^ random32());
27259 +       srandom32(k_rand_bytes[3] ^ random32());
27260         u_rand_bytes = (elf_addr_t __user *)
27261                        STACK_ALLOC(p, sizeof(k_rand_bytes));
27262         if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
27263 @@ -385,10 +400,10 @@ static unsigned long load_elf_interp(str
27264  {
27265         struct elf_phdr *elf_phdata;
27266         struct elf_phdr *eppnt;
27267 -       unsigned long load_addr = 0;
27268 +       unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
27269         int load_addr_set = 0;
27270         unsigned long last_bss = 0, elf_bss = 0;
27271 -       unsigned long error = ~0UL;
27272 +       unsigned long error = -EINVAL;
27273         unsigned long total_size;
27274         int retval, i, size;
27275
27276 @@ -434,6 +449,11 @@ static unsigned long load_elf_interp(str
27277                 goto out_close;
27278         }
27279
27280 +#ifdef CONFIG_PAX_SEGMEXEC
27281 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
27282 +               pax_task_size = SEGMEXEC_TASK_SIZE;
27283 +#endif
27284 +
27285         eppnt = elf_phdata;
27286         for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
27287                 if (eppnt->p_type == PT_LOAD) {
27288 @@ -477,8 +497,8 @@ static unsigned long load_elf_interp(str
27289                         k = load_addr + eppnt->p_vaddr;
27290                         if (BAD_ADDR(k) ||
27291                             eppnt->p_filesz > eppnt->p_memsz ||
27292 -                           eppnt->p_memsz > TASK_SIZE ||
27293 -                           TASK_SIZE - eppnt->p_memsz < k) {
27294 +                           eppnt->p_memsz > pax_task_size ||
27295 +                           pax_task_size - eppnt->p_memsz < k) {
27296                                 error = -ENOMEM;
27297                                 goto out_close;
27298                         }
27299 @@ -532,6 +552,177 @@ out:
27300         return error;
27301  }
27302
27303 +#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
27304 +static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
27305 +{
27306 +       unsigned long pax_flags = 0UL;
27307 +
27308 +#ifdef CONFIG_PAX_PAGEEXEC
27309 +       if (elf_phdata->p_flags & PF_PAGEEXEC)
27310 +               pax_flags |= MF_PAX_PAGEEXEC;
27311 +#endif
27312 +
27313 +#ifdef CONFIG_PAX_SEGMEXEC
27314 +       if (elf_phdata->p_flags & PF_SEGMEXEC)
27315 +               pax_flags |= MF_PAX_SEGMEXEC;
27316 +#endif
27317 +
27318 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
27319 +       if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
27320 +               if ((__supported_pte_mask & _PAGE_NX))
27321 +                       pax_flags &= ~MF_PAX_SEGMEXEC;
27322 +               else
27323 +                       pax_flags &= ~MF_PAX_PAGEEXEC;
27324 +       }
27325 +#endif
27326 +
27327 +#ifdef CONFIG_PAX_EMUTRAMP
27328 +       if (elf_phdata->p_flags & PF_EMUTRAMP)
27329 +               pax_flags |= MF_PAX_EMUTRAMP;
27330 +#endif
27331 +
27332 +#ifdef CONFIG_PAX_MPROTECT
27333 +       if (elf_phdata->p_flags & PF_MPROTECT)
27334 +               pax_flags |= MF_PAX_MPROTECT;
27335 +#endif
27336 +
27337 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
27338 +       if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
27339 +               pax_flags |= MF_PAX_RANDMMAP;
27340 +#endif
27341 +
27342 +       return pax_flags;
27343 +}
27344 +#endif
27345 +
27346 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
27347 +static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
27348 +{
27349 +       unsigned long pax_flags = 0UL;
27350 +
27351 +#ifdef CONFIG_PAX_PAGEEXEC
27352 +       if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
27353 +               pax_flags |= MF_PAX_PAGEEXEC;
27354 +#endif
27355 +
27356 +#ifdef CONFIG_PAX_SEGMEXEC
27357 +       if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
27358 +               pax_flags |= MF_PAX_SEGMEXEC;
27359 +#endif
27360 +
27361 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
27362 +       if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
27363 +               if ((__supported_pte_mask & _PAGE_NX))
27364 +                       pax_flags &= ~MF_PAX_SEGMEXEC;
27365 +               else
27366 +                       pax_flags &= ~MF_PAX_PAGEEXEC;
27367 +       }
27368 +#endif
27369 +
27370 +#ifdef CONFIG_PAX_EMUTRAMP
27371 +       if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
27372 +               pax_flags |= MF_PAX_EMUTRAMP;
27373 +#endif
27374 +
27375 +#ifdef CONFIG_PAX_MPROTECT
27376 +       if (!(elf_phdata->p_flags & PF_NOMPROTECT))
27377 +               pax_flags |= MF_PAX_MPROTECT;
27378 +#endif
27379 +
27380 +#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
27381 +       if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
27382 +               pax_flags |= MF_PAX_RANDMMAP;
27383 +#endif
27384 +
27385 +       return pax_flags;
27386 +}
27387 +#endif
27388 +
27389 +#ifdef CONFIG_PAX_EI_PAX
27390 +static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
27391 +{
27392 +       unsigned long pax_flags = 0UL;
27393 +
27394 +#ifdef CONFIG_PAX_PAGEEXEC
27395 +       if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
27396 +               pax_flags |= MF_PAX_PAGEEXEC;
27397 +#endif
27398 +
27399 +#ifdef CONFIG_PAX_SEGMEXEC
27400 +       if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
27401 +               pax_flags |= MF_PAX_SEGMEXEC;
27402 +#endif
27403 +
27404 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
27405 +       if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
27406 +               if ((__supported_pte_mask & _PAGE_NX))
27407 +                       pax_flags &= ~MF_PAX_SEGMEXEC;
27408 +               else
27409 +                       pax_flags &= ~MF_PAX_PAGEEXEC;
27410 +       }
27411 +#endif
27412 +
27413 +#ifdef CONFIG_PAX_EMUTRAMP
27414 +       if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
27415 +               pax_flags |= MF_PAX_EMUTRAMP;
27416 +#endif
27417 +
27418 +#ifdef CONFIG_PAX_MPROTECT
27419 +       if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
27420 +               pax_flags |= MF_PAX_MPROTECT;
27421 +#endif
27422 +
27423 +#ifdef CONFIG_PAX_ASLR
27424 +       if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
27425 +               pax_flags |= MF_PAX_RANDMMAP;
27426 +#endif
27427 +
27428 +       return pax_flags;
27429 +}
27430 +#endif
27431 +
27432 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
27433 +static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
27434 +{
27435 +       unsigned long pax_flags = 0UL;
27436 +
27437 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
27438 +       unsigned long i;
27439 +#endif
27440 +
27441 +#ifdef CONFIG_PAX_EI_PAX
27442 +       pax_flags = pax_parse_ei_pax(elf_ex);
27443 +#endif
27444 +
27445 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
27446 +       for (i = 0UL; i < elf_ex->e_phnum; i++)
27447 +               if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
27448 +                       if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
27449 +                           ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
27450 +                           ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
27451 +                           ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
27452 +                           ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
27453 +                               return -EINVAL;
27454 +
27455 +#ifdef CONFIG_PAX_SOFTMODE
27456 +                       if (pax_softmode)
27457 +                               pax_flags = pax_parse_softmode(&elf_phdata[i]);
27458 +                       else
27459 +#endif
27460 +
27461 +                               pax_flags = pax_parse_hardmode(&elf_phdata[i]);
27462 +                       break;
27463 +               }
27464 +#endif
27465 +
27466 +       if (0 > pax_check_flags(&pax_flags))
27467 +               return -EINVAL;
27468 +
27469 +       current->mm->pax_flags = pax_flags;
27470 +       return 0;
27471 +}
27472 +#endif
27473 +
27474  /*
27475   * These are the functions used to load ELF style executables and shared
27476   * libraries.  There is no binary dependent code anywhere else.
27477 @@ -548,6 +739,11 @@ static unsigned long randomize_stack_top
27478  {
27479         unsigned int random_variable = 0;
27480
27481 +#ifdef CONFIG_PAX_RANDUSTACK
27482 +       if (randomize_va_space)
27483 +               return stack_top - current->mm->delta_stack;
27484 +#endif
27485 +
27486         if ((current->flags & PF_RANDOMIZE) &&
27487                 !(current->personality & ADDR_NO_RANDOMIZE)) {
27488                 random_variable = get_random_int() & STACK_RND_MASK;
27489 @@ -566,7 +762,7 @@ static int load_elf_binary(struct linux_
27490         unsigned long load_addr = 0, load_bias = 0;
27491         int load_addr_set = 0;
27492         char * elf_interpreter = NULL;
27493 -       unsigned long error;
27494 +       unsigned long error = 0;
27495         struct elf_phdr *elf_ppnt, *elf_phdata;
27496         unsigned long elf_bss, elf_brk;
27497         int retval, i;
27498 @@ -576,11 +772,11 @@ static int load_elf_binary(struct linux_
27499         unsigned long start_code, end_code, start_data, end_data;
27500         unsigned long reloc_func_desc = 0;
27501         int executable_stack = EXSTACK_DEFAULT;
27502 -       unsigned long def_flags = 0;
27503         struct {
27504                 struct elfhdr elf_ex;
27505                 struct elfhdr interp_elf_ex;
27506         } *loc;
27507 +       unsigned long pax_task_size = TASK_SIZE;
27508
27509         loc = kmalloc(sizeof(*loc), GFP_KERNEL);
27510         if (!loc) {
27511 @@ -718,11 +914,80 @@ static int load_elf_binary(struct linux_
27512
27513         /* OK, This is the point of no return */
27514         current->flags &= ~PF_FORKNOEXEC;
27515 -       current->mm->def_flags = def_flags;
27516 +
27517 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
27518 +       current->mm->pax_flags = 0UL;
27519 +#endif
27520 +
27521 +#ifdef CONFIG_PAX_DLRESOLVE
27522 +       current->mm->call_dl_resolve = 0UL;
27523 +#endif
27524 +
27525 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
27526 +       current->mm->call_syscall = 0UL;
27527 +#endif
27528 +
27529 +#ifdef CONFIG_PAX_ASLR
27530 +       current->mm->delta_mmap = 0UL;
27531 +       current->mm->delta_stack = 0UL;
27532 +#endif
27533 +
27534 +       current->mm->def_flags = 0;
27535 +
27536 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
27537 +       if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
27538 +               send_sig(SIGKILL, current, 0);
27539 +               goto out_free_dentry;
27540 +       }
27541 +#endif
27542 +
27543 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
27544 +       pax_set_initial_flags(bprm);
27545 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
27546 +       if (pax_set_initial_flags_func)
27547 +               (pax_set_initial_flags_func)(bprm);
27548 +#endif
27549 +
27550 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
27551 +       if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !(__supported_pte_mask & _PAGE_NX)) {
27552 +               current->mm->context.user_cs_limit = PAGE_SIZE;
27553 +               current->mm->def_flags |= VM_PAGEEXEC;
27554 +       }
27555 +#endif
27556 +
27557 +#ifdef CONFIG_PAX_SEGMEXEC
27558 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
27559 +               current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
27560 +               current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
27561 +               pax_task_size = SEGMEXEC_TASK_SIZE;
27562 +       }
27563 +#endif
27564 +
27565 +#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
27566 +       if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
27567 +               set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
27568 +               put_cpu();
27569 +       }
27570 +#endif
27571
27572         /* Do this immediately, since STACK_TOP as used in setup_arg_pages
27573            may depend on the personality.  */
27574         SET_PERSONALITY(loc->elf_ex);
27575 +
27576 +#ifdef CONFIG_PAX_ASLR
27577 +       if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
27578 +               current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
27579 +               current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
27580 +       }
27581 +#endif
27582 +
27583 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
27584 +       if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
27585 +               executable_stack = EXSTACK_DISABLE_X;
27586 +               current->personality &= ~READ_IMPLIES_EXEC;
27587 +       } else
27588 +#endif
27589 +
27590         if (elf_read_implies_exec(loc->elf_ex, executable_stack))
27591                 current->personality |= READ_IMPLIES_EXEC;
27592
27593 @@ -804,6 +1069,20 @@ static int load_elf_binary(struct linux_
27594  #else
27595                         load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
27596  #endif
27597 +
27598 +#ifdef CONFIG_PAX_RANDMMAP
27599 +                       /* PaX: randomize base address at the default exe base if requested */
27600 +                       if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
27601 +#ifdef CONFIG_SPARC64
27602 +                               load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
27603 +#else
27604 +                               load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
27605 +#endif
27606 +                               load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
27607 +                               elf_flags |= MAP_FIXED;
27608 +                       }
27609 +#endif
27610 +
27611                 }
27612
27613                 error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
27614 @@ -836,9 +1115,9 @@ static int load_elf_binary(struct linux_
27615                  * allowed task size. Note that p_filesz must always be
27616                  * <= p_memsz so it is only necessary to check p_memsz.
27617                  */
27618 -               if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
27619 -                   elf_ppnt->p_memsz > TASK_SIZE ||
27620 -                   TASK_SIZE - elf_ppnt->p_memsz < k) {
27621 +               if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
27622 +                   elf_ppnt->p_memsz > pax_task_size ||
27623 +                   pax_task_size - elf_ppnt->p_memsz < k) {
27624                         /* set_brk can never work. Avoid overflows. */
27625                         send_sig(SIGKILL, current, 0);
27626                         retval = -EINVAL;
27627 @@ -866,6 +1145,11 @@ static int load_elf_binary(struct linux_
27628         start_data += load_bias;
27629         end_data += load_bias;
27630
27631 +#ifdef CONFIG_PAX_RANDMMAP
27632 +       if (current->mm->pax_flags & MF_PAX_RANDMMAP)
27633 +               elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
27634 +#endif
27635 +
27636         /* Calling set_brk effectively mmaps the pages that we need
27637          * for the bss and break sections.  We must do this before
27638          * mapping in the interpreter, to make sure it doesn't wind
27639 @@ -877,9 +1161,11 @@ static int load_elf_binary(struct linux_
27640                 goto out_free_dentry;
27641         }
27642         if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
27643 -               send_sig(SIGSEGV, current, 0);
27644 -               retval = -EFAULT; /* Nobody gets to see this, but.. */
27645 -               goto out_free_dentry;
27646 +               /*
27647 +                * This bss-zeroing can fail if the ELF
27648 +                * file specifies odd protections. So
27649 +                * we don't check the return value
27650 +                */
27651         }
27652
27653         if (elf_interpreter) {
27654 @@ -1107,8 +1393,10 @@ static int dump_seek(struct file *file,
27655                         unsigned long n = off;
27656                         if (n > PAGE_SIZE)
27657                                 n = PAGE_SIZE;
27658 -                       if (!dump_write(file, buf, n))
27659 +                       if (!dump_write(file, buf, n)) {
27660 +                               free_page((unsigned long)buf);
27661                                 return 0;
27662 +                       }
27663                         off -= n;
27664                 }
27665                 free_page((unsigned long)buf);
27666 @@ -1120,7 +1408,7 @@ static int dump_seek(struct file *file,
27667   * Decide what to dump of a segment, part, all or none.
27668   */
27669  static unsigned long vma_dump_size(struct vm_area_struct *vma,
27670 -                                  unsigned long mm_flags)
27671 +                                  unsigned long mm_flags, long signr)
27672  {
27673  #define FILTER(type)   (mm_flags & (1UL << MMF_DUMP_##type))
27674
27675 @@ -1154,7 +1442,7 @@ static unsigned long vma_dump_size(struc
27676         if (vma->vm_file == NULL)
27677                 return 0;
27678
27679 -       if (FILTER(MAPPED_PRIVATE))
27680 +       if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
27681                 goto whole;
27682
27683         /*
27684 @@ -1250,9 +1538,12 @@ static int writenote(struct memelfnote *
27685  #undef DUMP_WRITE
27686
27687  #define DUMP_WRITE(addr, nr)                           \
27688 +       do {                                            \
27689 +       gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
27690         if ((size += (nr)) > cprm->limit ||             \
27691             !dump_write(cprm->file, (addr), (nr)))      \
27692 -               goto end_coredump;
27693 +               goto end_coredump;                      \
27694 +       } while (0);
27695
27696  static void fill_elf_header(struct elfhdr *elf, int segs,
27697                             u16 machine, u32 flags, u8 osabi)
27698 @@ -1381,9 +1672,9 @@ static void fill_auxv_note(struct memelf
27699  {
27700         elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
27701         int i = 0;
27702 -       do
27703 +       do {
27704                 i += 2;
27705 -       while (auxv[i - 2] != AT_NULL);
27706 +       } while (auxv[i - 2] != AT_NULL);
27707         fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
27708  }
27709
27710 @@ -1969,7 +2260,7 @@ static int elf_core_dump(struct coredump
27711                 phdr.p_offset = offset;
27712                 phdr.p_vaddr = vma->vm_start;
27713                 phdr.p_paddr = 0;
27714 -               phdr.p_filesz = vma_dump_size(vma, mm_flags);
27715 +               phdr.p_filesz = vma_dump_size(vma, mm_flags, cprm->signr);
27716                 phdr.p_memsz = vma->vm_end - vma->vm_start;
27717                 offset += phdr.p_filesz;
27718                 phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
27719 @@ -2002,7 +2293,7 @@ static int elf_core_dump(struct coredump
27720                 unsigned long addr;
27721                 unsigned long end;
27722
27723 -               end = vma->vm_start + vma_dump_size(vma, mm_flags);
27724 +               end = vma->vm_start + vma_dump_size(vma, mm_flags, cprm->signr);
27725
27726                 for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
27727                         struct page *page;
27728 @@ -2011,6 +2302,7 @@ static int elf_core_dump(struct coredump
27729                         page = get_dump_page(addr);
27730                         if (page) {
27731                                 void *kaddr = kmap(page);
27732 +                               gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
27733                                 stop = ((size += PAGE_SIZE) > cprm->limit) ||
27734                                         !dump_write(cprm->file, kaddr,
27735                                                     PAGE_SIZE);
27736 @@ -2039,6 +2331,97 @@ out:
27737
27738  #endif         /* CONFIG_ELF_CORE */
27739
27740 +#ifdef CONFIG_PAX_MPROTECT
27741 +/* PaX: non-PIC ELF libraries need relocations on their executable segments
27742 + * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
27743 + * we'll remove VM_MAYWRITE for good on RELRO segments.
27744 + *
27745 + * The checks favour ld-linux.so behaviour which operates on a per ELF segment
27746 + * basis because we want to allow the common case and not the special ones.
27747 + */
27748 +static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
27749 +{
27750 +       struct elfhdr elf_h;
27751 +       struct elf_phdr elf_p;
27752 +       unsigned long i;
27753 +       unsigned long oldflags;
27754 +       bool is_textrel_rw, is_textrel_rx, is_relro;
27755 +
27756 +       if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
27757 +               return;
27758 +
27759 +       oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
27760 +       newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
27761 +
27762 +#ifdef CONFIG_PAX_NOELFRELOCS
27763 +       is_textrel_rw = false;
27764 +       is_textrel_rx = false;
27765 +#else
27766 +       /* possible TEXTREL */
27767 +       is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
27768 +       is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
27769 +#endif
27770 +
27771 +       /* possible RELRO */
27772 +       is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
27773 +
27774 +       if (!is_textrel_rw && !is_textrel_rx && !is_relro)
27775 +               return;
27776 +
27777 +       if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
27778 +           memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
27779 +
27780 +#ifdef CONFIG_PAX_ETEXECRELOCS
27781 +           ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
27782 +#else
27783 +           ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
27784 +#endif
27785 +
27786 +           (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
27787 +           !elf_check_arch(&elf_h) ||
27788 +           elf_h.e_phentsize != sizeof(struct elf_phdr) ||
27789 +           elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
27790 +               return;
27791 +
27792 +       for (i = 0UL; i < elf_h.e_phnum; i++) {
27793 +               if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
27794 +                       return;
27795 +               switch (elf_p.p_type) {
27796 +               case PT_DYNAMIC:
27797 +                       if (!is_textrel_rw && !is_textrel_rx)
27798 +                               continue;
27799 +                       i = 0UL;
27800 +                       while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
27801 +                               elf_dyn dyn;
27802 +
27803 +                               if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
27804 +                                       return;
27805 +                               if (dyn.d_tag == DT_NULL)
27806 +                                       return;
27807 +                               if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
27808 +                                       gr_log_textrel(vma);
27809 +                                       if (is_textrel_rw)
27810 +                                               vma->vm_flags |= VM_MAYWRITE;
27811 +                                       else
27812 +                                               /* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
27813 +                                               vma->vm_flags &= ~VM_MAYWRITE;
27814 +                                       return;
27815 +                               }
27816 +                               i++;
27817 +                       }
27818 +                       return;
27819 +
27820 +               case PT_GNU_RELRO:
27821 +                       if (!is_relro)
27822 +                               continue;
27823 +                       if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
27824 +                               vma->vm_flags &= ~VM_MAYWRITE;
27825 +                       return;
27826 +               }
27827 +       }
27828 +}
27829 +#endif
27830 +
27831  static int __init init_elf_binfmt(void)
27832  {
27833         return register_binfmt(&elf_format);
27834 diff -urNp linux-2.6.33/fs/binfmt_flat.c linux-2.6.33/fs/binfmt_flat.c
27835 --- linux-2.6.33/fs/binfmt_flat.c       2010-02-24 13:52:17.000000000 -0500
27836 +++ linux-2.6.33/fs/binfmt_flat.c       2010-03-07 12:23:36.073720428 -0500
27837 @@ -564,7 +564,9 @@ static int load_flat_file(struct linux_b
27838                                 realdatastart = (unsigned long) -ENOMEM;
27839                         printk("Unable to allocate RAM for process data, errno %d\n",
27840                                         (int)-realdatastart);
27841 +                       down_write(&current->mm->mmap_sem);
27842                         do_munmap(current->mm, textpos, text_len);
27843 +                       up_write(&current->mm->mmap_sem);
27844                         ret = realdatastart;
27845                         goto err;
27846                 }
27847 @@ -588,8 +590,10 @@ static int load_flat_file(struct linux_b
27848                 }
27849                 if (IS_ERR_VALUE(result)) {
27850                         printk("Unable to read data+bss, errno %d\n", (int)-result);
27851 +                       down_write(&current->mm->mmap_sem);
27852                         do_munmap(current->mm, textpos, text_len);
27853                         do_munmap(current->mm, realdatastart, data_len + extra);
27854 +                       up_write(&current->mm->mmap_sem);
27855                         ret = result;
27856                         goto err;
27857                 }
27858 @@ -658,8 +662,10 @@ static int load_flat_file(struct linux_b
27859                 }
27860                 if (IS_ERR_VALUE(result)) {
27861                         printk("Unable to read code+data+bss, errno %d\n",(int)-result);
27862 +                       down_write(&current->mm->mmap_sem);
27863                         do_munmap(current->mm, textpos, text_len + data_len + extra +
27864                                 MAX_SHARED_LIBS * sizeof(unsigned long));
27865 +                       up_write(&current->mm->mmap_sem);
27866                         ret = result;
27867                         goto err;
27868                 }
27869 diff -urNp linux-2.6.33/fs/binfmt_misc.c linux-2.6.33/fs/binfmt_misc.c
27870 --- linux-2.6.33/fs/binfmt_misc.c       2010-02-24 13:52:17.000000000 -0500
27871 +++ linux-2.6.33/fs/binfmt_misc.c       2010-03-07 12:23:36.073720428 -0500
27872 @@ -693,7 +693,7 @@ static int bm_fill_super(struct super_bl
27873         static struct tree_descr bm_files[] = {
27874                 [2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
27875                 [3] = {"register", &bm_register_operations, S_IWUSR},
27876 -               /* last one */ {""}
27877 +               /* last one */ {"", NULL, 0}
27878         };
27879         int err = simple_fill_super(sb, 0x42494e4d, bm_files);
27880         if (!err)
27881 diff -urNp linux-2.6.33/fs/bio.c linux-2.6.33/fs/bio.c
27882 --- linux-2.6.33/fs/bio.c       2010-02-24 13:52:17.000000000 -0500
27883 +++ linux-2.6.33/fs/bio.c       2010-03-07 12:23:36.073720428 -0500
27884 @@ -1217,7 +1217,7 @@ static void bio_copy_kern_endio(struct b
27885         const int read = bio_data_dir(bio) == READ;
27886         struct bio_map_data *bmd = bio->bi_private;
27887         int i;
27888 -       char *p = bmd->sgvecs[0].iov_base;
27889 +       char *p = (__force char *)bmd->sgvecs[0].iov_base;
27890
27891         __bio_for_each_segment(bvec, bio, i, 0) {
27892                 char *addr = page_address(bvec->bv_page);
27893 diff -urNp linux-2.6.33/fs/btrfs/ctree.c linux-2.6.33/fs/btrfs/ctree.c
27894 --- linux-2.6.33/fs/btrfs/ctree.c       2010-02-24 13:52:17.000000000 -0500
27895 +++ linux-2.6.33/fs/btrfs/ctree.c       2010-03-07 12:23:36.073720428 -0500
27896 @@ -3645,7 +3645,6 @@ setup_items_for_insert(struct btrfs_tran
27897
27898         ret = 0;
27899         if (slot == 0) {
27900 -               struct btrfs_disk_key disk_key;
27901                 btrfs_cpu_key_to_disk(&disk_key, cpu_key);
27902                 ret = fixup_low_keys(trans, root, path, &disk_key, 1);
27903         }
27904 diff -urNp linux-2.6.33/fs/btrfs/disk-io.c linux-2.6.33/fs/btrfs/disk-io.c
27905 --- linux-2.6.33/fs/btrfs/disk-io.c     2010-02-24 13:52:17.000000000 -0500
27906 +++ linux-2.6.33/fs/btrfs/disk-io.c     2010-03-07 12:23:36.073720428 -0500
27907 @@ -39,7 +39,7 @@
27908  #include "tree-log.h"
27909  #include "free-space-cache.h"
27910
27911 -static struct extent_io_ops btree_extent_io_ops;
27912 +static const struct extent_io_ops btree_extent_io_ops;
27913  static void end_workqueue_fn(struct btrfs_work *work);
27914  static void free_fs_root(struct btrfs_root *root);
27915
27916 @@ -2605,7 +2605,7 @@ out:
27917         return 0;
27918  }
27919
27920 -static struct extent_io_ops btree_extent_io_ops = {
27921 +static const struct extent_io_ops btree_extent_io_ops = {
27922         .write_cache_pages_lock_hook = btree_lock_page_hook,
27923         .readpage_end_io_hook = btree_readpage_end_io_hook,
27924         .submit_bio_hook = btree_submit_bio_hook,
27925 diff -urNp linux-2.6.33/fs/btrfs/extent_io.h linux-2.6.33/fs/btrfs/extent_io.h
27926 --- linux-2.6.33/fs/btrfs/extent_io.h   2010-02-24 13:52:17.000000000 -0500
27927 +++ linux-2.6.33/fs/btrfs/extent_io.h   2010-03-07 12:23:36.073720428 -0500
27928 @@ -49,36 +49,36 @@ typedef     int (extent_submit_bio_hook_t)(s
27929                                        struct bio *bio, int mirror_num,
27930                                        unsigned long bio_flags);
27931  struct extent_io_ops {
27932 -       int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
27933 +       int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
27934                              u64 start, u64 end, int *page_started,
27935                              unsigned long *nr_written);
27936 -       int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
27937 -       int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
27938 +       int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
27939 +       int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
27940         extent_submit_bio_hook_t *submit_bio_hook;
27941 -       int (*merge_bio_hook)(struct page *page, unsigned long offset,
27942 +       int (* const merge_bio_hook)(struct page *page, unsigned long offset,
27943                               size_t size, struct bio *bio,
27944                               unsigned long bio_flags);
27945 -       int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
27946 -       int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
27947 +       int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
27948 +       int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
27949                                        u64 start, u64 end,
27950                                        struct extent_state *state);
27951 -       int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
27952 +       int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
27953                                         u64 start, u64 end,
27954                                        struct extent_state *state);
27955 -       int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
27956 +       int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
27957                                     struct extent_state *state);
27958 -       int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
27959 +       int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
27960                                       struct extent_state *state, int uptodate);
27961 -       int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
27962 +       int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
27963                             unsigned long old, unsigned long bits);
27964 -       int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
27965 +       int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
27966                               unsigned long bits);
27967 -       int (*merge_extent_hook)(struct inode *inode,
27968 +       int (* const merge_extent_hook)(struct inode *inode,
27969                                  struct extent_state *new,
27970                                  struct extent_state *other);
27971 -       int (*split_extent_hook)(struct inode *inode,
27972 +       int (* const split_extent_hook)(struct inode *inode,
27973                                  struct extent_state *orig, u64 split);
27974 -       int (*write_cache_pages_lock_hook)(struct page *page);
27975 +       int (* const write_cache_pages_lock_hook)(struct page *page);
27976  };
27977
27978  struct extent_io_tree {
27979 @@ -88,7 +88,7 @@ struct extent_io_tree {
27980         u64 dirty_bytes;
27981         spinlock_t lock;
27982         spinlock_t buffer_lock;
27983 -       struct extent_io_ops *ops;
27984 +       const struct extent_io_ops *ops;
27985  };
27986
27987  struct extent_state {
27988 diff -urNp linux-2.6.33/fs/btrfs/free-space-cache.c linux-2.6.33/fs/btrfs/free-space-cache.c
27989 --- linux-2.6.33/fs/btrfs/free-space-cache.c    2010-02-24 13:52:17.000000000 -0500
27990 +++ linux-2.6.33/fs/btrfs/free-space-cache.c    2010-03-07 12:23:36.073720428 -0500
27991 @@ -1074,8 +1074,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
27992
27993         while(1) {
27994                 if (entry->bytes < bytes || entry->offset < min_start) {
27995 -                       struct rb_node *node;
27996 -
27997                         node = rb_next(&entry->offset_index);
27998                         if (!node)
27999                                 break;
28000 @@ -1226,7 +1224,7 @@ again:
28001          */
28002         while (entry->bitmap || found_bitmap ||
28003                (!entry->bitmap && entry->bytes < min_bytes)) {
28004 -               struct rb_node *node = rb_next(&entry->offset_index);
28005 +               node = rb_next(&entry->offset_index);
28006
28007                 if (entry->bitmap && entry->bytes > bytes + empty_size) {
28008                         ret = btrfs_bitmap_cluster(block_group, entry, cluster,
28009 diff -urNp linux-2.6.33/fs/btrfs/inode.c linux-2.6.33/fs/btrfs/inode.c
28010 --- linux-2.6.33/fs/btrfs/inode.c       2010-02-24 13:52:17.000000000 -0500
28011 +++ linux-2.6.33/fs/btrfs/inode.c       2010-03-07 12:23:36.077713587 -0500
28012 @@ -63,7 +63,7 @@ static const struct inode_operations btr
28013  static const struct address_space_operations btrfs_aops;
28014  static const struct address_space_operations btrfs_symlink_aops;
28015  static const struct file_operations btrfs_dir_file_operations;
28016 -static struct extent_io_ops btrfs_extent_io_ops;
28017 +static const struct extent_io_ops btrfs_extent_io_ops;
28018
28019  static struct kmem_cache *btrfs_inode_cachep;
28020  struct kmem_cache *btrfs_trans_handle_cachep;
28021 @@ -5973,7 +5973,7 @@ static const struct file_operations btrf
28022         .fsync          = btrfs_sync_file,
28023  };
28024
28025 -static struct extent_io_ops btrfs_extent_io_ops = {
28026 +static const struct extent_io_ops btrfs_extent_io_ops = {
28027         .fill_delalloc = run_delalloc_range,
28028         .submit_bio_hook = btrfs_submit_bio_hook,
28029         .merge_bio_hook = btrfs_merge_bio_hook,
28030 diff -urNp linux-2.6.33/fs/btrfs/sysfs.c linux-2.6.33/fs/btrfs/sysfs.c
28031 --- linux-2.6.33/fs/btrfs/sysfs.c       2010-02-24 13:52:17.000000000 -0500
28032 +++ linux-2.6.33/fs/btrfs/sysfs.c       2010-03-07 12:23:36.077713587 -0500
28033 @@ -164,12 +164,12 @@ static void btrfs_root_release(struct ko
28034         complete(&root->kobj_unregister);
28035  }
28036
28037 -static struct sysfs_ops btrfs_super_attr_ops = {
28038 +static const struct sysfs_ops btrfs_super_attr_ops = {
28039         .show   = btrfs_super_attr_show,
28040         .store  = btrfs_super_attr_store,
28041  };
28042
28043 -static struct sysfs_ops btrfs_root_attr_ops = {
28044 +static const struct sysfs_ops btrfs_root_attr_ops = {
28045         .show   = btrfs_root_attr_show,
28046         .store  = btrfs_root_attr_store,
28047  };
28048 diff -urNp linux-2.6.33/fs/buffer.c linux-2.6.33/fs/buffer.c
28049 --- linux-2.6.33/fs/buffer.c    2010-02-24 13:52:17.000000000 -0500
28050 +++ linux-2.6.33/fs/buffer.c    2010-03-07 12:23:36.077713587 -0500
28051 @@ -25,6 +25,7 @@
28052  #include <linux/percpu.h>
28053  #include <linux/slab.h>
28054  #include <linux/capability.h>
28055 +#include <linux/security.h>
28056  #include <linux/blkdev.h>
28057  #include <linux/file.h>
28058  #include <linux/quotaops.h>
28059 diff -urNp linux-2.6.33/fs/cachefiles/daemon.c linux-2.6.33/fs/cachefiles/daemon.c
28060 --- linux-2.6.33/fs/cachefiles/daemon.c 2010-02-24 13:52:17.000000000 -0500
28061 +++ linux-2.6.33/fs/cachefiles/daemon.c 2010-03-07 12:23:36.077713587 -0500
28062 @@ -195,7 +195,7 @@ static ssize_t cachefiles_daemon_read(st
28063         if (n > buflen)
28064                 return -EMSGSIZE;
28065
28066 -       if (copy_to_user(_buffer, buffer, n) != 0)
28067 +       if (n > sizeof(buffer) || copy_to_user(_buffer, buffer, n) != 0)
28068                 return -EFAULT;
28069
28070         return n;
28071 diff -urNp linux-2.6.33/fs/cachefiles/rdwr.c linux-2.6.33/fs/cachefiles/rdwr.c
28072 --- linux-2.6.33/fs/cachefiles/rdwr.c   2010-02-24 13:52:17.000000000 -0500
28073 +++ linux-2.6.33/fs/cachefiles/rdwr.c   2010-03-07 12:23:36.077713587 -0500
28074 @@ -944,7 +944,7 @@ int cachefiles_write_page(struct fscache
28075                         old_fs = get_fs();
28076                         set_fs(KERNEL_DS);
28077                         ret = file->f_op->write(
28078 -                               file, (const void __user *) data, len, &pos);
28079 +                               file, (__force const void __user *) data, len, &pos);
28080                         set_fs(old_fs);
28081                         kunmap(page);
28082                         if (ret != len)
28083 diff -urNp linux-2.6.33/fs/cifs/cifs_uniupr.h linux-2.6.33/fs/cifs/cifs_uniupr.h
28084 --- linux-2.6.33/fs/cifs/cifs_uniupr.h  2010-02-24 13:52:17.000000000 -0500
28085 +++ linux-2.6.33/fs/cifs/cifs_uniupr.h  2010-03-07 12:23:36.077713587 -0500
28086 @@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
28087         {0x0490, 0x04cc, UniCaseRangeU0490},
28088         {0x1e00, 0x1ffc, UniCaseRangeU1e00},
28089         {0xff40, 0xff5a, UniCaseRangeUff40},
28090 -       {0}
28091 +       {0, 0, NULL}
28092  };
28093  #endif
28094
28095 diff -urNp linux-2.6.33/fs/cifs/link.c linux-2.6.33/fs/cifs/link.c
28096 --- linux-2.6.33/fs/cifs/link.c 2010-02-24 13:52:17.000000000 -0500
28097 +++ linux-2.6.33/fs/cifs/link.c 2010-03-07 12:23:36.077713587 -0500
28098 @@ -215,7 +215,7 @@ cifs_symlink(struct inode *inode, struct
28099
28100  void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
28101  {
28102 -       char *p = nd_get_link(nd);
28103 +       const char *p = nd_get_link(nd);
28104         if (!IS_ERR(p))
28105                 kfree(p);
28106  }
28107 diff -urNp linux-2.6.33/fs/compat_binfmt_elf.c linux-2.6.33/fs/compat_binfmt_elf.c
28108 --- linux-2.6.33/fs/compat_binfmt_elf.c 2010-02-24 13:52:17.000000000 -0500
28109 +++ linux-2.6.33/fs/compat_binfmt_elf.c 2010-03-07 12:23:36.077713587 -0500
28110 @@ -29,10 +29,12 @@
28111  #undef elfhdr
28112  #undef elf_phdr
28113  #undef elf_note
28114 +#undef elf_dyn
28115  #undef elf_addr_t
28116  #define elfhdr         elf32_hdr
28117  #define elf_phdr       elf32_phdr
28118  #define elf_note       elf32_note
28119 +#define elf_dyn                Elf32_Dyn
28120  #define elf_addr_t     Elf32_Addr
28121
28122  /*
28123 diff -urNp linux-2.6.33/fs/compat.c linux-2.6.33/fs/compat.c
28124 --- linux-2.6.33/fs/compat.c    2010-02-24 13:52:17.000000000 -0500
28125 +++ linux-2.6.33/fs/compat.c    2010-03-07 12:23:36.077713587 -0500
28126 @@ -1408,14 +1408,12 @@ static int compat_copy_strings(int argc,
28127                         if (!kmapped_page || kpos != (pos & PAGE_MASK)) {
28128                                 struct page *page;
28129
28130 -#ifdef CONFIG_STACK_GROWSUP
28131                                 ret = expand_stack_downwards(bprm->vma, pos);
28132                                 if (ret < 0) {
28133                                         /* We've exceed the stack rlimit. */
28134                                         ret = -E2BIG;
28135                                         goto out;
28136                                 }
28137 -#endif
28138                                 ret = get_user_pages(current, bprm->mm, pos,
28139                                                      1, 1, 1, &page, NULL);
28140                                 if (ret <= 0) {
28141 @@ -1461,6 +1459,11 @@ int compat_do_execve(char * filename,
28142         compat_uptr_t __user *envp,
28143         struct pt_regs * regs)
28144  {
28145 +#ifdef CONFIG_GRKERNSEC
28146 +       struct file *old_exec_file;
28147 +       struct acl_subject_label *old_acl;
28148 +       struct rlimit old_rlim[RLIM_NLIMITS];
28149 +#endif
28150         struct linux_binprm *bprm;
28151         struct file *file;
28152         struct files_struct *displaced;
28153 @@ -1497,6 +1500,14 @@ int compat_do_execve(char * filename,
28154         bprm->filename = filename;
28155         bprm->interp = filename;
28156
28157 +       gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
28158 +       retval = -EAGAIN;
28159 +       if (gr_handle_nproc())
28160 +               goto out_file;
28161 +       retval = -EACCES;
28162 +       if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
28163 +               goto out_file;
28164 +
28165         retval = bprm_mm_init(bprm);
28166         if (retval)
28167                 goto out_file;
28168 @@ -1526,9 +1537,40 @@ int compat_do_execve(char * filename,
28169         if (retval < 0)
28170                 goto out;
28171
28172 +       if (!gr_tpe_allow(file)) {
28173 +               retval = -EACCES;
28174 +               goto out;
28175 +       }
28176 +
28177 +       if (gr_check_crash_exec(file)) {
28178 +               retval = -EACCES;
28179 +               goto out;
28180 +       }
28181 +
28182 +       gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
28183 +
28184 +       gr_handle_exec_args(bprm, (char __user * __user *)argv);
28185 +
28186 +#ifdef CONFIG_GRKERNSEC
28187 +       old_acl = current->acl;
28188 +       memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
28189 +       old_exec_file = current->exec_file;
28190 +       get_file(file);
28191 +       current->exec_file = file;
28192 +#endif
28193 +
28194 +       retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
28195 +                                  bprm->unsafe & LSM_UNSAFE_SHARE);
28196 +       if (retval < 0)
28197 +               goto out_fail;
28198 +
28199         retval = search_binary_handler(bprm, regs);
28200         if (retval < 0)
28201 -               goto out;
28202 +               goto out_fail;
28203 +#ifdef CONFIG_GRKERNSEC
28204 +       if (old_exec_file)
28205 +               fput(old_exec_file);
28206 +#endif
28207
28208         current->stack_start = current->mm->start_stack;
28209
28210 @@ -1541,6 +1583,14 @@ int compat_do_execve(char * filename,
28211                 put_files_struct(displaced);
28212         return retval;
28213
28214 +out_fail:
28215 +#ifdef CONFIG_GRKERNSEC
28216 +       current->acl = old_acl;
28217 +       memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
28218 +       fput(current->exec_file);
28219 +       current->exec_file = old_exec_file;
28220 +#endif
28221 +
28222  out:
28223         if (bprm->mm)
28224                 mmput(bprm->mm);
28225 diff -urNp linux-2.6.33/fs/debugfs/inode.c linux-2.6.33/fs/debugfs/inode.c
28226 --- linux-2.6.33/fs/debugfs/inode.c     2010-02-24 13:52:17.000000000 -0500
28227 +++ linux-2.6.33/fs/debugfs/inode.c     2010-03-07 12:23:36.077713587 -0500
28228 @@ -128,7 +128,7 @@ static inline int debugfs_positive(struc
28229
28230  static int debug_fill_super(struct super_block *sb, void *data, int silent)
28231  {
28232 -       static struct tree_descr debug_files[] = {{""}};
28233 +       static struct tree_descr debug_files[] = {{"", NULL, 0}};
28234
28235         return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
28236  }
28237 diff -urNp linux-2.6.33/fs/dlm/lockspace.c linux-2.6.33/fs/dlm/lockspace.c
28238 --- linux-2.6.33/fs/dlm/lockspace.c     2010-02-24 13:52:17.000000000 -0500
28239 +++ linux-2.6.33/fs/dlm/lockspace.c     2010-03-07 12:23:36.077713587 -0500
28240 @@ -148,7 +148,7 @@ static void lockspace_kobj_release(struc
28241         kfree(ls);
28242  }
28243
28244 -static struct sysfs_ops dlm_attr_ops = {
28245 +static const struct sysfs_ops dlm_attr_ops = {
28246         .show  = dlm_attr_show,
28247         .store = dlm_attr_store,
28248  };
28249 diff -urNp linux-2.6.33/fs/ecryptfs/inode.c linux-2.6.33/fs/ecryptfs/inode.c
28250 --- linux-2.6.33/fs/ecryptfs/inode.c    2010-02-24 13:52:17.000000000 -0500
28251 +++ linux-2.6.33/fs/ecryptfs/inode.c    2010-03-07 12:23:36.077713587 -0500
28252 @@ -685,7 +685,7 @@ ecryptfs_readlink(struct dentry *dentry,
28253         old_fs = get_fs();
28254         set_fs(get_ds());
28255         rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
28256 -                                                  (char __user *)lower_buf,
28257 +                                                  (__force char __user *)lower_buf,
28258                                                    lower_bufsiz);
28259         set_fs(old_fs);
28260         if (rc >= 0) {
28261 @@ -729,7 +729,7 @@ static void *ecryptfs_follow_link(struct
28262         }
28263         old_fs = get_fs();
28264         set_fs(get_ds());
28265 -       rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
28266 +       rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
28267         set_fs(old_fs);
28268         if (rc < 0) {
28269                 kfree(buf);
28270 @@ -744,7 +744,7 @@ out:
28271  static void
28272  ecryptfs_put_link(struct dentry *dentry, struct nameidata *nd, void *ptr)
28273  {
28274 -       char *buf = nd_get_link(nd);
28275 +       const char *buf = nd_get_link(nd);
28276         if (!IS_ERR(buf)) {
28277                 /* Free the char* */
28278                 kfree(buf);
28279 diff -urNp linux-2.6.33/fs/ecryptfs/miscdev.c linux-2.6.33/fs/ecryptfs/miscdev.c
28280 --- linux-2.6.33/fs/ecryptfs/miscdev.c  2010-02-24 13:52:17.000000000 -0500
28281 +++ linux-2.6.33/fs/ecryptfs/miscdev.c  2010-03-07 12:23:36.077713587 -0500
28282 @@ -327,7 +327,7 @@ check_list:
28283                 goto out_unlock_msg_ctx;
28284         i = 5;
28285         if (msg_ctx->msg) {
28286 -               if (copy_to_user(&buf[i], packet_length, packet_length_size))
28287 +               if (packet_length_size > sizeof(packet_length) || copy_to_user(&buf[i], packet_length, packet_length_size))
28288                         goto out_unlock_msg_ctx;
28289                 i += packet_length_size;
28290                 if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
28291 diff -urNp linux-2.6.33/fs/exec.c linux-2.6.33/fs/exec.c
28292 --- linux-2.6.33/fs/exec.c      2010-02-24 13:52:17.000000000 -0500
28293 +++ linux-2.6.33/fs/exec.c      2010-03-07 12:23:36.081714180 -0500
28294 @@ -55,12 +55,24 @@
28295  #include <linux/fsnotify.h>
28296  #include <linux/fs_struct.h>
28297  #include <linux/pipe_fs_i.h>
28298 +#include <linux/random.h>
28299 +#include <linux/seq_file.h>
28300 +
28301 +#ifdef CONFIG_PAX_REFCOUNT
28302 +#include <linux/kallsyms.h>
28303 +#include <linux/kdebug.h>
28304 +#endif
28305
28306  #include <asm/uaccess.h>
28307  #include <asm/mmu_context.h>
28308  #include <asm/tlb.h>
28309  #include "internal.h"
28310
28311 +#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
28312 +void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
28313 +EXPORT_SYMBOL(pax_set_initial_flags_func);
28314 +#endif
28315 +
28316  int core_uses_pid;
28317  char core_pattern[CORENAME_MAX_SIZE] = "core";
28318  unsigned int core_pipe_limit;
28319 @@ -114,7 +126,7 @@ SYSCALL_DEFINE1(uselib, const char __use
28320                 goto out;
28321
28322         file = do_filp_open(AT_FDCWD, tmp,
28323 -                               O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
28324 +                               O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
28325                                 MAY_READ | MAY_EXEC | MAY_OPEN);
28326         putname(tmp);
28327         error = PTR_ERR(file);
28328 @@ -162,18 +174,10 @@ static struct page *get_arg_page(struct
28329                 int write)
28330  {
28331         struct page *page;
28332 -       int ret;
28333
28334 -#ifdef CONFIG_STACK_GROWSUP
28335 -       if (write) {
28336 -               ret = expand_stack_downwards(bprm->vma, pos);
28337 -               if (ret < 0)
28338 -                       return NULL;
28339 -       }
28340 -#endif
28341 -       ret = get_user_pages(current, bprm->mm, pos,
28342 -                       1, write, 1, &page, NULL);
28343 -       if (ret <= 0)
28344 +       if (0 > expand_stack_downwards(bprm->vma, pos))
28345 +               return NULL;
28346 +       if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
28347                 return NULL;
28348
28349         if (write) {
28350 @@ -245,6 +249,11 @@ static int __bprm_mm_init(struct linux_b
28351         vma->vm_end = STACK_TOP_MAX;
28352         vma->vm_start = vma->vm_end - PAGE_SIZE;
28353         vma->vm_flags = VM_STACK_FLAGS;
28354 +
28355 +#ifdef CONFIG_PAX_SEGMEXEC
28356 +       vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
28357 +#endif
28358 +
28359         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
28360         err = insert_vm_struct(mm, vma);
28361         if (err)
28362 @@ -253,6 +262,12 @@ static int __bprm_mm_init(struct linux_b
28363         mm->stack_vm = mm->total_vm = 1;
28364         up_write(&mm->mmap_sem);
28365         bprm->p = vma->vm_end - sizeof(void *);
28366 +
28367 +#ifdef CONFIG_PAX_RANDUSTACK
28368 +       if (randomize_va_space)
28369 +               bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
28370 +#endif
28371 +
28372         return 0;
28373  err:
28374         up_write(&mm->mmap_sem);
28375 @@ -474,7 +489,7 @@ int copy_strings_kernel(int argc,char **
28376         int r;
28377         mm_segment_t oldfs = get_fs();
28378         set_fs(KERNEL_DS);
28379 -       r = copy_strings(argc, (char __user * __user *)argv, bprm);
28380 +       r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
28381         set_fs(oldfs);
28382         return r;
28383  }
28384 @@ -504,7 +519,8 @@ static int shift_arg_pages(struct vm_are
28385         unsigned long new_end = old_end - shift;
28386         struct mmu_gather *tlb;
28387
28388 -       BUG_ON(new_start > new_end);
28389 +       if (new_start >= new_end || new_start < mmap_min_addr)
28390 +               return -EFAULT;
28391
28392         /*
28393          * ensure there are no vmas between where we want to go
28394 @@ -513,6 +529,10 @@ static int shift_arg_pages(struct vm_are
28395         if (vma != find_vma(mm, new_start))
28396                 return -EFAULT;
28397
28398 +#ifdef CONFIG_PAX_SEGMEXEC
28399 +       BUG_ON(pax_find_mirror_vma(vma));
28400 +#endif
28401 +
28402         /*
28403          * cover the whole range: [new_start, old_end)
28404          */
28405 @@ -604,8 +624,28 @@ int setup_arg_pages(struct linux_binprm
28406         bprm->exec -= stack_shift;
28407
28408         down_write(&mm->mmap_sem);
28409 +
28410 +       /* Move stack pages down in memory. */
28411 +       if (stack_shift) {
28412 +               ret = shift_arg_pages(vma, stack_shift);
28413 +               if (ret)
28414 +                       goto out_unlock;
28415 +       }
28416 +
28417         vm_flags = VM_STACK_FLAGS;
28418
28419 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
28420 +       if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
28421 +               vm_flags &= ~VM_EXEC;
28422 +
28423 +#ifdef CONFIG_PAX_MPROTECT
28424 +               if (mm->pax_flags & MF_PAX_MPROTECT)
28425 +                       vm_flags &= ~VM_MAYEXEC;
28426 +#endif
28427 +
28428 +       }
28429 +#endif
28430 +
28431         /*
28432          * Adjust stack execute permissions; explicitly enable for
28433          * EXSTACK_ENABLE_X, disable for EXSTACK_DISABLE_X and leave alone
28434 @@ -623,13 +663,6 @@ int setup_arg_pages(struct linux_binprm
28435                 goto out_unlock;
28436         BUG_ON(prev != vma);
28437
28438 -       /* Move stack pages down in memory. */
28439 -       if (stack_shift) {
28440 -               ret = shift_arg_pages(vma, stack_shift);
28441 -               if (ret)
28442 -                       goto out_unlock;
28443 -       }
28444 -
28445         stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
28446         stack_size = vma->vm_end - vma->vm_start;
28447         /*
28448 @@ -666,7 +699,7 @@ struct file *open_exec(const char *name)
28449         int err;
28450
28451         file = do_filp_open(AT_FDCWD, name,
28452 -                               O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
28453 +                               O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
28454                                 MAY_EXEC | MAY_OPEN);
28455         if (IS_ERR(file))
28456                 goto out;
28457 @@ -703,7 +736,7 @@ int kernel_read(struct file *file, loff_
28458         old_fs = get_fs();
28459         set_fs(get_ds());
28460         /* The cast to a user pointer is valid due to the set_fs() */
28461 -       result = vfs_read(file, (void __user *)addr, count, &pos);
28462 +       result = vfs_read(file, (__force void __user *)addr, count, &pos);
28463         set_fs(old_fs);
28464         return result;
28465  }
28466 @@ -1120,7 +1153,7 @@ int check_unsafe_exec(struct linux_binpr
28467         }
28468         rcu_read_unlock();
28469
28470 -       if (p->fs->users > n_fs) {
28471 +       if (atomic_read(&p->fs->users) > n_fs) {
28472                 bprm->unsafe |= LSM_UNSAFE_SHARE;
28473         } else {
28474                 res = -EAGAIN;
28475 @@ -1316,6 +1349,11 @@ int do_execve(char * filename,
28476         char __user *__user *envp,
28477         struct pt_regs * regs)
28478  {
28479 +#ifdef CONFIG_GRKERNSEC
28480 +       struct file *old_exec_file;
28481 +       struct acl_subject_label *old_acl;
28482 +       struct rlimit old_rlim[RLIM_NLIMITS];
28483 +#endif
28484         struct linux_binprm *bprm;
28485         struct file *file;
28486         struct files_struct *displaced;
28487 @@ -1352,6 +1390,18 @@ int do_execve(char * filename,
28488         bprm->filename = filename;
28489         bprm->interp = filename;
28490
28491 +       gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
28492 +
28493 +       if (gr_handle_nproc()) {
28494 +               retval = -EAGAIN;
28495 +               goto out_file;
28496 +       }
28497 +
28498 +       if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
28499 +               retval = -EACCES;
28500 +               goto out_file;
28501 +       }
28502 +
28503         retval = bprm_mm_init(bprm);
28504         if (retval)
28505                 goto out_file;
28506 @@ -1381,10 +1431,41 @@ int do_execve(char * filename,
28507         if (retval < 0)
28508                 goto out;
28509
28510 +       if (!gr_tpe_allow(file)) {
28511 +               retval = -EACCES;
28512 +               goto out;
28513 +       }
28514 +
28515 +       if (gr_check_crash_exec(file)) {
28516 +               retval = -EACCES;
28517 +               goto out;
28518 +       }
28519 +
28520 +       gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
28521 +
28522 +       gr_handle_exec_args(bprm, argv);
28523 +
28524 +#ifdef CONFIG_GRKERNSEC
28525 +       old_acl = current->acl;
28526 +       memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
28527 +       old_exec_file = current->exec_file;
28528 +       get_file(file);
28529 +       current->exec_file = file;
28530 +#endif
28531 +
28532 +       retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
28533 +                                  bprm->unsafe & LSM_UNSAFE_SHARE);
28534 +       if (retval < 0)
28535 +               goto out_fail;
28536 +
28537         current->flags &= ~PF_KTHREAD;
28538         retval = search_binary_handler(bprm,regs);
28539         if (retval < 0)
28540 -               goto out;
28541 +               goto out_fail;
28542 +#ifdef CONFIG_GRKERNSEC
28543 +       if (old_exec_file)
28544 +               fput(old_exec_file);
28545 +#endif
28546
28547         current->stack_start = current->mm->start_stack;
28548
28549 @@ -1397,6 +1478,14 @@ int do_execve(char * filename,
28550                 put_files_struct(displaced);
28551         return retval;
28552
28553 +out_fail:
28554 +#ifdef CONFIG_GRKERNSEC
28555 +       current->acl = old_acl;
28556 +       memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
28557 +       fput(current->exec_file);
28558 +       current->exec_file = old_exec_file;
28559 +#endif
28560 +
28561  out:
28562         if (bprm->mm)
28563                 mmput (bprm->mm);
28564 @@ -1560,6 +1649,169 @@ out:
28565         return ispipe;
28566  }
28567
28568 +int pax_check_flags(unsigned long *flags)
28569 +{
28570 +       int retval = 0;
28571 +
28572 +#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
28573 +       if (*flags & MF_PAX_SEGMEXEC)
28574 +       {
28575 +               *flags &= ~MF_PAX_SEGMEXEC;
28576 +               retval = -EINVAL;
28577 +       }
28578 +#endif
28579 +
28580 +       if ((*flags & MF_PAX_PAGEEXEC)
28581 +
28582 +#ifdef CONFIG_PAX_PAGEEXEC
28583 +           &&  (*flags & MF_PAX_SEGMEXEC)
28584 +#endif
28585 +
28586 +          )
28587 +       {
28588 +               *flags &= ~MF_PAX_PAGEEXEC;
28589 +               retval = -EINVAL;
28590 +       }
28591 +
28592 +       if ((*flags & MF_PAX_MPROTECT)
28593 +
28594 +#ifdef CONFIG_PAX_MPROTECT
28595 +           && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
28596 +#endif
28597 +
28598 +          )
28599 +       {
28600 +               *flags &= ~MF_PAX_MPROTECT;
28601 +               retval = -EINVAL;
28602 +       }
28603 +
28604 +       if ((*flags & MF_PAX_EMUTRAMP)
28605 +
28606 +#ifdef CONFIG_PAX_EMUTRAMP
28607 +           && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
28608 +#endif
28609 +
28610 +          )
28611 +       {
28612 +               *flags &= ~MF_PAX_EMUTRAMP;
28613 +               retval = -EINVAL;
28614 +       }
28615 +
28616 +       return retval;
28617 +}
28618 +
28619 +EXPORT_SYMBOL(pax_check_flags);
28620 +
28621 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
28622 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
28623 +{
28624 +       struct task_struct *tsk = current;
28625 +       struct mm_struct *mm = current->mm;
28626 +       char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
28627 +       char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
28628 +       char *path_exec = NULL;
28629 +       char *path_fault = NULL;
28630 +       unsigned long start = 0UL, end = 0UL, offset = 0UL;
28631 +
28632 +       if (buffer_exec && buffer_fault) {
28633 +               struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
28634 +
28635 +               down_read(&mm->mmap_sem);
28636 +               vma = mm->mmap;
28637 +               while (vma && (!vma_exec || !vma_fault)) {
28638 +                       if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
28639 +                               vma_exec = vma;
28640 +                       if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
28641 +                               vma_fault = vma;
28642 +                       vma = vma->vm_next;
28643 +               }
28644 +               if (vma_exec) {
28645 +                       path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
28646 +                       if (IS_ERR(path_exec))
28647 +                               path_exec = "<path too long>";
28648 +                       else {
28649 +                               path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
28650 +                               if (path_exec) {
28651 +                                       *path_exec = 0;
28652 +                                       path_exec = buffer_exec;
28653 +                               } else
28654 +                                       path_exec = "<path too long>";
28655 +                       }
28656 +               }
28657 +               if (vma_fault) {
28658 +                       start = vma_fault->vm_start;
28659 +                       end = vma_fault->vm_end;
28660 +                       offset = vma_fault->vm_pgoff << PAGE_SHIFT;
28661 +                       if (vma_fault->vm_file) {
28662 +                               path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
28663 +                               if (IS_ERR(path_fault))
28664 +                                       path_fault = "<path too long>";
28665 +                               else {
28666 +                                       path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
28667 +                                       if (path_fault) {
28668 +                                               *path_fault = 0;
28669 +                                               path_fault = buffer_fault;
28670 +                                       } else
28671 +                                               path_fault = "<path too long>";
28672 +                               }
28673 +                       } else
28674 +                               path_fault = "<anonymous mapping>";
28675 +               }
28676 +               up_read(&mm->mmap_sem);
28677 +       }
28678 +       if (tsk->signal->curr_ip)
28679 +               printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
28680 +       else
28681 +               printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
28682 +       printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
28683 +                       "PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
28684 +                       task_uid(tsk), task_euid(tsk), pc, sp);
28685 +       free_page((unsigned long)buffer_exec);
28686 +       free_page((unsigned long)buffer_fault);
28687 +       pax_report_insns(pc, sp);
28688 +       do_coredump(SIGKILL, SIGKILL, regs);
28689 +}
28690 +#endif
28691 +
28692 +#ifdef CONFIG_PAX_REFCOUNT
28693 +void pax_report_refcount_overflow(struct pt_regs *regs)
28694 +{
28695 +       if (current->signal->curr_ip)
28696 +               printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
28697 +                                &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
28698 +       else
28699 +               printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
28700 +                                current->comm, task_pid_nr(current), current_uid(), current_euid());
28701 +       print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
28702 +       show_regs(regs);
28703 +       force_sig_info(SIGKILL, SEND_SIG_FORCED, current);
28704 +}
28705 +#endif
28706 +
28707 +#ifdef CONFIG_PAX_USERCOPY
28708 +void pax_report_leak_to_user(const void *ptr, unsigned long len)
28709 +{
28710 +       if (current->signal->curr_ip)
28711 +               printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
28712 +                       &current->signal->curr_ip, ptr, len);
28713 +       else
28714 +               printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
28715 +       dump_stack();
28716 +       do_group_exit(SIGKILL);
28717 +}
28718 +
28719 +void pax_report_overflow_from_user(const void *ptr, unsigned long len)
28720 +{
28721 +       if (current->signal->curr_ip)
28722 +               printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
28723 +                       &current->signal->curr_ip, ptr, len);
28724 +       else
28725 +               printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
28726 +       dump_stack();
28727 +       do_group_exit(SIGKILL);
28728 +}
28729 +#endif
28730 +
28731  static int zap_process(struct task_struct *start)
28732  {
28733         struct task_struct *t;
28734 @@ -1762,17 +2014,17 @@ static void wait_for_dump_helpers(struct
28735         pipe = file->f_path.dentry->d_inode->i_pipe;
28736
28737         pipe_lock(pipe);
28738 -       pipe->readers++;
28739 -       pipe->writers--;
28740 +       atomic_inc(&pipe->readers);
28741 +       atomic_dec(&pipe->writers);
28742
28743 -       while ((pipe->readers > 1) && (!signal_pending(current))) {
28744 +       while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
28745                 wake_up_interruptible_sync(&pipe->wait);
28746                 kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
28747                 pipe_wait(pipe);
28748         }
28749
28750 -       pipe->readers--;
28751 -       pipe->writers++;
28752 +       atomic_dec(&pipe->readers);
28753 +       atomic_inc(&pipe->writers);
28754         pipe_unlock(pipe);
28755
28756  }
28757 @@ -1846,6 +2098,10 @@ void do_coredump(long signr, int exit_co
28758          */
28759         clear_thread_flag(TIF_SIGPENDING);
28760
28761 +       if (signr == SIGKILL || signr == SIGILL)
28762 +               gr_handle_brute_attach(current);
28763 +       gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
28764 +
28765         /*
28766          * lock_kernel() because format_corename() is controlled by sysctl, which
28767          * uses lock_kernel()
28768 diff -urNp linux-2.6.33/fs/ext2/balloc.c linux-2.6.33/fs/ext2/balloc.c
28769 --- linux-2.6.33/fs/ext2/balloc.c       2010-02-24 13:52:17.000000000 -0500
28770 +++ linux-2.6.33/fs/ext2/balloc.c       2010-03-07 12:23:36.081714180 -0500
28771 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
28772
28773         free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
28774         root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
28775 -       if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
28776 +       if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
28777                 sbi->s_resuid != current_fsuid() &&
28778                 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
28779                 return 0;
28780 diff -urNp linux-2.6.33/fs/ext3/balloc.c linux-2.6.33/fs/ext3/balloc.c
28781 --- linux-2.6.33/fs/ext3/balloc.c       2010-02-24 13:52:17.000000000 -0500
28782 +++ linux-2.6.33/fs/ext3/balloc.c       2010-03-07 12:23:36.081714180 -0500
28783 @@ -1421,7 +1421,7 @@ static int ext3_has_free_blocks(struct e
28784
28785         free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
28786         root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
28787 -       if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
28788 +       if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
28789                 sbi->s_resuid != current_fsuid() &&
28790                 (sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
28791                 return 0;
28792 diff -urNp linux-2.6.33/fs/ext3/namei.c linux-2.6.33/fs/ext3/namei.c
28793 --- linux-2.6.33/fs/ext3/namei.c        2010-02-24 13:52:17.000000000 -0500
28794 +++ linux-2.6.33/fs/ext3/namei.c        2010-03-07 12:23:36.081714180 -0500
28795 @@ -1168,7 +1168,7 @@ static struct ext3_dir_entry_2 *do_split
28796         char *data1 = (*bh)->b_data, *data2;
28797         unsigned split, move, size;
28798         struct ext3_dir_entry_2 *de = NULL, *de2;
28799 -       int     err = 0, i;
28800 +       int     i, err = 0;
28801
28802         bh2 = ext3_append (handle, dir, &newblock, &err);
28803         if (!(bh2)) {
28804 diff -urNp linux-2.6.33/fs/ext3/xattr.c linux-2.6.33/fs/ext3/xattr.c
28805 --- linux-2.6.33/fs/ext3/xattr.c        2010-02-24 13:52:17.000000000 -0500
28806 +++ linux-2.6.33/fs/ext3/xattr.c        2010-03-07 12:23:36.081714180 -0500
28807 @@ -89,8 +89,8 @@
28808                 printk("\n"); \
28809         } while (0)
28810  #else
28811 -# define ea_idebug(f...)
28812 -# define ea_bdebug(f...)
28813 +# define ea_idebug(f...) do {} while (0)
28814 +# define ea_bdebug(f...) do {} while (0)
28815  #endif
28816
28817  static void ext3_xattr_cache_insert(struct buffer_head *);
28818 diff -urNp linux-2.6.33/fs/ext4/balloc.c linux-2.6.33/fs/ext4/balloc.c
28819 --- linux-2.6.33/fs/ext4/balloc.c       2010-02-24 13:52:17.000000000 -0500
28820 +++ linux-2.6.33/fs/ext4/balloc.c       2010-03-07 12:23:36.081714180 -0500
28821 @@ -535,7 +535,7 @@ int ext4_has_free_blocks(struct ext4_sb_
28822         /* Hm, nope.  Are (enough) root reserved blocks available? */
28823         if (sbi->s_resuid == current_fsuid() ||
28824             ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
28825 -           capable(CAP_SYS_RESOURCE)) {
28826 +           capable_nolog(CAP_SYS_RESOURCE)) {
28827                 if (free_blocks >= (nblocks + dirty_blocks))
28828                         return 1;
28829         }
28830 diff -urNp linux-2.6.33/fs/ext4/ioctl.c linux-2.6.33/fs/ext4/ioctl.c
28831 --- linux-2.6.33/fs/ext4/ioctl.c        2010-02-24 13:52:17.000000000 -0500
28832 +++ linux-2.6.33/fs/ext4/ioctl.c        2010-03-07 12:23:36.081714180 -0500
28833 @@ -221,6 +221,9 @@ setversion_out:
28834                 struct file *donor_filp;
28835                 int err;
28836
28837 +               /* temporary workaround for bugs in here */
28838 +               return -EOPNOTSUPP;
28839 +
28840                 if (!(filp->f_mode & FMODE_READ) ||
28841                     !(filp->f_mode & FMODE_WRITE))
28842                         return -EBADF;
28843 diff -urNp linux-2.6.33/fs/ext4/namei.c linux-2.6.33/fs/ext4/namei.c
28844 --- linux-2.6.33/fs/ext4/namei.c        2010-02-24 13:52:17.000000000 -0500
28845 +++ linux-2.6.33/fs/ext4/namei.c        2010-03-07 12:23:36.081714180 -0500
28846 @@ -1203,7 +1203,7 @@ static struct ext4_dir_entry_2 *do_split
28847         char *data1 = (*bh)->b_data, *data2;
28848         unsigned split, move, size;
28849         struct ext4_dir_entry_2 *de = NULL, *de2;
28850 -       int     err = 0, i;
28851 +       int     i, err = 0;
28852
28853         bh2 = ext4_append (handle, dir, &newblock, &err);
28854         if (!(bh2)) {
28855 diff -urNp linux-2.6.33/fs/ext4/super.c linux-2.6.33/fs/ext4/super.c
28856 --- linux-2.6.33/fs/ext4/super.c        2010-02-24 13:52:17.000000000 -0500
28857 +++ linux-2.6.33/fs/ext4/super.c        2010-03-07 12:23:36.085722338 -0500
28858 @@ -2292,7 +2292,7 @@ static void ext4_sb_release(struct kobje
28859  }
28860
28861
28862 -static struct sysfs_ops ext4_attr_ops = {
28863 +static const struct sysfs_ops ext4_attr_ops = {
28864         .show   = ext4_attr_show,
28865         .store  = ext4_attr_store,
28866  };
28867 diff -urNp linux-2.6.33/fs/fcntl.c linux-2.6.33/fs/fcntl.c
28868 --- linux-2.6.33/fs/fcntl.c     2010-02-24 13:52:17.000000000 -0500
28869 +++ linux-2.6.33/fs/fcntl.c     2010-03-07 12:23:36.085722338 -0500
28870 @@ -344,6 +344,7 @@ static long do_fcntl(int fd, unsigned in
28871         switch (cmd) {
28872         case F_DUPFD:
28873         case F_DUPFD_CLOEXEC:
28874 +               gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
28875                 if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
28876                         break;
28877                 err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
28878 @@ -500,7 +501,8 @@ static inline int sigio_perm(struct task
28879         ret = ((fown->euid == 0 ||
28880                 fown->euid == cred->suid || fown->euid == cred->uid ||
28881                 fown->uid  == cred->suid || fown->uid  == cred->uid) &&
28882 -              !security_file_send_sigiotask(p, fown, sig));
28883 +              !security_file_send_sigiotask(p, fown, sig) &&
28884 +              !gr_check_protected_task(p) && !gr_pid_is_chrooted(p));
28885         rcu_read_unlock();
28886         return ret;
28887  }
28888 diff -urNp linux-2.6.33/fs/fifo.c linux-2.6.33/fs/fifo.c
28889 --- linux-2.6.33/fs/fifo.c      2010-02-24 13:52:17.000000000 -0500
28890 +++ linux-2.6.33/fs/fifo.c      2010-03-07 12:23:36.085722338 -0500
28891 @@ -59,10 +59,10 @@ static int fifo_open(struct inode *inode
28892          */
28893                 filp->f_op = &read_pipefifo_fops;
28894                 pipe->r_counter++;
28895 -               if (pipe->readers++ == 0)
28896 +               if (atomic_inc_return(&pipe->readers) == 1)
28897                         wake_up_partner(inode);
28898
28899 -               if (!pipe->writers) {
28900 +               if (!atomic_read(&pipe->writers)) {
28901                         if ((filp->f_flags & O_NONBLOCK)) {
28902                                 /* suppress POLLHUP until we have
28903                                  * seen a writer */
28904 @@ -83,15 +83,15 @@ static int fifo_open(struct inode *inode
28905          *  errno=ENXIO when there is no process reading the FIFO.
28906          */
28907                 ret = -ENXIO;
28908 -               if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
28909 +               if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
28910                         goto err;
28911
28912                 filp->f_op = &write_pipefifo_fops;
28913                 pipe->w_counter++;
28914 -               if (!pipe->writers++)
28915 +               if (atomic_inc_return(&pipe->writers) == 1)
28916                         wake_up_partner(inode);
28917
28918 -               if (!pipe->readers) {
28919 +               if (!atomic_read(&pipe->readers)) {
28920                         wait_for_partner(inode, &pipe->r_counter);
28921                         if (signal_pending(current))
28922                                 goto err_wr;
28923 @@ -107,11 +107,11 @@ static int fifo_open(struct inode *inode
28924          */
28925                 filp->f_op = &rdwr_pipefifo_fops;
28926
28927 -               pipe->readers++;
28928 -               pipe->writers++;
28929 +               atomic_inc(&pipe->readers);
28930 +               atomic_inc(&pipe->writers);
28931                 pipe->r_counter++;
28932                 pipe->w_counter++;
28933 -               if (pipe->readers == 1 || pipe->writers == 1)
28934 +               if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
28935                         wake_up_partner(inode);
28936                 break;
28937
28938 @@ -125,19 +125,19 @@ static int fifo_open(struct inode *inode
28939         return 0;
28940
28941  err_rd:
28942 -       if (!--pipe->readers)
28943 +       if (atomic_dec_and_test(&pipe->readers))
28944                 wake_up_interruptible(&pipe->wait);
28945         ret = -ERESTARTSYS;
28946         goto err;
28947
28948  err_wr:
28949 -       if (!--pipe->writers)
28950 +       if (atomic_dec_and_test(&pipe->writers))
28951                 wake_up_interruptible(&pipe->wait);
28952         ret = -ERESTARTSYS;
28953         goto err;
28954
28955  err:
28956 -       if (!pipe->readers && !pipe->writers)
28957 +       if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
28958                 free_pipe_info(inode);
28959
28960  err_nocleanup:
28961 diff -urNp linux-2.6.33/fs/file.c linux-2.6.33/fs/file.c
28962 --- linux-2.6.33/fs/file.c      2010-02-24 13:52:17.000000000 -0500
28963 +++ linux-2.6.33/fs/file.c      2010-03-07 12:23:36.085722338 -0500
28964 @@ -14,6 +14,7 @@
28965  #include <linux/slab.h>
28966  #include <linux/vmalloc.h>
28967  #include <linux/file.h>
28968 +#include <linux/security.h>
28969  #include <linux/fdtable.h>
28970  #include <linux/bitops.h>
28971  #include <linux/interrupt.h>
28972 @@ -257,6 +258,8 @@ int expand_files(struct files_struct *fi
28973          * N.B. For clone tasks sharing a files structure, this test
28974          * will limit the total number of files that can be opened.
28975          */
28976 +
28977 +       gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
28978         if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
28979                 return -EMFILE;
28980
28981 diff -urNp linux-2.6.33/fs/fs_struct.c linux-2.6.33/fs/fs_struct.c
28982 --- linux-2.6.33/fs/fs_struct.c 2010-02-24 13:52:17.000000000 -0500
28983 +++ linux-2.6.33/fs/fs_struct.c 2010-03-07 12:23:36.085722338 -0500
28984 @@ -45,10 +45,12 @@ void chroot_fs_refs(struct path *old_roo
28985         struct task_struct *g, *p;
28986         struct fs_struct *fs;
28987         int count = 0;
28988 +       unsigned long flags;
28989
28990         read_lock(&tasklist_lock);
28991         do_each_thread(g, p) {
28992                 task_lock(p);
28993 +               gr_fs_write_lock_irqsave(p, flags);
28994                 fs = p->fs;
28995                 if (fs) {
28996                         write_lock(&fs->lock);
28997 @@ -66,6 +68,7 @@ void chroot_fs_refs(struct path *old_roo
28998                         }
28999                         write_unlock(&fs->lock);
29000                 }
29001 +               gr_fs_write_unlock_irqrestore(p, flags);
29002                 task_unlock(p);
29003         } while_each_thread(g, p);
29004         read_unlock(&tasklist_lock);
29005 @@ -83,14 +86,17 @@ void free_fs_struct(struct fs_struct *fs
29006  void exit_fs(struct task_struct *tsk)
29007  {
29008         struct fs_struct *fs = tsk->fs;
29009 +       unsigned long flags;
29010
29011         if (fs) {
29012                 int kill;
29013                 task_lock(tsk);
29014 +               gr_fs_write_lock_irqsave(tsk, flags);
29015                 write_lock(&fs->lock);
29016                 tsk->fs = NULL;
29017 -               kill = !--fs->users;
29018 +               kill = !atomic_dec_return(&fs->users);
29019                 write_unlock(&fs->lock);
29020 +               gr_fs_write_unlock_irqrestore(tsk, flags);
29021                 task_unlock(tsk);
29022                 if (kill)
29023                         free_fs_struct(fs);
29024 @@ -102,7 +108,7 @@ struct fs_struct *copy_fs_struct(struct
29025         struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
29026         /* We don't need to lock fs - think why ;-) */
29027         if (fs) {
29028 -               fs->users = 1;
29029 +               atomic_set(&fs->users, 1);
29030                 fs->in_exec = 0;
29031                 rwlock_init(&fs->lock);
29032                 fs->umask = old->umask;
29033 @@ -121,15 +127,18 @@ int unshare_fs_struct(void)
29034         struct fs_struct *fs = current->fs;
29035         struct fs_struct *new_fs = copy_fs_struct(fs);
29036         int kill;
29037 +       unsigned long flags;
29038
29039         if (!new_fs)
29040                 return -ENOMEM;
29041
29042         task_lock(current);
29043 +       gr_fs_write_lock_irqsave(current, flags);
29044         write_lock(&fs->lock);
29045 -       kill = !--fs->users;
29046 +       kill = !atomic_dec_return(&fs->users);
29047         current->fs = new_fs;
29048         write_unlock(&fs->lock);
29049 +       gr_fs_write_unlock_irqrestore(current, flags);
29050         task_unlock(current);
29051
29052         if (kill)
29053 @@ -147,7 +156,7 @@ EXPORT_SYMBOL(current_umask);
29054
29055  /* to be mentioned only in INIT_TASK */
29056  struct fs_struct init_fs = {
29057 -       .users          = 1,
29058 +       .users          = ATOMIC_INIT(1),
29059         .lock           = __RW_LOCK_UNLOCKED(init_fs.lock),
29060         .umask          = 0022,
29061  };
29062 @@ -155,6 +164,7 @@ struct fs_struct init_fs = {
29063  void daemonize_fs_struct(void)
29064  {
29065         struct fs_struct *fs = current->fs;
29066 +       unsigned long flags;
29067
29068         if (fs) {
29069                 int kill;
29070 @@ -162,13 +172,15 @@ void daemonize_fs_struct(void)
29071                 task_lock(current);
29072
29073                 write_lock(&init_fs.lock);
29074 -               init_fs.users++;
29075 +               atomic_inc(&init_fs.users);
29076                 write_unlock(&init_fs.lock);
29077
29078 +               gr_fs_write_lock_irqsave(current, flags);
29079                 write_lock(&fs->lock);
29080                 current->fs = &init_fs;
29081 -               kill = !--fs->users;
29082 +               kill = !atomic_dec_return(&fs->users);
29083                 write_unlock(&fs->lock);
29084 +               gr_fs_write_unlock_irqrestore(current, flags);
29085
29086                 task_unlock(current);
29087                 if (kill)
29088 diff -urNp linux-2.6.33/fs/fuse/control.c linux-2.6.33/fs/fuse/control.c
29089 --- linux-2.6.33/fs/fuse/control.c      2010-02-24 13:52:17.000000000 -0500
29090 +++ linux-2.6.33/fs/fuse/control.c      2010-03-07 12:23:36.085722338 -0500
29091 @@ -293,7 +293,7 @@ void fuse_ctl_remove_conn(struct fuse_co
29092
29093  static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
29094  {
29095 -       struct tree_descr empty_descr = {""};
29096 +       struct tree_descr empty_descr = {"", NULL, 0};
29097         struct fuse_conn *fc;
29098         int err;
29099
29100 diff -urNp linux-2.6.33/fs/fuse/cuse.c linux-2.6.33/fs/fuse/cuse.c
29101 --- linux-2.6.33/fs/fuse/cuse.c 2010-02-24 13:52:17.000000000 -0500
29102 +++ linux-2.6.33/fs/fuse/cuse.c 2010-03-07 12:23:36.085722338 -0500
29103 @@ -528,8 +528,18 @@ static int cuse_channel_release(struct i
29104         return rc;
29105  }
29106
29107 -static struct file_operations cuse_channel_fops; /* initialized during init */
29108 -
29109 +static const struct file_operations cuse_channel_fops = { /* initialized during init */
29110 +       .owner          = THIS_MODULE,
29111 +       .llseek         = no_llseek,
29112 +       .read           = do_sync_read,
29113 +       .aio_read       = fuse_dev_read,
29114 +       .write          = do_sync_write,
29115 +       .aio_write      = fuse_dev_write,
29116 +       .poll           = fuse_dev_poll,
29117 +       .open           = cuse_channel_open,
29118 +       .release        = cuse_channel_release,
29119 +       .fasync         = fuse_dev_fasync,
29120 +};
29121
29122  /**************************************************************************
29123   * Misc stuff and module initializatiion
29124 @@ -575,12 +585,6 @@ static int __init cuse_init(void)
29125         for (i = 0; i < CUSE_CONNTBL_LEN; i++)
29126                 INIT_LIST_HEAD(&cuse_conntbl[i]);
29127
29128 -       /* inherit and extend fuse_dev_operations */
29129 -       cuse_channel_fops               = fuse_dev_operations;
29130 -       cuse_channel_fops.owner         = THIS_MODULE;
29131 -       cuse_channel_fops.open          = cuse_channel_open;
29132 -       cuse_channel_fops.release       = cuse_channel_release;
29133 -
29134         cuse_class = class_create(THIS_MODULE, "cuse");
29135         if (IS_ERR(cuse_class))
29136                 return PTR_ERR(cuse_class);
29137 diff -urNp linux-2.6.33/fs/fuse/dev.c linux-2.6.33/fs/fuse/dev.c
29138 --- linux-2.6.33/fs/fuse/dev.c  2010-02-24 13:52:17.000000000 -0500
29139 +++ linux-2.6.33/fs/fuse/dev.c  2010-03-07 12:23:36.085722338 -0500
29140 @@ -745,7 +745,7 @@ __releases(&fc->lock)
29141   * request_end().  Otherwise add it to the processing list, and set
29142   * the 'sent' flag.
29143   */
29144 -static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
29145 +ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
29146                               unsigned long nr_segs, loff_t pos)
29147  {
29148         int err;
29149 @@ -828,6 +828,8 @@ static ssize_t fuse_dev_read(struct kioc
29150         return err;
29151  }
29152
29153 +EXPORT_SYMBOL_GPL(fuse_dev_read);
29154 +
29155  static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
29156                             struct fuse_copy_state *cs)
29157  {
29158 @@ -885,7 +887,7 @@ static int fuse_notify_inval_entry(struc
29159  {
29160         struct fuse_notify_inval_entry_out outarg;
29161         int err = -EINVAL;
29162 -       char buf[FUSE_NAME_MAX+1];
29163 +       char *buf = NULL;
29164         struct qstr name;
29165
29166         if (size < sizeof(outarg))
29167 @@ -899,6 +901,11 @@ static int fuse_notify_inval_entry(struc
29168         if (outarg.namelen > FUSE_NAME_MAX)
29169                 goto err;
29170
29171 +       err = -ENOMEM;
29172 +       buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
29173 +       if (!buf)
29174 +               goto err;
29175 +
29176         name.name = buf;
29177         name.len = outarg.namelen;
29178         err = fuse_copy_one(cs, buf, outarg.namelen + 1);
29179 @@ -910,17 +917,15 @@ static int fuse_notify_inval_entry(struc
29180
29181         down_read(&fc->killsb);
29182         err = -ENOENT;
29183 -       if (!fc->sb)
29184 -               goto err_unlock;
29185 -
29186 -       err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
29187 -
29188 -err_unlock:
29189 +       if (fc->sb)
29190 +               err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
29191         up_read(&fc->killsb);
29192 +       kfree(buf);
29193         return err;
29194
29195  err:
29196         fuse_copy_finish(cs);
29197 +       kfree(buf);
29198         return err;
29199  }
29200
29201 @@ -987,7 +992,7 @@ static int copy_out_args(struct fuse_cop
29202   * it from the list and copy the rest of the buffer to the request.
29203   * The request is finished by calling request_end()
29204   */
29205 -static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
29206 +ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
29207                                unsigned long nr_segs, loff_t pos)
29208  {
29209         int err;
29210 @@ -1084,7 +1089,9 @@ static ssize_t fuse_dev_write(struct kio
29211         return err;
29212  }
29213
29214 -static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
29215 +EXPORT_SYMBOL_GPL(fuse_dev_write);
29216 +
29217 +unsigned fuse_dev_poll(struct file *file, poll_table *wait)
29218  {
29219         unsigned mask = POLLOUT | POLLWRNORM;
29220         struct fuse_conn *fc = fuse_get_conn(file);
29221 @@ -1103,6 +1110,8 @@ static unsigned fuse_dev_poll(struct fil
29222         return mask;
29223  }
29224
29225 +EXPORT_SYMBOL_GPL(fuse_dev_poll);
29226 +
29227  /*
29228   * Abort all requests on the given list (pending or processing)
29229   *
29230 @@ -1210,7 +1219,7 @@ int fuse_dev_release(struct inode *inode
29231  }
29232  EXPORT_SYMBOL_GPL(fuse_dev_release);
29233
29234 -static int fuse_dev_fasync(int fd, struct file *file, int on)
29235 +int fuse_dev_fasync(int fd, struct file *file, int on)
29236  {
29237         struct fuse_conn *fc = fuse_get_conn(file);
29238         if (!fc)
29239 @@ -1220,6 +1229,8 @@ static int fuse_dev_fasync(int fd, struc
29240         return fasync_helper(fd, file, on, &fc->fasync);
29241  }
29242
29243 +EXPORT_SYMBOL_GPL(fuse_dev_fasync);
29244 +
29245  const struct file_operations fuse_dev_operations = {
29246         .owner          = THIS_MODULE,
29247         .llseek         = no_llseek,
29248 diff -urNp linux-2.6.33/fs/fuse/dir.c linux-2.6.33/fs/fuse/dir.c
29249 --- linux-2.6.33/fs/fuse/dir.c  2010-02-24 13:52:17.000000000 -0500
29250 +++ linux-2.6.33/fs/fuse/dir.c  2010-03-07 12:23:36.085722338 -0500
29251 @@ -1127,7 +1127,7 @@ static char *read_link(struct dentry *de
29252         return link;
29253  }
29254
29255 -static void free_link(char *link)
29256 +static void free_link(const char *link)
29257  {
29258         if (!IS_ERR(link))
29259                 free_page((unsigned long) link);
29260 diff -urNp linux-2.6.33/fs/fuse/fuse_i.h linux-2.6.33/fs/fuse/fuse_i.h
29261 --- linux-2.6.33/fs/fuse/fuse_i.h       2010-02-24 13:52:17.000000000 -0500
29262 +++ linux-2.6.33/fs/fuse/fuse_i.h       2010-03-07 12:23:36.085722338 -0500
29263 @@ -521,6 +521,16 @@ extern const struct file_operations fuse
29264
29265  extern const struct dentry_operations fuse_dentry_operations;
29266
29267 +extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
29268 +                             unsigned long nr_segs, loff_t pos);
29269 +
29270 +extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
29271 +                              unsigned long nr_segs, loff_t pos);
29272 +
29273 +extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
29274 +
29275 +extern int fuse_dev_fasync(int fd, struct file *file, int on);
29276 +
29277  /**
29278   * Inode to nodeid comparison.
29279   */
29280 diff -urNp linux-2.6.33/fs/gfs2/sys.c linux-2.6.33/fs/gfs2/sys.c
29281 --- linux-2.6.33/fs/gfs2/sys.c  2010-02-24 13:52:17.000000000 -0500
29282 +++ linux-2.6.33/fs/gfs2/sys.c  2010-03-07 12:23:36.085722338 -0500
29283 @@ -49,7 +49,7 @@ static ssize_t gfs2_attr_store(struct ko
29284         return a->store ? a->store(sdp, buf, len) : len;
29285  }
29286
29287 -static struct sysfs_ops gfs2_attr_ops = {
29288 +static const struct sysfs_ops gfs2_attr_ops = {
29289         .show  = gfs2_attr_show,
29290         .store = gfs2_attr_store,
29291  };
29292 @@ -576,7 +576,7 @@ static int gfs2_uevent(struct kset *kset
29293         return 0;
29294  }
29295
29296 -static struct kset_uevent_ops gfs2_uevent_ops = {
29297 +static const struct kset_uevent_ops gfs2_uevent_ops = {
29298         .uevent = gfs2_uevent,
29299  };
29300
29301 diff -urNp linux-2.6.33/fs/hfs/inode.c linux-2.6.33/fs/hfs/inode.c
29302 --- linux-2.6.33/fs/hfs/inode.c 2010-02-24 13:52:17.000000000 -0500
29303 +++ linux-2.6.33/fs/hfs/inode.c 2010-03-07 12:23:36.085722338 -0500
29304 @@ -423,7 +423,7 @@ int hfs_write_inode(struct inode *inode,
29305
29306         if (S_ISDIR(main_inode->i_mode)) {
29307                 if (fd.entrylength < sizeof(struct hfs_cat_dir))
29308 -                       /* panic? */;
29309 +                       {/* panic? */}
29310                 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
29311                            sizeof(struct hfs_cat_dir));
29312                 if (rec.type != HFS_CDR_DIR ||
29313 @@ -444,7 +444,7 @@ int hfs_write_inode(struct inode *inode,
29314                                 sizeof(struct hfs_cat_file));
29315         } else {
29316                 if (fd.entrylength < sizeof(struct hfs_cat_file))
29317 -                       /* panic? */;
29318 +                       {/* panic? */}
29319                 hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
29320                            sizeof(struct hfs_cat_file));
29321                 if (rec.type != HFS_CDR_FIL ||
29322 diff -urNp linux-2.6.33/fs/hfsplus/inode.c linux-2.6.33/fs/hfsplus/inode.c
29323 --- linux-2.6.33/fs/hfsplus/inode.c     2010-02-24 13:52:17.000000000 -0500
29324 +++ linux-2.6.33/fs/hfsplus/inode.c     2010-03-07 12:23:36.085722338 -0500
29325 @@ -406,7 +406,7 @@ int hfsplus_cat_read_inode(struct inode
29326                 struct hfsplus_cat_folder *folder = &entry.folder;
29327
29328                 if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
29329 -                       /* panic? */;
29330 +                       {/* panic? */}
29331                 hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
29332                                         sizeof(struct hfsplus_cat_folder));
29333                 hfsplus_get_perms(inode, &folder->permissions, 1);
29334 @@ -423,7 +423,7 @@ int hfsplus_cat_read_inode(struct inode
29335                 struct hfsplus_cat_file *file = &entry.file;
29336
29337                 if (fd->entrylength < sizeof(struct hfsplus_cat_file))
29338 -                       /* panic? */;
29339 +                       {/* panic? */}
29340                 hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
29341                                         sizeof(struct hfsplus_cat_file));
29342
29343 @@ -479,7 +479,7 @@ int hfsplus_cat_write_inode(struct inode
29344                 struct hfsplus_cat_folder *folder = &entry.folder;
29345
29346                 if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
29347 -                       /* panic? */;
29348 +                       {/* panic? */}
29349                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
29350                                         sizeof(struct hfsplus_cat_folder));
29351                 /* simple node checks? */
29352 @@ -501,7 +501,7 @@ int hfsplus_cat_write_inode(struct inode
29353                 struct hfsplus_cat_file *file = &entry.file;
29354
29355                 if (fd.entrylength < sizeof(struct hfsplus_cat_file))
29356 -                       /* panic? */;
29357 +                       {/* panic? */}
29358                 hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
29359                                         sizeof(struct hfsplus_cat_file));
29360                 hfsplus_inode_write_fork(inode, &file->data_fork);
29361 diff -urNp linux-2.6.33/fs/ioctl.c linux-2.6.33/fs/ioctl.c
29362 --- linux-2.6.33/fs/ioctl.c     2010-02-24 13:52:17.000000000 -0500
29363 +++ linux-2.6.33/fs/ioctl.c     2010-03-07 12:23:36.085722338 -0500
29364 @@ -97,7 +97,7 @@ int fiemap_fill_next_extent(struct fiema
29365                             u64 phys, u64 len, u32 flags)
29366  {
29367         struct fiemap_extent extent;
29368 -       struct fiemap_extent *dest = fieinfo->fi_extents_start;
29369 +       struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
29370
29371         /* only count the extents */
29372         if (fieinfo->fi_extents_max == 0) {
29373 @@ -207,7 +207,7 @@ static int ioctl_fiemap(struct file *fil
29374
29375         fieinfo.fi_flags = fiemap.fm_flags;
29376         fieinfo.fi_extents_max = fiemap.fm_extent_count;
29377 -       fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
29378 +       fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
29379
29380         if (fiemap.fm_extent_count != 0 &&
29381             !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
29382 @@ -220,7 +220,7 @@ static int ioctl_fiemap(struct file *fil
29383         error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
29384         fiemap.fm_flags = fieinfo.fi_flags;
29385         fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
29386 -       if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
29387 +       if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
29388                 error = -EFAULT;
29389
29390         return error;
29391 diff -urNp linux-2.6.33/fs/jffs2/debug.h linux-2.6.33/fs/jffs2/debug.h
29392 --- linux-2.6.33/fs/jffs2/debug.h       2010-02-24 13:52:17.000000000 -0500
29393 +++ linux-2.6.33/fs/jffs2/debug.h       2010-03-07 12:23:36.085722338 -0500
29394 @@ -52,13 +52,13 @@
29395  #if CONFIG_JFFS2_FS_DEBUG > 0
29396  #define D1(x) x
29397  #else
29398 -#define D1(x)
29399 +#define D1(x) do {} while (0);
29400  #endif
29401
29402  #if CONFIG_JFFS2_FS_DEBUG > 1
29403  #define D2(x) x
29404  #else
29405 -#define D2(x)
29406 +#define D2(x) do {} while (0);
29407  #endif
29408
29409  /* The prefixes of JFFS2 messages */
29410 @@ -114,73 +114,73 @@
29411  #ifdef JFFS2_DBG_READINODE_MESSAGES
29412  #define dbg_readinode(fmt, ...)        JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29413  #else
29414 -#define dbg_readinode(fmt, ...)
29415 +#define dbg_readinode(fmt, ...)        do {} while (0)
29416  #endif
29417  #ifdef JFFS2_DBG_READINODE2_MESSAGES
29418  #define dbg_readinode2(fmt, ...)       JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29419  #else
29420 -#define dbg_readinode2(fmt, ...)
29421 +#define dbg_readinode2(fmt, ...)       do {} while (0)
29422  #endif
29423
29424  /* Fragtree build debugging messages */
29425  #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
29426  #define dbg_fragtree(fmt, ...) JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29427  #else
29428 -#define dbg_fragtree(fmt, ...)
29429 +#define dbg_fragtree(fmt, ...) do {} while (0)
29430  #endif
29431  #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
29432  #define dbg_fragtree2(fmt, ...)        JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29433  #else
29434 -#define dbg_fragtree2(fmt, ...)
29435 +#define dbg_fragtree2(fmt, ...)        do {} while (0)
29436  #endif
29437
29438  /* Directory entry list manilulation debugging messages */
29439  #ifdef JFFS2_DBG_DENTLIST_MESSAGES
29440  #define dbg_dentlist(fmt, ...) JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29441  #else
29442 -#define dbg_dentlist(fmt, ...)
29443 +#define dbg_dentlist(fmt, ...) do {} while (0)
29444  #endif
29445
29446  /* Print the messages about manipulating node_refs */
29447  #ifdef JFFS2_DBG_NODEREF_MESSAGES
29448  #define dbg_noderef(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29449  #else
29450 -#define dbg_noderef(fmt, ...)
29451 +#define dbg_noderef(fmt, ...)  do {} while (0)
29452  #endif
29453
29454  /* Manipulations with the list of inodes (JFFS2 inocache) */
29455  #ifdef JFFS2_DBG_INOCACHE_MESSAGES
29456  #define dbg_inocache(fmt, ...) JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29457  #else
29458 -#define dbg_inocache(fmt, ...)
29459 +#define dbg_inocache(fmt, ...) do {} while (0)
29460  #endif
29461
29462  /* Summary debugging messages */
29463  #ifdef JFFS2_DBG_SUMMARY_MESSAGES
29464  #define dbg_summary(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29465  #else
29466 -#define dbg_summary(fmt, ...)
29467 +#define dbg_summary(fmt, ...)  do {} while (0)
29468  #endif
29469
29470  /* File system build messages */
29471  #ifdef JFFS2_DBG_FSBUILD_MESSAGES
29472  #define dbg_fsbuild(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29473  #else
29474 -#define dbg_fsbuild(fmt, ...)
29475 +#define dbg_fsbuild(fmt, ...)  do {} while (0)
29476  #endif
29477
29478  /* Watch the object allocations */
29479  #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
29480  #define dbg_memalloc(fmt, ...) JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29481  #else
29482 -#define dbg_memalloc(fmt, ...)
29483 +#define dbg_memalloc(fmt, ...) do {} while (0)
29484  #endif
29485
29486  /* Watch the XATTR subsystem */
29487  #ifdef JFFS2_DBG_XATTR_MESSAGES
29488  #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
29489  #else
29490 -#define dbg_xattr(fmt, ...)
29491 +#define dbg_xattr(fmt, ...)    do {} while (0)
29492  #endif
29493
29494  /* "Sanity" checks */
29495 diff -urNp linux-2.6.33/fs/jffs2/erase.c linux-2.6.33/fs/jffs2/erase.c
29496 --- linux-2.6.33/fs/jffs2/erase.c       2010-02-24 13:52:17.000000000 -0500
29497 +++ linux-2.6.33/fs/jffs2/erase.c       2010-03-07 12:23:36.085722338 -0500
29498 @@ -434,7 +434,8 @@ static void jffs2_mark_erased_block(stru
29499                 struct jffs2_unknown_node marker = {
29500                         .magic =        cpu_to_je16(JFFS2_MAGIC_BITMASK),
29501                         .nodetype =     cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
29502 -                       .totlen =       cpu_to_je32(c->cleanmarker_size)
29503 +                       .totlen =       cpu_to_je32(c->cleanmarker_size),
29504 +                       .hdr_crc =      cpu_to_je32(0)
29505                 };
29506
29507                 jffs2_prealloc_raw_node_refs(c, jeb, 1);
29508 diff -urNp linux-2.6.33/fs/jffs2/summary.h linux-2.6.33/fs/jffs2/summary.h
29509 --- linux-2.6.33/fs/jffs2/summary.h     2010-02-24 13:52:17.000000000 -0500
29510 +++ linux-2.6.33/fs/jffs2/summary.h     2010-03-07 12:23:36.089622247 -0500
29511 @@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
29512
29513  #define jffs2_sum_active() (0)
29514  #define jffs2_sum_init(a) (0)
29515 -#define jffs2_sum_exit(a)
29516 -#define jffs2_sum_disable_collecting(a)
29517 +#define jffs2_sum_exit(a) do {} while (0)
29518 +#define jffs2_sum_disable_collecting(a) do {} while (0)
29519  #define jffs2_sum_is_disabled(a) (0)
29520 -#define jffs2_sum_reset_collected(a)
29521 +#define jffs2_sum_reset_collected(a) do {} while (0)
29522  #define jffs2_sum_add_kvec(a,b,c,d) (0)
29523 -#define jffs2_sum_move_collected(a,b)
29524 +#define jffs2_sum_move_collected(a,b) do {} while (0)
29525  #define jffs2_sum_write_sumnode(a) (0)
29526 -#define jffs2_sum_add_padding_mem(a,b)
29527 -#define jffs2_sum_add_inode_mem(a,b,c)
29528 -#define jffs2_sum_add_dirent_mem(a,b,c)
29529 -#define jffs2_sum_add_xattr_mem(a,b,c)
29530 -#define jffs2_sum_add_xref_mem(a,b,c)
29531 +#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
29532 +#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
29533 +#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
29534 +#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
29535 +#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
29536  #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
29537
29538  #endif /* CONFIG_JFFS2_SUMMARY */
29539 diff -urNp linux-2.6.33/fs/jffs2/wbuf.c linux-2.6.33/fs/jffs2/wbuf.c
29540 --- linux-2.6.33/fs/jffs2/wbuf.c        2010-02-24 13:52:17.000000000 -0500
29541 +++ linux-2.6.33/fs/jffs2/wbuf.c        2010-03-07 12:23:36.089622247 -0500
29542 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
29543  {
29544         .magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
29545         .nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
29546 -       .totlen = constant_cpu_to_je32(8)
29547 +       .totlen = constant_cpu_to_je32(8),
29548 +       .hdr_crc = constant_cpu_to_je32(0)
29549  };
29550
29551  /*
29552 diff -urNp linux-2.6.33/fs/lockd/svc.c linux-2.6.33/fs/lockd/svc.c
29553 --- linux-2.6.33/fs/lockd/svc.c 2010-02-24 13:52:17.000000000 -0500
29554 +++ linux-2.6.33/fs/lockd/svc.c 2010-03-07 12:23:36.089622247 -0500
29555 @@ -43,7 +43,7 @@
29556
29557  static struct svc_program      nlmsvc_program;
29558
29559 -struct nlmsvc_binding *                nlmsvc_ops;
29560 +const struct nlmsvc_binding *  nlmsvc_ops;
29561  EXPORT_SYMBOL_GPL(nlmsvc_ops);
29562
29563  static DEFINE_MUTEX(nlmsvc_mutex);
29564 diff -urNp linux-2.6.33/fs/locks.c linux-2.6.33/fs/locks.c
29565 --- linux-2.6.33/fs/locks.c     2010-02-24 13:52:17.000000000 -0500
29566 +++ linux-2.6.33/fs/locks.c     2010-03-07 12:23:36.089622247 -0500
29567 @@ -2007,16 +2007,16 @@ void locks_remove_flock(struct file *fil
29568                 return;
29569
29570         if (filp->f_op && filp->f_op->flock) {
29571 -               struct file_lock fl = {
29572 +               struct file_lock flock = {
29573                         .fl_pid = current->tgid,
29574                         .fl_file = filp,
29575                         .fl_flags = FL_FLOCK,
29576                         .fl_type = F_UNLCK,
29577                         .fl_end = OFFSET_MAX,
29578                 };
29579 -               filp->f_op->flock(filp, F_SETLKW, &fl);
29580 -               if (fl.fl_ops && fl.fl_ops->fl_release_private)
29581 -                       fl.fl_ops->fl_release_private(&fl);
29582 +               filp->f_op->flock(filp, F_SETLKW, &flock);
29583 +               if (flock.fl_ops && flock.fl_ops->fl_release_private)
29584 +                       flock.fl_ops->fl_release_private(&flock);
29585         }
29586
29587         lock_kernel();
29588 diff -urNp linux-2.6.33/fs/namei.c linux-2.6.33/fs/namei.c
29589 --- linux-2.6.33/fs/namei.c     2010-02-24 13:52:17.000000000 -0500
29590 +++ linux-2.6.33/fs/namei.c     2010-03-07 12:23:36.089622247 -0500
29591 @@ -565,7 +565,7 @@ static __always_inline int __do_follow_l
29592         cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
29593         error = PTR_ERR(cookie);
29594         if (!IS_ERR(cookie)) {
29595 -               char *s = nd_get_link(nd);
29596 +               const char *s = nd_get_link(nd);
29597                 error = 0;
29598                 if (s)
29599                         error = __vfs_follow_link(nd, s);
29600 @@ -599,6 +599,13 @@ static inline int do_follow_link(struct
29601         err = security_inode_follow_link(path->dentry, nd);
29602         if (err)
29603                 goto loop;
29604 +
29605 +       if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
29606 +                                 path->dentry->d_inode, path->dentry, nd->path.mnt)) {
29607 +               err = -EACCES;
29608 +               goto loop;
29609 +       }
29610 +
29611         current->link_count++;
29612         current->total_link_count++;
29613         nd->depth++;
29614 @@ -994,11 +1001,18 @@ return_reval:
29615                                 break;
29616                 }
29617  return_base:
29618 +               if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
29619 +                       path_put(&nd->path);
29620 +                       return -ENOENT;
29621 +               }
29622                 return 0;
29623  out_dput:
29624                 path_put_conditional(&next, nd);
29625                 break;
29626         }
29627 +       if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
29628 +               err = -ENOENT;
29629 +
29630         path_put(&nd->path);
29631  return_err:
29632         return err;
29633 @@ -1552,12 +1566,19 @@ static int __open_namei_create(struct na
29634         int error;
29635         struct dentry *dir = nd->path.dentry;
29636
29637 +       if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
29638 +               error = -EACCES;
29639 +               goto out_unlock;
29640 +       }
29641 +
29642         if (!IS_POSIXACL(dir->d_inode))
29643                 mode &= ~current_umask();
29644         error = security_path_mknod(&nd->path, path->dentry, mode, 0);
29645         if (error)
29646                 goto out_unlock;
29647         error = vfs_create(dir->d_inode, path->dentry, mode, nd);
29648 +       if (!error)
29649 +               gr_handle_create(path->dentry, nd->path.mnt);
29650  out_unlock:
29651         mutex_unlock(&dir->d_inode->i_mutex);
29652         dput(nd->path.dentry);
29653 @@ -1665,6 +1686,22 @@ struct file *do_filp_open(int dfd, const
29654                         release_open_intent(&nd);
29655                 if (error)
29656                         return ERR_PTR(error);
29657 +
29658 +               if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
29659 +                       error = -EPERM;
29660 +                       goto exit;
29661 +               }
29662 +
29663 +               if (gr_handle_rawio(nd.path.dentry->d_inode)) {
29664 +                       error = -EPERM;
29665 +                       goto exit;
29666 +               }
29667 +
29668 +               if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
29669 +                       error = -EACCES;
29670 +                       goto exit;
29671 +               }
29672 +
29673                 goto ok;
29674         }
29675
29676 @@ -1758,6 +1795,24 @@ do_last:
29677         /*
29678          * It already exists.
29679          */
29680 +
29681 +       if (gr_handle_rofs_blockwrite(path.dentry, nd.path.mnt, acc_mode)) {
29682 +               error = -EPERM;
29683 +               goto exit_mutex_unlock;
29684 +       }
29685 +       if (gr_handle_rawio(path.dentry->d_inode)) {
29686 +               error = -EPERM;
29687 +               goto exit_mutex_unlock;
29688 +       }
29689 +       if (!gr_acl_handle_open(path.dentry, nd.path.mnt, flag)) {
29690 +               error = -EACCES;
29691 +               goto exit_mutex_unlock;
29692 +       }
29693 +       if (gr_handle_fifo(path.dentry, nd.path.mnt, dir, flag, acc_mode)) {
29694 +               error = -EACCES;
29695 +               goto exit_mutex_unlock;
29696 +       }
29697 +
29698         mutex_unlock(&dir->d_inode->i_mutex);
29699         audit_inode(pathname, path.dentry);
29700
29701 @@ -1866,6 +1921,13 @@ do_link:
29702         error = security_inode_follow_link(path.dentry, &nd);
29703         if (error)
29704                 goto exit_dput;
29705 +
29706 +       if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
29707 +                                 path.dentry, nd.path.mnt)) {
29708 +               error = -EACCES;
29709 +               goto exit_dput;
29710 +       }
29711 +
29712         error = __do_follow_link(&path, &nd);
29713         path_put(&path);
29714         if (error) {
29715 @@ -2045,6 +2107,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
29716         error = may_mknod(mode);
29717         if (error)
29718                 goto out_dput;
29719 +
29720 +       if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
29721 +               error = -EPERM;
29722 +               goto out_dput;
29723 +       }
29724 +
29725 +       if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
29726 +               error = -EACCES;
29727 +               goto out_dput;
29728 +       }
29729 +
29730         error = mnt_want_write(nd.path.mnt);
29731         if (error)
29732                 goto out_dput;
29733 @@ -2065,6 +2138,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
29734         }
29735  out_drop_write:
29736         mnt_drop_write(nd.path.mnt);
29737 +
29738 +       if (!error)
29739 +               gr_handle_create(dentry, nd.path.mnt);
29740  out_dput:
29741         dput(dentry);
29742  out_unlock:
29743 @@ -2118,6 +2194,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
29744         if (IS_ERR(dentry))
29745                 goto out_unlock;
29746
29747 +       if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
29748 +               error = -EACCES;
29749 +               goto out_dput;
29750 +       }
29751 +
29752         if (!IS_POSIXACL(nd.path.dentry->d_inode))
29753                 mode &= ~current_umask();
29754         error = mnt_want_write(nd.path.mnt);
29755 @@ -2129,6 +2210,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
29756         error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
29757  out_drop_write:
29758         mnt_drop_write(nd.path.mnt);
29759 +
29760 +       if (!error)
29761 +               gr_handle_create(dentry, nd.path.mnt);
29762 +
29763  out_dput:
29764         dput(dentry);
29765  out_unlock:
29766 @@ -2210,6 +2295,8 @@ static long do_rmdir(int dfd, const char
29767         char * name;
29768         struct dentry *dentry;
29769         struct nameidata nd;
29770 +       ino_t saved_ino = 0;
29771 +       dev_t saved_dev = 0;
29772
29773         error = user_path_parent(dfd, pathname, &nd, &name);
29774         if (error)
29775 @@ -2234,6 +2321,19 @@ static long do_rmdir(int dfd, const char
29776         error = PTR_ERR(dentry);
29777         if (IS_ERR(dentry))
29778                 goto exit2;
29779 +
29780 +       if (dentry->d_inode != NULL) {
29781 +               if (dentry->d_inode->i_nlink <= 1) {
29782 +                       saved_ino = dentry->d_inode->i_ino;
29783 +                       saved_dev = dentry->d_inode->i_sb->s_dev;
29784 +               }
29785 +
29786 +               if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
29787 +                       error = -EACCES;
29788 +                       goto exit3;
29789 +               }
29790 +       }
29791 +
29792         error = mnt_want_write(nd.path.mnt);
29793         if (error)
29794                 goto exit3;
29795 @@ -2241,6 +2341,8 @@ static long do_rmdir(int dfd, const char
29796         if (error)
29797                 goto exit4;
29798         error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
29799 +       if (!error && (saved_dev || saved_ino))
29800 +               gr_handle_delete(saved_ino, saved_dev);
29801  exit4:
29802         mnt_drop_write(nd.path.mnt);
29803  exit3:
29804 @@ -2302,6 +2404,8 @@ static long do_unlinkat(int dfd, const c
29805         struct dentry *dentry;
29806         struct nameidata nd;
29807         struct inode *inode = NULL;
29808 +       ino_t saved_ino = 0;
29809 +       dev_t saved_dev = 0;
29810
29811         error = user_path_parent(dfd, pathname, &nd, &name);
29812         if (error)
29813 @@ -2321,8 +2425,19 @@ static long do_unlinkat(int dfd, const c
29814                 if (nd.last.name[nd.last.len])
29815                         goto slashes;
29816                 inode = dentry->d_inode;
29817 -               if (inode)
29818 +               if (inode) {
29819 +                       if (inode->i_nlink <= 1) {
29820 +                               saved_ino = inode->i_ino;
29821 +                               saved_dev = inode->i_sb->s_dev;
29822 +                       }
29823 +
29824                         atomic_inc(&inode->i_count);
29825 +
29826 +                       if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
29827 +                               error = -EACCES;
29828 +                               goto exit2;
29829 +                       }
29830 +               }
29831                 error = mnt_want_write(nd.path.mnt);
29832                 if (error)
29833                         goto exit2;
29834 @@ -2330,6 +2445,8 @@ static long do_unlinkat(int dfd, const c
29835                 if (error)
29836                         goto exit3;
29837                 error = vfs_unlink(nd.path.dentry->d_inode, dentry);
29838 +               if (!error && (saved_ino || saved_dev))
29839 +                       gr_handle_delete(saved_ino, saved_dev);
29840  exit3:
29841                 mnt_drop_write(nd.path.mnt);
29842         exit2:
29843 @@ -2408,6 +2525,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
29844         if (IS_ERR(dentry))
29845                 goto out_unlock;
29846
29847 +       if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
29848 +               error = -EACCES;
29849 +               goto out_dput;
29850 +       }
29851 +
29852         error = mnt_want_write(nd.path.mnt);
29853         if (error)
29854                 goto out_dput;
29855 @@ -2415,6 +2537,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
29856         if (error)
29857                 goto out_drop_write;
29858         error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
29859 +       if (!error)
29860 +               gr_handle_create(dentry, nd.path.mnt);
29861  out_drop_write:
29862         mnt_drop_write(nd.path.mnt);
29863  out_dput:
29864 @@ -2508,6 +2632,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
29865         error = PTR_ERR(new_dentry);
29866         if (IS_ERR(new_dentry))
29867                 goto out_unlock;
29868 +
29869 +       if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
29870 +                              old_path.dentry->d_inode,
29871 +                              old_path.dentry->d_inode->i_mode, to)) {
29872 +               error = -EACCES;
29873 +               goto out_dput;
29874 +       }
29875 +
29876 +       if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
29877 +                               old_path.dentry, old_path.mnt, to)) {
29878 +               error = -EACCES;
29879 +               goto out_dput;
29880 +       }
29881 +
29882         error = mnt_want_write(nd.path.mnt);
29883         if (error)
29884                 goto out_dput;
29885 @@ -2515,6 +2653,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
29886         if (error)
29887                 goto out_drop_write;
29888         error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
29889 +       if (!error)
29890 +               gr_handle_create(new_dentry, nd.path.mnt);
29891  out_drop_write:
29892         mnt_drop_write(nd.path.mnt);
29893  out_dput:
29894 @@ -2748,6 +2888,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
29895         if (new_dentry == trap)
29896                 goto exit5;
29897
29898 +       error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
29899 +                                    old_dentry, old_dir->d_inode, oldnd.path.mnt,
29900 +                                    to);
29901 +       if (error)
29902 +               goto exit5;
29903 +
29904         error = mnt_want_write(oldnd.path.mnt);
29905         if (error)
29906                 goto exit5;
29907 @@ -2757,6 +2903,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
29908                 goto exit6;
29909         error = vfs_rename(old_dir->d_inode, old_dentry,
29910                                    new_dir->d_inode, new_dentry);
29911 +       if (!error)
29912 +               gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
29913 +                                new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
29914  exit6:
29915         mnt_drop_write(oldnd.path.mnt);
29916  exit5:
29917 diff -urNp linux-2.6.33/fs/namespace.c linux-2.6.33/fs/namespace.c
29918 --- linux-2.6.33/fs/namespace.c 2010-02-24 13:52:17.000000000 -0500
29919 +++ linux-2.6.33/fs/namespace.c 2010-03-07 12:23:36.089622247 -0500
29920 @@ -1085,6 +1085,9 @@ static int do_umount(struct vfsmount *mn
29921                 if (!(sb->s_flags & MS_RDONLY))
29922                         retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
29923                 up_write(&sb->s_umount);
29924 +
29925 +               gr_log_remount(mnt->mnt_devname, retval);
29926 +
29927                 return retval;
29928         }
29929
29930 @@ -1106,6 +1109,9 @@ static int do_umount(struct vfsmount *mn
29931                 security_sb_umount_busy(mnt);
29932         up_write(&namespace_sem);
29933         release_mounts(&umount_list);
29934 +
29935 +       gr_log_unmount(mnt->mnt_devname, retval);
29936 +
29937         return retval;
29938  }
29939
29940 @@ -1963,6 +1969,16 @@ long do_mount(char *dev_name, char *dir_
29941                    MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
29942                    MS_STRICTATIME);
29943
29944 +       if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
29945 +               retval = -EPERM;
29946 +               goto dput_out;
29947 +       }
29948 +
29949 +       if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
29950 +               retval = -EPERM;
29951 +               goto dput_out;
29952 +       }
29953 +
29954         if (flags & MS_REMOUNT)
29955                 retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
29956                                     data_page);
29957 @@ -1977,6 +1993,9 @@ long do_mount(char *dev_name, char *dir_
29958                                       dev_name, data_page);
29959  dput_out:
29960         path_put(&path);
29961 +
29962 +       gr_log_mount(dev_name, dir_name, retval);
29963 +
29964         return retval;
29965  }
29966
29967 @@ -2183,6 +2202,12 @@ SYSCALL_DEFINE2(pivot_root, const char _
29968                 goto out1;
29969         }
29970
29971 +       if (gr_handle_chroot_pivot()) {
29972 +               error = -EPERM;
29973 +               path_put(&old);
29974 +               goto out1;
29975 +       }
29976 +
29977         read_lock(&current->fs->lock);
29978         root = current->fs->root;
29979         path_get(&current->fs->root);
29980 diff -urNp linux-2.6.33/fs/nfs/inode.c linux-2.6.33/fs/nfs/inode.c
29981 --- linux-2.6.33/fs/nfs/inode.c 2010-02-24 13:52:17.000000000 -0500
29982 +++ linux-2.6.33/fs/nfs/inode.c 2010-03-07 12:23:36.089622247 -0500
29983 @@ -965,16 +965,16 @@ static int nfs_size_need_update(const st
29984         return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
29985  }
29986
29987 -static atomic_long_t nfs_attr_generation_counter;
29988 +static atomic_long_unchecked_t nfs_attr_generation_counter;
29989
29990  static unsigned long nfs_read_attr_generation_counter(void)
29991  {
29992 -       return atomic_long_read(&nfs_attr_generation_counter);
29993 +       return atomic_long_read_unchecked(&nfs_attr_generation_counter);
29994  }
29995
29996  unsigned long nfs_inc_attr_generation_counter(void)
29997  {
29998 -       return atomic_long_inc_return(&nfs_attr_generation_counter);
29999 +       return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
30000  }
30001
30002  void nfs_fattr_init(struct nfs_fattr *fattr)
30003 diff -urNp linux-2.6.33/fs/nfs/nfs4proc.c linux-2.6.33/fs/nfs/nfs4proc.c
30004 --- linux-2.6.33/fs/nfs/nfs4proc.c      2010-02-24 13:52:17.000000000 -0500
30005 +++ linux-2.6.33/fs/nfs/nfs4proc.c      2010-03-07 12:23:36.089622247 -0500
30006 @@ -1159,7 +1159,7 @@ static int _nfs4_do_open_reclaim(struct
30007  static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
30008  {
30009         struct nfs_server *server = NFS_SERVER(state->inode);
30010 -       struct nfs4_exception exception = { };
30011 +       struct nfs4_exception exception = {0, 0};
30012         int err;
30013         do {
30014                 err = _nfs4_do_open_reclaim(ctx, state);
30015 @@ -1201,7 +1201,7 @@ static int _nfs4_open_delegation_recall(
30016
30017  int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
30018  {
30019 -       struct nfs4_exception exception = { };
30020 +       struct nfs4_exception exception = {0, 0};
30021         struct nfs_server *server = NFS_SERVER(state->inode);
30022         int err;
30023         do {
30024 @@ -1572,7 +1572,7 @@ static int _nfs4_open_expired(struct nfs
30025  static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
30026  {
30027         struct nfs_server *server = NFS_SERVER(state->inode);
30028 -       struct nfs4_exception exception = { };
30029 +       struct nfs4_exception exception = {0, 0};
30030         int err;
30031
30032         do {
30033 @@ -1678,7 +1678,7 @@ out_err:
30034
30035  static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
30036  {
30037 -       struct nfs4_exception exception = { };
30038 +       struct nfs4_exception exception = {0, 0};
30039         struct nfs4_state *res;
30040         int status;
30041
30042 @@ -1769,7 +1769,7 @@ static int nfs4_do_setattr(struct inode
30043                            struct nfs4_state *state)
30044  {
30045         struct nfs_server *server = NFS_SERVER(inode);
30046 -       struct nfs4_exception exception = { };
30047 +       struct nfs4_exception exception = {0, 0};
30048         int err;
30049         do {
30050                 err = nfs4_handle_exception(server,
30051 @@ -2146,7 +2146,7 @@ static int _nfs4_server_capabilities(str
30052
30053  int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
30054  {
30055 -       struct nfs4_exception exception = { };
30056 +       struct nfs4_exception exception = {0, 0};
30057         int err;
30058         do {
30059                 err = nfs4_handle_exception(server,
30060 @@ -2180,7 +2180,7 @@ static int _nfs4_lookup_root(struct nfs_
30061  static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
30062                 struct nfs_fsinfo *info)
30063  {
30064 -       struct nfs4_exception exception = { };
30065 +       struct nfs4_exception exception = {0, 0};
30066         int err;
30067         do {
30068                 err = nfs4_handle_exception(server,
30069 @@ -2269,7 +2269,7 @@ static int _nfs4_proc_getattr(struct nfs
30070
30071  static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
30072  {
30073 -       struct nfs4_exception exception = { };
30074 +       struct nfs4_exception exception = {0, 0};
30075         int err;
30076         do {
30077                 err = nfs4_handle_exception(server,
30078 @@ -2357,7 +2357,7 @@ static int nfs4_proc_lookupfh(struct nfs
30079                               struct qstr *name, struct nfs_fh *fhandle,
30080                               struct nfs_fattr *fattr)
30081  {
30082 -       struct nfs4_exception exception = { };
30083 +       struct nfs4_exception exception = {0, 0};
30084         int err;
30085         do {
30086                 err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
30087 @@ -2386,7 +2386,7 @@ static int _nfs4_proc_lookup(struct inod
30088
30089  static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
30090  {
30091 -       struct nfs4_exception exception = { };
30092 +       struct nfs4_exception exception = {0, 0};
30093         int err;
30094         do {
30095                 err = nfs4_handle_exception(NFS_SERVER(dir),
30096 @@ -2450,7 +2450,7 @@ static int _nfs4_proc_access(struct inod
30097
30098  static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
30099  {
30100 -       struct nfs4_exception exception = { };
30101 +       struct nfs4_exception exception = {0, 0};
30102         int err;
30103         do {
30104                 err = nfs4_handle_exception(NFS_SERVER(inode),
30105 @@ -2506,7 +2506,7 @@ static int _nfs4_proc_readlink(struct in
30106  static int nfs4_proc_readlink(struct inode *inode, struct page *page,
30107                 unsigned int pgbase, unsigned int pglen)
30108  {
30109 -       struct nfs4_exception exception = { };
30110 +       struct nfs4_exception exception = {0, 0};
30111         int err;
30112         do {
30113                 err = nfs4_handle_exception(NFS_SERVER(inode),
30114 @@ -2604,7 +2604,7 @@ static int _nfs4_proc_remove(struct inod
30115
30116  static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
30117  {
30118 -       struct nfs4_exception exception = { };
30119 +       struct nfs4_exception exception = {0, 0};
30120         int err;
30121         do {
30122                 err = nfs4_handle_exception(NFS_SERVER(dir),
30123 @@ -2677,7 +2677,7 @@ static int _nfs4_proc_rename(struct inod
30124  static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
30125                 struct inode *new_dir, struct qstr *new_name)
30126  {
30127 -       struct nfs4_exception exception = { };
30128 +       struct nfs4_exception exception = {0, 0};
30129         int err;
30130         do {
30131                 err = nfs4_handle_exception(NFS_SERVER(old_dir),
30132 @@ -2724,7 +2724,7 @@ static int _nfs4_proc_link(struct inode
30133
30134  static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
30135  {
30136 -       struct nfs4_exception exception = { };
30137 +       struct nfs4_exception exception = {0, 0};
30138         int err;
30139         do {
30140                 err = nfs4_handle_exception(NFS_SERVER(inode),
30141 @@ -2816,7 +2816,7 @@ out:
30142  static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
30143                 struct page *page, unsigned int len, struct iattr *sattr)
30144  {
30145 -       struct nfs4_exception exception = { };
30146 +       struct nfs4_exception exception = {0, 0};
30147         int err;
30148         do {
30149                 err = nfs4_handle_exception(NFS_SERVER(dir),
30150 @@ -2847,7 +2847,7 @@ out:
30151  static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
30152                 struct iattr *sattr)
30153  {
30154 -       struct nfs4_exception exception = { };
30155 +       struct nfs4_exception exception = {0, 0};
30156         int err;
30157         do {
30158                 err = nfs4_handle_exception(NFS_SERVER(dir),
30159 @@ -2896,7 +2896,7 @@ static int _nfs4_proc_readdir(struct den
30160  static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
30161                    u64 cookie, struct page *page, unsigned int count, int plus)
30162  {
30163 -       struct nfs4_exception exception = { };
30164 +       struct nfs4_exception exception = {0, 0};
30165         int err;
30166         do {
30167                 err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
30168 @@ -2944,7 +2944,7 @@ out:
30169  static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
30170                 struct iattr *sattr, dev_t rdev)
30171  {
30172 -       struct nfs4_exception exception = { };
30173 +       struct nfs4_exception exception = {0, 0};
30174         int err;
30175         do {
30176                 err = nfs4_handle_exception(NFS_SERVER(dir),
30177 @@ -2976,7 +2976,7 @@ static int _nfs4_proc_statfs(struct nfs_
30178
30179  static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
30180  {
30181 -       struct nfs4_exception exception = { };
30182 +       struct nfs4_exception exception = {0, 0};
30183         int err;
30184         do {
30185                 err = nfs4_handle_exception(server,
30186 @@ -3007,7 +3007,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
30187
30188  static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
30189  {
30190 -       struct nfs4_exception exception = { };
30191 +       struct nfs4_exception exception = {0, 0};
30192         int err;
30193
30194         do {
30195 @@ -3053,7 +3053,7 @@ static int _nfs4_proc_pathconf(struct nf
30196  static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
30197                 struct nfs_pathconf *pathconf)
30198  {
30199 -       struct nfs4_exception exception = { };
30200 +       struct nfs4_exception exception = {0, 0};
30201         int err;
30202
30203         do {
30204 @@ -3348,7 +3348,7 @@ out_free:
30205
30206  static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
30207  {
30208 -       struct nfs4_exception exception = { };
30209 +       struct nfs4_exception exception = {0, 0};
30210         ssize_t ret;
30211         do {
30212                 ret = __nfs4_get_acl_uncached(inode, buf, buflen);
30213 @@ -3404,7 +3404,7 @@ static int __nfs4_proc_set_acl(struct in
30214
30215  static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
30216  {
30217 -       struct nfs4_exception exception = { };
30218 +       struct nfs4_exception exception = {0, 0};
30219         int err;
30220         do {
30221                 err = nfs4_handle_exception(NFS_SERVER(inode),
30222 @@ -3686,7 +3686,7 @@ out:
30223  int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
30224  {
30225         struct nfs_server *server = NFS_SERVER(inode);
30226 -       struct nfs4_exception exception = { };
30227 +       struct nfs4_exception exception = {0, 0};
30228         int err;
30229         do {
30230                 err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
30231 @@ -3759,7 +3759,7 @@ out:
30232
30233  static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
30234  {
30235 -       struct nfs4_exception exception = { };
30236 +       struct nfs4_exception exception = {0, 0};
30237         int err;
30238
30239         do {
30240 @@ -4171,7 +4171,7 @@ static int _nfs4_do_setlk(struct nfs4_st
30241  static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
30242  {
30243         struct nfs_server *server = NFS_SERVER(state->inode);
30244 -       struct nfs4_exception exception = { };
30245 +       struct nfs4_exception exception = {0, 0};
30246         int err;
30247
30248         do {
30249 @@ -4189,7 +4189,7 @@ static int nfs4_lock_reclaim(struct nfs4
30250  static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
30251  {
30252         struct nfs_server *server = NFS_SERVER(state->inode);
30253 -       struct nfs4_exception exception = { };
30254 +       struct nfs4_exception exception = {0, 0};
30255         int err;
30256
30257         err = nfs4_set_lock_state(state, request);
30258 @@ -4253,7 +4253,7 @@ out:
30259
30260  static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
30261  {
30262 -       struct nfs4_exception exception = { };
30263 +       struct nfs4_exception exception = {0, 0};
30264         int err;
30265
30266         do {
30267 @@ -4313,7 +4313,7 @@ nfs4_proc_lock(struct file *filp, int cm
30268  int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
30269  {
30270         struct nfs_server *server = NFS_SERVER(state->inode);
30271 -       struct nfs4_exception exception = { };
30272 +       struct nfs4_exception exception = {0, 0};
30273         int err;
30274
30275         err = nfs4_set_lock_state(state, fl);
30276 diff -urNp linux-2.6.33/fs/nfsd/lockd.c linux-2.6.33/fs/nfsd/lockd.c
30277 --- linux-2.6.33/fs/nfsd/lockd.c        2010-02-24 13:52:17.000000000 -0500
30278 +++ linux-2.6.33/fs/nfsd/lockd.c        2010-03-07 12:23:36.089622247 -0500
30279 @@ -61,7 +61,7 @@ nlm_fclose(struct file *filp)
30280         fput(filp);
30281  }
30282
30283 -static struct nlmsvc_binding   nfsd_nlm_ops = {
30284 +static const struct nlmsvc_binding     nfsd_nlm_ops = {
30285         .fopen          = nlm_fopen,            /* open file for locking */
30286         .fclose         = nlm_fclose,           /* close file */
30287  };
30288 diff -urNp linux-2.6.33/fs/nfsd/nfsctl.c linux-2.6.33/fs/nfsd/nfsctl.c
30289 --- linux-2.6.33/fs/nfsd/nfsctl.c       2010-02-24 13:52:17.000000000 -0500
30290 +++ linux-2.6.33/fs/nfsd/nfsctl.c       2010-03-07 12:23:36.093718866 -0500
30291 @@ -159,7 +159,7 @@ static int export_features_open(struct i
30292         return single_open(file, export_features_show, NULL);
30293  }
30294
30295 -static struct file_operations export_features_operations = {
30296 +static const struct file_operations export_features_operations = {
30297         .open           = export_features_open,
30298         .read           = seq_read,
30299         .llseek         = seq_lseek,
30300 diff -urNp linux-2.6.33/fs/nfsd/vfs.c linux-2.6.33/fs/nfsd/vfs.c
30301 --- linux-2.6.33/fs/nfsd/vfs.c  2010-02-24 13:52:17.000000000 -0500
30302 +++ linux-2.6.33/fs/nfsd/vfs.c  2010-03-07 12:23:36.093718866 -0500
30303 @@ -945,7 +945,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
30304         } else {
30305                 oldfs = get_fs();
30306                 set_fs(KERNEL_DS);
30307 -               host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
30308 +               host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
30309                 set_fs(oldfs);
30310         }
30311
30312 @@ -1068,7 +1068,7 @@ nfsd_vfs_write(struct svc_rqst *rqstp, s
30313
30314         /* Write the data. */
30315         oldfs = get_fs(); set_fs(KERNEL_DS);
30316 -       host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
30317 +       host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
30318         set_fs(oldfs);
30319         if (host_err < 0)
30320                 goto out_nfserr;
30321 @@ -1543,7 +1543,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
30322          */
30323
30324         oldfs = get_fs(); set_fs(KERNEL_DS);
30325 -       host_err = inode->i_op->readlink(dentry, buf, *lenp);
30326 +       host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
30327         set_fs(oldfs);
30328
30329         if (host_err < 0)
30330 diff -urNp linux-2.6.33/fs/nls/nls_base.c linux-2.6.33/fs/nls/nls_base.c
30331 --- linux-2.6.33/fs/nls/nls_base.c      2010-02-24 13:52:17.000000000 -0500
30332 +++ linux-2.6.33/fs/nls/nls_base.c      2010-03-07 12:23:36.093718866 -0500
30333 @@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
30334      {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
30335      {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
30336      {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
30337 -    {0,                                                       /* end of table    */}
30338 +    {0, 0, 0, 0, 0,                                   /* end of table    */}
30339  };
30340
30341  #define UNICODE_MAX    0x0010ffff
30342 diff -urNp linux-2.6.33/fs/ntfs/file.c linux-2.6.33/fs/ntfs/file.c
30343 --- linux-2.6.33/fs/ntfs/file.c 2010-02-24 13:52:17.000000000 -0500
30344 +++ linux-2.6.33/fs/ntfs/file.c 2010-03-07 12:23:36.093718866 -0500
30345 @@ -2243,6 +2243,6 @@ const struct inode_operations ntfs_file_
30346  #endif /* NTFS_RW */
30347  };
30348
30349 -const struct file_operations ntfs_empty_file_ops = {};
30350 +const struct file_operations ntfs_empty_file_ops __read_only;
30351
30352 -const struct inode_operations ntfs_empty_inode_ops = {};
30353 +const struct inode_operations ntfs_empty_inode_ops __read_only;
30354 diff -urNp linux-2.6.33/fs/ocfs2/cluster/masklog.c linux-2.6.33/fs/ocfs2/cluster/masklog.c
30355 --- linux-2.6.33/fs/ocfs2/cluster/masklog.c     2010-02-24 13:52:17.000000000 -0500
30356 +++ linux-2.6.33/fs/ocfs2/cluster/masklog.c     2010-03-07 12:23:36.093718866 -0500
30357 @@ -135,7 +135,7 @@ static ssize_t mlog_store(struct kobject
30358         return mlog_mask_store(mlog_attr->mask, buf, count);
30359  }
30360
30361 -static struct sysfs_ops mlog_attr_ops = {
30362 +static const struct sysfs_ops mlog_attr_ops = {
30363         .show  = mlog_show,
30364         .store = mlog_store,
30365  };
30366 diff -urNp linux-2.6.33/fs/ocfs2/localalloc.c linux-2.6.33/fs/ocfs2/localalloc.c
30367 --- linux-2.6.33/fs/ocfs2/localalloc.c  2010-02-24 13:52:17.000000000 -0500
30368 +++ linux-2.6.33/fs/ocfs2/localalloc.c  2010-03-07 12:23:36.093718866 -0500
30369 @@ -1188,7 +1188,7 @@ static int ocfs2_local_alloc_slide_windo
30370                 goto bail;
30371         }
30372
30373 -       atomic_inc(&osb->alloc_stats.moves);
30374 +       atomic_inc_unchecked(&osb->alloc_stats.moves);
30375
30376         status = 0;
30377  bail:
30378 diff -urNp linux-2.6.33/fs/ocfs2/ocfs2.h linux-2.6.33/fs/ocfs2/ocfs2.h
30379 --- linux-2.6.33/fs/ocfs2/ocfs2.h       2010-02-24 13:52:17.000000000 -0500
30380 +++ linux-2.6.33/fs/ocfs2/ocfs2.h       2010-03-07 12:23:36.093718866 -0500
30381 @@ -221,11 +221,11 @@ enum ocfs2_vol_state
30382
30383  struct ocfs2_alloc_stats
30384  {
30385 -       atomic_t moves;
30386 -       atomic_t local_data;
30387 -       atomic_t bitmap_data;
30388 -       atomic_t bg_allocs;
30389 -       atomic_t bg_extends;
30390 +       atomic_unchecked_t moves;
30391 +       atomic_unchecked_t local_data;
30392 +       atomic_unchecked_t bitmap_data;
30393 +       atomic_unchecked_t bg_allocs;
30394 +       atomic_unchecked_t bg_extends;
30395  };
30396
30397  enum ocfs2_local_alloc_state
30398 diff -urNp linux-2.6.33/fs/ocfs2/suballoc.c linux-2.6.33/fs/ocfs2/suballoc.c
30399 --- linux-2.6.33/fs/ocfs2/suballoc.c    2010-02-24 13:52:17.000000000 -0500
30400 +++ linux-2.6.33/fs/ocfs2/suballoc.c    2010-03-07 12:23:36.093718866 -0500
30401 @@ -620,7 +620,7 @@ static int ocfs2_reserve_suballoc_bits(s
30402                                 mlog_errno(status);
30403                         goto bail;
30404                 }
30405 -               atomic_inc(&osb->alloc_stats.bg_extends);
30406 +               atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
30407
30408                 /* You should never ask for this much metadata */
30409                 BUG_ON(bits_wanted >
30410 @@ -1651,7 +1651,7 @@ int ocfs2_claim_metadata(struct ocfs2_su
30411                 mlog_errno(status);
30412                 goto bail;
30413         }
30414 -       atomic_inc(&osb->alloc_stats.bg_allocs);
30415 +       atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
30416
30417         *blkno_start = bg_blkno + (u64) *suballoc_bit_start;
30418         ac->ac_bits_given += (*num_bits);
30419 @@ -1725,7 +1725,7 @@ int ocfs2_claim_new_inode(struct ocfs2_s
30420                 mlog_errno(status);
30421                 goto bail;
30422         }
30423 -       atomic_inc(&osb->alloc_stats.bg_allocs);
30424 +       atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
30425
30426         BUG_ON(num_bits != 1);
30427
30428 @@ -1827,7 +1827,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
30429                                                       cluster_start,
30430                                                       num_clusters);
30431                 if (!status)
30432 -                       atomic_inc(&osb->alloc_stats.local_data);
30433 +                       atomic_inc_unchecked(&osb->alloc_stats.local_data);
30434         } else {
30435                 if (min_clusters > (osb->bitmap_cpg - 1)) {
30436                         /* The only paths asking for contiguousness
30437 @@ -1855,7 +1855,7 @@ int __ocfs2_claim_clusters(struct ocfs2_
30438                                 ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
30439                                                                  bg_blkno,
30440                                                                  bg_bit_off);
30441 -                       atomic_inc(&osb->alloc_stats.bitmap_data);
30442 +                       atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
30443                 }
30444         }
30445         if (status < 0) {
30446 diff -urNp linux-2.6.33/fs/ocfs2/super.c linux-2.6.33/fs/ocfs2/super.c
30447 --- linux-2.6.33/fs/ocfs2/super.c       2010-02-24 13:52:17.000000000 -0500
30448 +++ linux-2.6.33/fs/ocfs2/super.c       2010-03-07 12:23:36.093718866 -0500
30449 @@ -286,11 +286,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
30450                         "%10s => GlobalAllocs: %d  LocalAllocs: %d  "
30451                         "SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
30452                         "Stats",
30453 -                       atomic_read(&osb->alloc_stats.bitmap_data),
30454 -                       atomic_read(&osb->alloc_stats.local_data),
30455 -                       atomic_read(&osb->alloc_stats.bg_allocs),
30456 -                       atomic_read(&osb->alloc_stats.moves),
30457 -                       atomic_read(&osb->alloc_stats.bg_extends));
30458 +                       atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
30459 +                       atomic_read_unchecked(&osb->alloc_stats.local_data),
30460 +                       atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
30461 +                       atomic_read_unchecked(&osb->alloc_stats.moves),
30462 +                       atomic_read_unchecked(&osb->alloc_stats.bg_extends));
30463
30464         out += snprintf(buf + out, len - out,
30465                         "%10s => State: %u  Descriptor: %llu  Size: %u bits  "
30466 @@ -1999,11 +1999,11 @@ static int ocfs2_initialize_super(struct
30467         spin_lock_init(&osb->osb_xattr_lock);
30468         ocfs2_init_inode_steal_slot(osb);
30469
30470 -       atomic_set(&osb->alloc_stats.moves, 0);
30471 -       atomic_set(&osb->alloc_stats.local_data, 0);
30472 -       atomic_set(&osb->alloc_stats.bitmap_data, 0);
30473 -       atomic_set(&osb->alloc_stats.bg_allocs, 0);
30474 -       atomic_set(&osb->alloc_stats.bg_extends, 0);
30475 +       atomic_set_unchecked(&osb->alloc_stats.moves, 0);
30476 +       atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
30477 +       atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
30478 +       atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
30479 +       atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
30480
30481         /* Copy the blockcheck stats from the superblock probe */
30482         osb->osb_ecc_stats = *stats;
30483 diff -urNp linux-2.6.33/fs/ocfs2/symlink.c linux-2.6.33/fs/ocfs2/symlink.c
30484 --- linux-2.6.33/fs/ocfs2/symlink.c     2010-02-24 13:52:17.000000000 -0500
30485 +++ linux-2.6.33/fs/ocfs2/symlink.c     2010-03-07 12:23:36.093718866 -0500
30486 @@ -148,7 +148,7 @@ bail:
30487
30488  static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
30489  {
30490 -       char *link = nd_get_link(nd);
30491 +       const char *link = nd_get_link(nd);
30492         if (!IS_ERR(link))
30493                 kfree(link);
30494  }
30495 diff -urNp linux-2.6.33/fs/open.c linux-2.6.33/fs/open.c
30496 --- linux-2.6.33/fs/open.c      2010-02-24 13:52:17.000000000 -0500
30497 +++ linux-2.6.33/fs/open.c      2010-03-07 12:23:36.093718866 -0500
30498 @@ -209,6 +209,9 @@ int do_truncate(struct dentry *dentry, l
30499         if (length < 0)
30500                 return -EINVAL;
30501
30502 +       if (filp && !gr_acl_handle_truncate(dentry, filp->f_path.mnt))
30503 +               return -EACCES;
30504 +
30505         newattrs.ia_size = length;
30506         newattrs.ia_valid = ATTR_SIZE | time_attrs;
30507         if (filp) {
30508 @@ -514,6 +517,9 @@ SYSCALL_DEFINE3(faccessat, int, dfd, con
30509         if (__mnt_is_readonly(path.mnt))
30510                 res = -EROFS;
30511
30512 +       if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
30513 +               res = -EACCES;
30514 +
30515  out_path_release:
30516         path_put(&path);
30517  out:
30518 @@ -540,6 +546,8 @@ SYSCALL_DEFINE1(chdir, const char __user
30519         if (error)
30520                 goto dput_and_out;
30521
30522 +       gr_log_chdir(path.dentry, path.mnt);
30523 +
30524         set_fs_pwd(current->fs, &path);
30525
30526  dput_and_out:
30527 @@ -566,6 +574,13 @@ SYSCALL_DEFINE1(fchdir, unsigned int, fd
30528                 goto out_putf;
30529
30530         error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
30531 +
30532 +       if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
30533 +               error = -EPERM;
30534 +
30535 +       if (!error)
30536 +               gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
30537 +
30538         if (!error)
30539                 set_fs_pwd(current->fs, &file->f_path);
30540  out_putf:
30541 @@ -594,7 +609,18 @@ SYSCALL_DEFINE1(chroot, const char __use
30542         if (error)
30543                 goto dput_and_out;
30544
30545 +       if (gr_handle_chroot_chroot(path.dentry, path.mnt))
30546 +               goto dput_and_out;
30547 +
30548 +       if (gr_handle_chroot_caps(&path)) {
30549 +               error = -ENOMEM;
30550 +               goto dput_and_out;
30551 +       }
30552 +
30553         set_fs_root(current->fs, &path);
30554 +
30555 +       gr_handle_chroot_chdir(&path);
30556 +
30557         error = 0;
30558  dput_and_out:
30559         path_put(&path);
30560 @@ -622,6 +648,12 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
30561         err = mnt_want_write_file(file);
30562         if (err)
30563                 goto out_putf;
30564 +
30565 +       if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
30566 +               err = -EACCES;
30567 +               goto out_drop_write;
30568 +       }
30569 +
30570         mutex_lock(&inode->i_mutex);
30571         err = security_path_chmod(dentry, file->f_vfsmnt, mode);
30572         if (err)
30573 @@ -633,6 +665,7 @@ SYSCALL_DEFINE2(fchmod, unsigned int, fd
30574         err = notify_change(dentry, &newattrs);
30575  out_unlock:
30576         mutex_unlock(&inode->i_mutex);
30577 +out_drop_write:
30578         mnt_drop_write(file->f_path.mnt);
30579  out_putf:
30580         fput(file);
30581 @@ -655,17 +688,30 @@ SYSCALL_DEFINE3(fchmodat, int, dfd, cons
30582         error = mnt_want_write(path.mnt);
30583         if (error)
30584                 goto dput_and_out;
30585 +
30586 +       if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
30587 +               error = -EACCES;
30588 +               goto out_drop_write;
30589 +       }
30590 +
30591         mutex_lock(&inode->i_mutex);
30592         error = security_path_chmod(path.dentry, path.mnt, mode);
30593         if (error)
30594                 goto out_unlock;
30595         if (mode == (mode_t) -1)
30596                 mode = inode->i_mode;
30597 +
30598 +       if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
30599 +               error = -EACCES;
30600 +               goto out_unlock;
30601 +       }
30602 +
30603         newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
30604         newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
30605         error = notify_change(path.dentry, &newattrs);
30606  out_unlock:
30607         mutex_unlock(&inode->i_mutex);
30608 +out_drop_write:
30609         mnt_drop_write(path.mnt);
30610  dput_and_out:
30611         path_put(&path);
30612 @@ -684,6 +730,9 @@ static int chown_common(struct path *pat
30613         int error;
30614         struct iattr newattrs;
30615
30616 +       if (!gr_acl_handle_chown(path->dentry, path->mnt))
30617 +               return -EACCES;
30618 +
30619         newattrs.ia_valid =  ATTR_CTIME;
30620         if (user != (uid_t) -1) {
30621                 newattrs.ia_valid |= ATTR_UID;
30622 diff -urNp linux-2.6.33/fs/pipe.c linux-2.6.33/fs/pipe.c
30623 --- linux-2.6.33/fs/pipe.c      2010-02-24 13:52:17.000000000 -0500
30624 +++ linux-2.6.33/fs/pipe.c      2010-03-07 12:23:36.097602735 -0500
30625 @@ -401,9 +401,9 @@ redo:
30626                 }
30627                 if (bufs)       /* More to do? */
30628                         continue;
30629 -               if (!pipe->writers)
30630 +               if (!atomic_read(&pipe->writers))
30631                         break;
30632 -               if (!pipe->waiting_writers) {
30633 +               if (!atomic_read(&pipe->waiting_writers)) {
30634                         /* syscall merging: Usually we must not sleep
30635                          * if O_NONBLOCK is set, or if we got some data.
30636                          * But if a writer sleeps in kernel space, then
30637 @@ -462,7 +462,7 @@ pipe_write(struct kiocb *iocb, const str
30638         mutex_lock(&inode->i_mutex);
30639         pipe = inode->i_pipe;
30640
30641 -       if (!pipe->readers) {
30642 +       if (!atomic_read(&pipe->readers)) {
30643                 send_sig(SIGPIPE, current, 0);
30644                 ret = -EPIPE;
30645                 goto out;
30646 @@ -511,7 +511,7 @@ redo1:
30647         for (;;) {
30648                 int bufs;
30649
30650 -               if (!pipe->readers) {
30651 +               if (!atomic_read(&pipe->readers)) {
30652                         send_sig(SIGPIPE, current, 0);
30653                         if (!ret)
30654                                 ret = -EPIPE;
30655 @@ -597,9 +597,9 @@ redo2:
30656                         kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
30657                         do_wakeup = 0;
30658                 }
30659 -               pipe->waiting_writers++;
30660 +               atomic_inc(&pipe->waiting_writers);
30661                 pipe_wait(pipe);
30662 -               pipe->waiting_writers--;
30663 +               atomic_dec(&pipe->waiting_writers);
30664         }
30665  out:
30666         mutex_unlock(&inode->i_mutex);
30667 @@ -666,7 +666,7 @@ pipe_poll(struct file *filp, poll_table
30668         mask = 0;
30669         if (filp->f_mode & FMODE_READ) {
30670                 mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
30671 -               if (!pipe->writers && filp->f_version != pipe->w_counter)
30672 +               if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
30673                         mask |= POLLHUP;
30674         }
30675
30676 @@ -676,7 +676,7 @@ pipe_poll(struct file *filp, poll_table
30677                  * Most Unices do not set POLLERR for FIFOs but on Linux they
30678                  * behave exactly like pipes for poll().
30679                  */
30680 -               if (!pipe->readers)
30681 +               if (!atomic_read(&pipe->readers))
30682                         mask |= POLLERR;
30683         }
30684
30685 @@ -690,10 +690,10 @@ pipe_release(struct inode *inode, int de
30686
30687         mutex_lock(&inode->i_mutex);
30688         pipe = inode->i_pipe;
30689 -       pipe->readers -= decr;
30690 -       pipe->writers -= decw;
30691 +       atomic_sub(decr, &pipe->readers);
30692 +       atomic_sub(decw, &pipe->writers);
30693
30694 -       if (!pipe->readers && !pipe->writers) {
30695 +       if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
30696                 free_pipe_info(inode);
30697         } else {
30698                 wake_up_interruptible_sync(&pipe->wait);
30699 @@ -783,7 +783,7 @@ pipe_read_open(struct inode *inode, stru
30700
30701         if (inode->i_pipe) {
30702                 ret = 0;
30703 -               inode->i_pipe->readers++;
30704 +               atomic_inc(&inode->i_pipe->readers);
30705         }
30706
30707         mutex_unlock(&inode->i_mutex);
30708 @@ -800,7 +800,7 @@ pipe_write_open(struct inode *inode, str
30709
30710         if (inode->i_pipe) {
30711                 ret = 0;
30712 -               inode->i_pipe->writers++;
30713 +               atomic_inc(&inode->i_pipe->writers);
30714         }
30715
30716         mutex_unlock(&inode->i_mutex);
30717 @@ -818,9 +818,9 @@ pipe_rdwr_open(struct inode *inode, stru
30718         if (inode->i_pipe) {
30719                 ret = 0;
30720                 if (filp->f_mode & FMODE_READ)
30721 -                       inode->i_pipe->readers++;
30722 +                       atomic_inc(&inode->i_pipe->readers);
30723                 if (filp->f_mode & FMODE_WRITE)
30724 -                       inode->i_pipe->writers++;
30725 +                       atomic_inc(&inode->i_pipe->writers);
30726         }
30727
30728         mutex_unlock(&inode->i_mutex);
30729 @@ -905,7 +905,7 @@ void free_pipe_info(struct inode *inode)
30730         inode->i_pipe = NULL;
30731  }
30732
30733 -static struct vfsmount *pipe_mnt __read_mostly;
30734 +struct vfsmount *pipe_mnt __read_mostly;
30735
30736  /*
30737   * pipefs_dname() is called from d_path().
30738 @@ -933,7 +933,8 @@ static struct inode * get_pipe_inode(voi
30739                 goto fail_iput;
30740         inode->i_pipe = pipe;
30741
30742 -       pipe->readers = pipe->writers = 1;
30743 +       atomic_set(&pipe->readers, 1);
30744 +       atomic_set(&pipe->writers, 1);
30745         inode->i_fop = &rdwr_pipefifo_fops;
30746
30747         /*
30748 diff -urNp linux-2.6.33/fs/proc/array.c linux-2.6.33/fs/proc/array.c
30749 --- linux-2.6.33/fs/proc/array.c        2010-02-24 13:52:17.000000000 -0500
30750 +++ linux-2.6.33/fs/proc/array.c        2010-03-07 12:23:36.097602735 -0500
30751 @@ -337,6 +337,21 @@ static void task_cpus_allowed(struct seq
30752         seq_printf(m, "\n");
30753  }
30754
30755 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
30756 +static inline void task_pax(struct seq_file *m, struct task_struct *p)
30757 +{
30758 +       if (p->mm)
30759 +               seq_printf(m, "PaX:\t%c%c%c%c%c\n",
30760 +                          p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
30761 +                          p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
30762 +                          p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
30763 +                          p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
30764 +                          p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
30765 +       else
30766 +               seq_printf(m, "PaX:\t-----\n");
30767 +}
30768 +#endif
30769 +
30770  int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
30771                         struct pid *pid, struct task_struct *task)
30772  {
30773 @@ -357,9 +372,20 @@ int proc_pid_status(struct seq_file *m,
30774         task_show_regs(m, task);
30775  #endif
30776         task_context_switch_counts(m, task);
30777 +
30778 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
30779 +       task_pax(m, task);
30780 +#endif
30781 +
30782         return 0;
30783  }
30784
30785 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
30786 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
30787 +                            (_mm->pax_flags & MF_PAX_RANDMMAP || \
30788 +                             _mm->pax_flags & MF_PAX_SEGMEXEC))
30789 +#endif
30790 +
30791  static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
30792                         struct pid *pid, struct task_struct *task, int whole)
30793  {
30794 @@ -452,6 +478,19 @@ static int do_task_stat(struct seq_file
30795                 gtime = task->gtime;
30796         }
30797
30798 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
30799 +       if (PAX_RAND_FLAGS(mm)) {
30800 +               eip = 0;
30801 +               esp = 0;
30802 +               wchan = 0;
30803 +       }
30804 +#endif
30805 +#ifdef CONFIG_GRKERNSEC_HIDESYM
30806 +       wchan = 0;
30807 +       eip =0;
30808 +       esp =0;
30809 +#endif
30810 +
30811         /* scale priority and nice values from timeslices to -20..20 */
30812         /* to make it look like a "normal" Unix priority/nice value  */
30813         priority = task_prio(task);
30814 @@ -492,9 +531,15 @@ static int do_task_stat(struct seq_file
30815                 vsize,
30816                 mm ? get_mm_rss(mm) : 0,
30817                 rsslim,
30818 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
30819 +               PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->start_code : 0),
30820 +               PAX_RAND_FLAGS(mm) ? 1 : (mm ? mm->end_code : 0),
30821 +               PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? task->stack_start : 0),
30822 +#else
30823                 mm ? mm->start_code : 0,
30824                 mm ? mm->end_code : 0,
30825                 (permitted && mm) ? task->stack_start : 0,
30826 +#endif
30827                 esp,
30828                 eip,
30829                 /* The signal information here is obsolete.
30830 @@ -547,3 +592,10 @@ int proc_pid_statm(struct seq_file *m, s
30831
30832         return 0;
30833  }
30834 +
30835 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
30836 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
30837 +{
30838 +       return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
30839 +}
30840 +#endif
30841 diff -urNp linux-2.6.33/fs/proc/base.c linux-2.6.33/fs/proc/base.c
30842 --- linux-2.6.33/fs/proc/base.c 2010-02-24 13:52:17.000000000 -0500
30843 +++ linux-2.6.33/fs/proc/base.c 2010-03-07 12:23:36.097602735 -0500
30844 @@ -102,6 +102,22 @@ struct pid_entry {
30845         union proc_op op;
30846  };
30847
30848 +struct getdents_callback {
30849 +       struct linux_dirent __user * current_dir;
30850 +       struct linux_dirent __user * previous;
30851 +       struct file * file;
30852 +       int count;
30853 +       int error;
30854 +};
30855 +
30856 +static int gr_fake_filldir(void * __buf, const char *name, int namlen,
30857 +                          loff_t offset, u64 ino, unsigned int d_type)
30858 +{
30859 +       struct getdents_callback * buf = (struct getdents_callback *) __buf;
30860 +       buf->error = -EINVAL;
30861 +       return 0;
30862 +}
30863 +
30864  #define NOD(NAME, MODE, IOP, FOP, OP) {                        \
30865         .name = (NAME),                                 \
30866         .len  = sizeof(NAME) - 1,                       \
30867 @@ -213,6 +229,9 @@ static int check_mem_permission(struct t
30868         if (task == current)
30869                 return 0;
30870
30871 +       if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
30872 +               return -EPERM;
30873 +
30874         /*
30875          * If current is actively ptrace'ing, and would also be
30876          * permitted to freshly attach with ptrace now, permit it.
30877 @@ -260,6 +279,9 @@ static int proc_pid_cmdline(struct task_
30878         if (!mm->arg_end)
30879                 goto out_mm;    /* Shh! No looking before we're done */
30880
30881 +       if (gr_acl_handle_procpidmem(task))
30882 +               goto out_mm;
30883 +
30884         len = mm->arg_end - mm->arg_start;
30885
30886         if (len > PAGE_SIZE)
30887 @@ -287,12 +309,26 @@ out:
30888         return res;
30889  }
30890
30891 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
30892 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
30893 +                            (_mm->pax_flags & MF_PAX_RANDMMAP || \
30894 +                             _mm->pax_flags & MF_PAX_SEGMEXEC))
30895 +#endif
30896 +
30897  static int proc_pid_auxv(struct task_struct *task, char *buffer)
30898  {
30899         int res = 0;
30900         struct mm_struct *mm = get_task_mm(task);
30901         if (mm) {
30902                 unsigned int nwords = 0;
30903 +
30904 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
30905 +               if (PAX_RAND_FLAGS(mm)) {
30906 +                       mmput(mm);
30907 +                       return res;
30908 +               }
30909 +#endif
30910 +
30911                 do {
30912                         nwords += 2;
30913                 } while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
30914 @@ -328,7 +364,7 @@ static int proc_pid_wchan(struct task_st
30915  }
30916  #endif /* CONFIG_KALLSYMS */
30917
30918 -#ifdef CONFIG_STACKTRACE
30919 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
30920
30921  #define MAX_STACK_TRACE_DEPTH  64
30922
30923 @@ -521,7 +557,7 @@ static int proc_pid_limits(struct task_s
30924         return count;
30925  }
30926
30927 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
30928 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
30929  static int proc_pid_syscall(struct task_struct *task, char *buffer)
30930  {
30931         long nr;
30932 @@ -935,6 +971,9 @@ static ssize_t environ_read(struct file
30933         if (!task)
30934                 goto out_no_task;
30935
30936 +       if (gr_acl_handle_procpidmem(task))
30937 +               goto out;
30938 +
30939         if (!ptrace_may_access(task, PTRACE_MODE_READ))
30940                 goto out;
30941
30942 @@ -1520,7 +1559,11 @@ static struct inode *proc_pid_make_inode
30943                 rcu_read_lock();
30944                 cred = __task_cred(task);
30945                 inode->i_uid = cred->euid;
30946 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
30947 +               inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
30948 +#else
30949                 inode->i_gid = cred->egid;
30950 +#endif
30951                 rcu_read_unlock();
30952         }
30953         security_task_to_inode(task, inode);
30954 @@ -1538,6 +1581,9 @@ static int pid_getattr(struct vfsmount *
30955         struct inode *inode = dentry->d_inode;
30956         struct task_struct *task;
30957         const struct cred *cred;
30958 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
30959 +       const struct cred *tmpcred = current_cred();
30960 +#endif
30961
30962         generic_fillattr(inode, stat);
30963
30964 @@ -1545,12 +1591,34 @@ static int pid_getattr(struct vfsmount *
30965         stat->uid = 0;
30966         stat->gid = 0;
30967         task = pid_task(proc_pid(inode), PIDTYPE_PID);
30968 +
30969 +       if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
30970 +               rcu_read_unlock();
30971 +               return -ENOENT;
30972 +       }
30973 +
30974         if (task) {
30975 +               cred = __task_cred(task);
30976 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
30977 +               if (!tmpcred->uid || (tmpcred->uid == cred->uid)
30978 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
30979 +                   || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
30980 +#endif
30981 +               )
30982 +#endif
30983                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
30984 +#ifdef CONFIG_GRKERNSEC_PROC_USER
30985 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
30986 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
30987 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
30988 +#endif
30989                     task_dumpable(task)) {
30990 -                       cred = __task_cred(task);
30991                         stat->uid = cred->euid;
30992 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
30993 +                       stat->gid = CONFIG_GRKERNSEC_PROC_GID;
30994 +#else
30995                         stat->gid = cred->egid;
30996 +#endif
30997                 }
30998         }
30999         rcu_read_unlock();
31000 @@ -1582,11 +1650,20 @@ static int pid_revalidate(struct dentry
31001
31002         if (task) {
31003                 if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
31004 +#ifdef CONFIG_GRKERNSEC_PROC_USER
31005 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
31006 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31007 +                   (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
31008 +#endif
31009                     task_dumpable(task)) {
31010                         rcu_read_lock();
31011                         cred = __task_cred(task);
31012                         inode->i_uid = cred->euid;
31013 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
31014 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
31015 +#else
31016                         inode->i_gid = cred->egid;
31017 +#endif
31018                         rcu_read_unlock();
31019                 } else {
31020                         inode->i_uid = 0;
31021 @@ -1707,7 +1784,8 @@ static int proc_fd_info(struct inode *in
31022         int fd = proc_fd(inode);
31023
31024         if (task) {
31025 -               files = get_files_struct(task);
31026 +               if (!gr_acl_handle_procpidmem(task))
31027 +                       files = get_files_struct(task);
31028                 put_task_struct(task);
31029         }
31030         if (files) {
31031 @@ -1959,12 +2037,22 @@ static const struct file_operations proc
31032  static int proc_fd_permission(struct inode *inode, int mask)
31033  {
31034         int rv;
31035 +       struct task_struct *task;
31036
31037         rv = generic_permission(inode, mask, NULL);
31038 -       if (rv == 0)
31039 -               return 0;
31040 +
31041         if (task_pid(current) == proc_pid(inode))
31042                 rv = 0;
31043 +
31044 +       task = get_proc_task(inode);
31045 +       if (task == NULL)
31046 +               return rv;
31047 +
31048 +       if (gr_acl_handle_procpidmem(task))
31049 +               rv = -EACCES;
31050 +
31051 +       put_task_struct(task);
31052 +
31053         return rv;
31054  }
31055
31056 @@ -2073,6 +2161,9 @@ static struct dentry *proc_pident_lookup
31057         if (!task)
31058                 goto out_no_task;
31059
31060 +       if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
31061 +               goto out;
31062 +
31063         /*
31064          * Yes, it does not scale. And it should not. Don't add
31065          * new entries into /proc/<tgid>/ without very good reasons.
31066 @@ -2117,6 +2208,9 @@ static int proc_pident_readdir(struct fi
31067         if (!task)
31068                 goto out_no_task;
31069
31070 +       if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
31071 +               goto out;
31072 +
31073         ret = 0;
31074         i = filp->f_pos;
31075         switch (i) {
31076 @@ -2384,7 +2478,7 @@ static void *proc_self_follow_link(struc
31077  static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
31078                                 void *cookie)
31079  {
31080 -       char *s = nd_get_link(nd);
31081 +       const char *s = nd_get_link(nd);
31082         if (!IS_ERR(s))
31083                 __putname(s);
31084  }
31085 @@ -2497,6 +2591,9 @@ static struct dentry *proc_base_lookup(s
31086         if (p > last)
31087                 goto out;
31088
31089 +       if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
31090 +               goto out;
31091 +
31092         error = proc_base_instantiate(dir, dentry, task, p);
31093
31094  out:
31095 @@ -2584,7 +2681,7 @@ static const struct pid_entry tgid_base_
31096         REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
31097  #endif
31098         REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
31099 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
31100 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
31101         INF("syscall",    S_IRUSR, proc_pid_syscall),
31102  #endif
31103         INF("cmdline",    S_IRUGO, proc_pid_cmdline),
31104 @@ -2612,7 +2709,7 @@ static const struct pid_entry tgid_base_
31105  #ifdef CONFIG_KALLSYMS
31106         INF("wchan",      S_IRUGO, proc_pid_wchan),
31107  #endif
31108 -#ifdef CONFIG_STACKTRACE
31109 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
31110         ONE("stack",      S_IRUSR, proc_pid_stack),
31111  #endif
31112  #ifdef CONFIG_SCHEDSTATS
31113 @@ -2642,6 +2739,9 @@ static const struct pid_entry tgid_base_
31114  #ifdef CONFIG_TASK_IO_ACCOUNTING
31115         INF("io",       S_IRUGO, proc_tgid_io_accounting),
31116  #endif
31117 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
31118 +       INF("ipaddr",     S_IRUSR, proc_pid_ipaddr),
31119 +#endif
31120  };
31121
31122  static int proc_tgid_base_readdir(struct file * filp,
31123 @@ -2766,7 +2866,14 @@ static struct dentry *proc_pid_instantia
31124         if (!inode)
31125                 goto out;
31126
31127 +#ifdef CONFIG_GRKERNSEC_PROC_USER
31128 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
31129 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31130 +       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
31131 +       inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
31132 +#else
31133         inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
31134 +#endif
31135         inode->i_op = &proc_tgid_base_inode_operations;
31136         inode->i_fop = &proc_tgid_base_operations;
31137         inode->i_flags|=S_IMMUTABLE;
31138 @@ -2808,7 +2915,11 @@ struct dentry *proc_pid_lookup(struct in
31139         if (!task)
31140                 goto out;
31141
31142 +       if (gr_check_hidden_task(task))
31143 +               goto out_put_task;
31144 +
31145         result = proc_pid_instantiate(dir, dentry, task, NULL);
31146 +out_put_task:
31147         put_task_struct(task);
31148  out:
31149         return result;
31150 @@ -2873,6 +2984,11 @@ int proc_pid_readdir(struct file * filp,
31151  {
31152         unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
31153         struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
31154 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31155 +       const struct cred *tmpcred = current_cred();
31156 +       const struct cred *itercred;
31157 +#endif
31158 +       filldir_t __filldir = filldir;
31159         struct tgid_iter iter;
31160         struct pid_namespace *ns;
31161
31162 @@ -2891,8 +3007,27 @@ int proc_pid_readdir(struct file * filp,
31163         for (iter = next_tgid(ns, iter);
31164              iter.task;
31165              iter.tgid += 1, iter = next_tgid(ns, iter)) {
31166 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31167 +               rcu_read_lock();
31168 +               itercred = __task_cred(iter.task);
31169 +#endif
31170 +               if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
31171 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31172 +                   || (tmpcred->uid && (itercred->uid != tmpcred->uid)
31173 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
31174 +                       && !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
31175 +#endif
31176 +                       )
31177 +#endif
31178 +               )
31179 +                       __filldir = &gr_fake_filldir;
31180 +               else
31181 +                       __filldir = filldir;
31182 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31183 +       rcu_read_unlock();
31184 +#endif
31185                 filp->f_pos = iter.tgid + TGID_OFFSET;
31186 -               if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
31187 +               if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
31188                         put_task_struct(iter.task);
31189                         goto out;
31190                 }
31191 @@ -2919,7 +3054,7 @@ static const struct pid_entry tid_base_s
31192         REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
31193  #endif
31194         REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
31195 -#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
31196 +#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
31197         INF("syscall",   S_IRUSR, proc_pid_syscall),
31198  #endif
31199         INF("cmdline",   S_IRUGO, proc_pid_cmdline),
31200 @@ -2946,7 +3081,7 @@ static const struct pid_entry tid_base_s
31201  #ifdef CONFIG_KALLSYMS
31202         INF("wchan",     S_IRUGO, proc_pid_wchan),
31203  #endif
31204 -#ifdef CONFIG_STACKTRACE
31205 +#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
31206         ONE("stack",      S_IRUSR, proc_pid_stack),
31207  #endif
31208  #ifdef CONFIG_SCHEDSTATS
31209 diff -urNp linux-2.6.33/fs/proc/cmdline.c linux-2.6.33/fs/proc/cmdline.c
31210 --- linux-2.6.33/fs/proc/cmdline.c      2010-02-24 13:52:17.000000000 -0500
31211 +++ linux-2.6.33/fs/proc/cmdline.c      2010-03-07 12:23:36.097602735 -0500
31212 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
31213
31214  static int __init proc_cmdline_init(void)
31215  {
31216 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
31217 +       proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
31218 +#else
31219         proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
31220 +#endif
31221         return 0;
31222  }
31223  module_init(proc_cmdline_init);
31224 diff -urNp linux-2.6.33/fs/proc/devices.c linux-2.6.33/fs/proc/devices.c
31225 --- linux-2.6.33/fs/proc/devices.c      2010-02-24 13:52:17.000000000 -0500
31226 +++ linux-2.6.33/fs/proc/devices.c      2010-03-07 12:23:36.097602735 -0500
31227 @@ -64,7 +64,11 @@ static const struct file_operations proc
31228
31229  static int __init proc_devices_init(void)
31230  {
31231 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
31232 +       proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
31233 +#else
31234         proc_create("devices", 0, NULL, &proc_devinfo_operations);
31235 +#endif
31236         return 0;
31237  }
31238  module_init(proc_devices_init);
31239 diff -urNp linux-2.6.33/fs/proc/inode.c linux-2.6.33/fs/proc/inode.c
31240 --- linux-2.6.33/fs/proc/inode.c        2010-02-24 13:52:17.000000000 -0500
31241 +++ linux-2.6.33/fs/proc/inode.c        2010-03-07 12:23:36.097602735 -0500
31242 @@ -434,7 +434,11 @@ struct inode *proc_get_inode(struct supe
31243                 if (de->mode) {
31244                         inode->i_mode = de->mode;
31245                         inode->i_uid = de->uid;
31246 +#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
31247 +                       inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
31248 +#else
31249                         inode->i_gid = de->gid;
31250 +#endif
31251                 }
31252                 if (de->size)
31253                         inode->i_size = de->size;
31254 diff -urNp linux-2.6.33/fs/proc/internal.h linux-2.6.33/fs/proc/internal.h
31255 --- linux-2.6.33/fs/proc/internal.h     2010-02-24 13:52:17.000000000 -0500
31256 +++ linux-2.6.33/fs/proc/internal.h     2010-03-07 12:23:36.097602735 -0500
31257 @@ -55,6 +55,10 @@
31258  extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
31259                                 struct pid *pid, struct task_struct *task);
31260
31261 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
31262 +extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
31263 +#endif
31264 +
31265  extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
31266
31267  extern const struct file_operations proc_maps_operations;
31268 diff -urNp linux-2.6.33/fs/proc/Kconfig linux-2.6.33/fs/proc/Kconfig
31269 --- linux-2.6.33/fs/proc/Kconfig        2010-02-24 13:52:17.000000000 -0500
31270 +++ linux-2.6.33/fs/proc/Kconfig        2010-03-07 12:23:36.097602735 -0500
31271 @@ -30,12 +30,12 @@ config PROC_FS
31272
31273  config PROC_KCORE
31274         bool "/proc/kcore support" if !ARM
31275 -       depends on PROC_FS && MMU
31276 +       depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
31277
31278  config PROC_VMCORE
31279          bool "/proc/vmcore support (EXPERIMENTAL)"
31280 -        depends on PROC_FS && CRASH_DUMP
31281 -       default y
31282 +        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
31283 +       default n
31284          help
31285          Exports the dump image of crashed kernel in ELF format.
31286
31287 @@ -59,8 +59,8 @@ config PROC_SYSCTL
31288           limited in memory.
31289
31290  config PROC_PAGE_MONITOR
31291 -       default y
31292 -       depends on PROC_FS && MMU
31293 +       default n
31294 +       depends on PROC_FS && MMU && !GRKERNSEC
31295         bool "Enable /proc page monitoring" if EMBEDDED
31296         help
31297           Various /proc files exist to monitor process memory utilization:
31298 diff -urNp linux-2.6.33/fs/proc/kcore.c linux-2.6.33/fs/proc/kcore.c
31299 --- linux-2.6.33/fs/proc/kcore.c        2010-02-24 13:52:17.000000000 -0500
31300 +++ linux-2.6.33/fs/proc/kcore.c        2010-03-07 12:23:36.097602735 -0500
31301 @@ -541,6 +541,9 @@ read_kcore(struct file *file, char __use
31302
31303  static int open_kcore(struct inode *inode, struct file *filp)
31304  {
31305 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
31306 +       return -EPERM;
31307 +#endif
31308         if (!capable(CAP_SYS_RAWIO))
31309                 return -EPERM;
31310         if (kcore_need_update)
31311 diff -urNp linux-2.6.33/fs/proc/meminfo.c linux-2.6.33/fs/proc/meminfo.c
31312 --- linux-2.6.33/fs/proc/meminfo.c      2010-02-24 13:52:17.000000000 -0500
31313 +++ linux-2.6.33/fs/proc/meminfo.c      2010-03-07 12:23:36.097602735 -0500
31314 @@ -149,7 +149,7 @@ static int meminfo_proc_show(struct seq_
31315                 vmi.used >> 10,
31316                 vmi.largest_chunk >> 10
31317  #ifdef CONFIG_MEMORY_FAILURE
31318 -               ,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
31319 +               ,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
31320  #endif
31321                 );
31322
31323 diff -urNp linux-2.6.33/fs/proc/nommu.c linux-2.6.33/fs/proc/nommu.c
31324 --- linux-2.6.33/fs/proc/nommu.c        2010-02-24 13:52:17.000000000 -0500
31325 +++ linux-2.6.33/fs/proc/nommu.c        2010-03-07 12:23:36.097602735 -0500
31326 @@ -67,7 +67,7 @@ static int nommu_region_show(struct seq_
31327                 if (len < 1)
31328                         len = 1;
31329                 seq_printf(m, "%*c", len, ' ');
31330 -               seq_path(m, &file->f_path, "");
31331 +               seq_path(m, &file->f_path, "\n\\");
31332         }
31333
31334         seq_putc(m, '\n');
31335 diff -urNp linux-2.6.33/fs/proc/proc_net.c linux-2.6.33/fs/proc/proc_net.c
31336 --- linux-2.6.33/fs/proc/proc_net.c     2010-02-24 13:52:17.000000000 -0500
31337 +++ linux-2.6.33/fs/proc/proc_net.c     2010-03-07 12:23:36.097602735 -0500
31338 @@ -104,6 +104,17 @@ static struct net *get_proc_task_net(str
31339         struct task_struct *task;
31340         struct nsproxy *ns;
31341         struct net *net = NULL;
31342 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31343 +       const struct cred *cred = current_cred();
31344 +#endif
31345 +
31346 +#ifdef CONFIG_GRKERNSEC_PROC_USER
31347 +       if (cred->fsuid)
31348 +               return net;
31349 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31350 +       if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
31351 +               return net;
31352 +#endif
31353
31354         rcu_read_lock();
31355         task = pid_task(proc_pid(dir), PIDTYPE_PID);
31356 diff -urNp linux-2.6.33/fs/proc/proc_sysctl.c linux-2.6.33/fs/proc/proc_sysctl.c
31357 --- linux-2.6.33/fs/proc/proc_sysctl.c  2010-02-24 13:52:17.000000000 -0500
31358 +++ linux-2.6.33/fs/proc/proc_sysctl.c  2010-03-07 12:23:36.097602735 -0500
31359 @@ -7,6 +7,8 @@
31360  #include <linux/security.h>
31361  #include "internal.h"
31362
31363 +extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
31364 +
31365  static const struct dentry_operations proc_sys_dentry_operations;
31366  static const struct file_operations proc_sys_file_operations;
31367  static const struct inode_operations proc_sys_inode_operations;
31368 @@ -109,6 +111,9 @@ static struct dentry *proc_sys_lookup(st
31369         if (!p)
31370                 goto out;
31371
31372 +       if (gr_handle_sysctl(p, MAY_EXEC))
31373 +               goto out;
31374 +
31375         err = ERR_PTR(-ENOMEM);
31376         inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
31377         if (h)
31378 @@ -228,6 +233,9 @@ static int scan(struct ctl_table_header
31379                 if (*pos < file->f_pos)
31380                         continue;
31381
31382 +               if (gr_handle_sysctl(table, 0))
31383 +                       continue;
31384 +
31385                 res = proc_sys_fill_cache(file, dirent, filldir, head, table);
31386                 if (res)
31387                         return res;
31388 @@ -344,6 +352,9 @@ static int proc_sys_getattr(struct vfsmo
31389         if (IS_ERR(head))
31390                 return PTR_ERR(head);
31391
31392 +       if (table && gr_handle_sysctl(table, MAY_EXEC))
31393 +               return -ENOENT;
31394 +
31395         generic_fillattr(inode, stat);
31396         if (table)
31397                 stat->mode = (stat->mode & S_IFMT) | table->mode;
31398 diff -urNp linux-2.6.33/fs/proc/root.c linux-2.6.33/fs/proc/root.c
31399 --- linux-2.6.33/fs/proc/root.c 2010-02-24 13:52:17.000000000 -0500
31400 +++ linux-2.6.33/fs/proc/root.c 2010-03-07 12:23:36.097602735 -0500
31401 @@ -134,7 +134,15 @@ void __init proc_root_init(void)
31402  #ifdef CONFIG_PROC_DEVICETREE
31403         proc_device_tree_init();
31404  #endif
31405 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
31406 +#ifdef CONFIG_GRKERNSEC_PROC_USER
31407 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
31408 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
31409 +       proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
31410 +#endif
31411 +#else
31412         proc_mkdir("bus", NULL);
31413 +#endif
31414         proc_sys_init();
31415  }
31416
31417 diff -urNp linux-2.6.33/fs/proc/task_mmu.c linux-2.6.33/fs/proc/task_mmu.c
31418 --- linux-2.6.33/fs/proc/task_mmu.c     2010-02-24 13:52:17.000000000 -0500
31419 +++ linux-2.6.33/fs/proc/task_mmu.c     2010-03-07 12:23:36.097602735 -0500
31420 @@ -46,15 +46,26 @@ void task_mem(struct seq_file *m, struct
31421                 "VmStk:\t%8lu kB\n"
31422                 "VmExe:\t%8lu kB\n"
31423                 "VmLib:\t%8lu kB\n"
31424 -               "VmPTE:\t%8lu kB\n",
31425 -               hiwater_vm << (PAGE_SHIFT-10),
31426 +               "VmPTE:\t%8lu kB\n"
31427 +
31428 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
31429 +               "CsBase:\t%8lx\nCsLim:\t%8lx\n"
31430 +#endif
31431 +
31432 +               ,hiwater_vm << (PAGE_SHIFT-10),
31433                 (total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
31434                 mm->locked_vm << (PAGE_SHIFT-10),
31435                 hiwater_rss << (PAGE_SHIFT-10),
31436                 total_rss << (PAGE_SHIFT-10),
31437                 data << (PAGE_SHIFT-10),
31438                 mm->stack_vm << (PAGE_SHIFT-10), text, lib,
31439 -               (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
31440 +               (PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
31441 +
31442 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
31443 +               , mm->context.user_cs_base, mm->context.user_cs_limit
31444 +#endif
31445 +
31446 +       );
31447  }
31448
31449  unsigned long task_vsize(struct mm_struct *mm)
31450 @@ -199,6 +210,12 @@ static int do_maps_open(struct inode *in
31451         return ret;
31452  }
31453
31454 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31455 +#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
31456 +                            (_mm->pax_flags & MF_PAX_RANDMMAP || \
31457 +                             _mm->pax_flags & MF_PAX_SEGMEXEC))
31458 +#endif
31459 +
31460  static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
31461  {
31462         struct mm_struct *mm = vma->vm_mm;
31463 @@ -217,13 +234,22 @@ static void show_map_vma(struct seq_file
31464         }
31465
31466         seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
31467 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31468 +                       PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
31469 +                       PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
31470 +#else
31471                         vma->vm_start,
31472                         vma->vm_end,
31473 +#endif
31474                         flags & VM_READ ? 'r' : '-',
31475                         flags & VM_WRITE ? 'w' : '-',
31476                         flags & VM_EXEC ? 'x' : '-',
31477                         flags & VM_MAYSHARE ? 's' : 'p',
31478 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31479 +                       PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
31480 +#else
31481                         pgoff,
31482 +#endif
31483                         MAJOR(dev), MINOR(dev), ino, &len);
31484
31485         /*
31486 @@ -232,16 +258,16 @@ static void show_map_vma(struct seq_file
31487          */
31488         if (file) {
31489                 pad_len_spaces(m, len);
31490 -               seq_path(m, &file->f_path, "\n");
31491 +               seq_path(m, &file->f_path, "\n\\");
31492         } else {
31493                 const char *name = arch_vma_name(vma);
31494                 if (!name) {
31495                         if (mm) {
31496 -                               if (vma->vm_start <= mm->start_brk &&
31497 -                                               vma->vm_end >= mm->brk) {
31498 +                               if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
31499                                         name = "[heap]";
31500 -                               } else if (vma->vm_start <= mm->start_stack &&
31501 -                                          vma->vm_end >= mm->start_stack) {
31502 +                               } else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
31503 +                                          (vma->vm_start <= mm->start_stack &&
31504 +                                           vma->vm_end >= mm->start_stack)) {
31505                                         name = "[stack]";
31506                                 } else {
31507                                         unsigned long stack_start;
31508 @@ -402,9 +428,16 @@ static int show_smap(struct seq_file *m,
31509         };
31510
31511         memset(&mss, 0, sizeof mss);
31512 -       mss.vma = vma;
31513 -       if (vma->vm_mm && !is_vm_hugetlb_page(vma))
31514 -               walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
31515 +
31516 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31517 +       if (!PAX_RAND_FLAGS(vma->vm_mm)) {
31518 +#endif
31519 +               mss.vma = vma;
31520 +               if (vma->vm_mm && !is_vm_hugetlb_page(vma))
31521 +                       walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
31522 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31523 +       }
31524 +#endif
31525
31526         show_map_vma(m, vma);
31527
31528 @@ -420,7 +453,11 @@ static int show_smap(struct seq_file *m,
31529                    "Swap:           %8lu kB\n"
31530                    "KernelPageSize: %8lu kB\n"
31531                    "MMUPageSize:    %8lu kB\n",
31532 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
31533 +                  PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
31534 +#else
31535                    (vma->vm_end - vma->vm_start) >> 10,
31536 +#endif
31537                    mss.resident >> 10,
31538                    (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
31539                    mss.shared_clean  >> 10,
31540 diff -urNp linux-2.6.33/fs/proc/task_nommu.c linux-2.6.33/fs/proc/task_nommu.c
31541 --- linux-2.6.33/fs/proc/task_nommu.c   2010-02-24 13:52:17.000000000 -0500
31542 +++ linux-2.6.33/fs/proc/task_nommu.c   2010-03-07 12:23:36.097602735 -0500
31543 @@ -50,7 +50,7 @@ void task_mem(struct seq_file *m, struct
31544         else
31545                 bytes += kobjsize(mm);
31546
31547 -       if (current->fs && current->fs->users > 1)
31548 +       if (current->fs && atomic_read(&current->fs->users) > 1)
31549                 sbytes += kobjsize(current->fs);
31550         else
31551                 bytes += kobjsize(current->fs);
31552 @@ -158,7 +158,7 @@ static int nommu_vma_show(struct seq_fil
31553                 if (len < 1)
31554                         len = 1;
31555                 seq_printf(m, "%*c", len, ' ');
31556 -               seq_path(m, &file->f_path, "");
31557 +               seq_path(m, &file->f_path, "\n\\");
31558         }
31559
31560         seq_putc(m, '\n');
31561 diff -urNp linux-2.6.33/fs/readdir.c linux-2.6.33/fs/readdir.c
31562 --- linux-2.6.33/fs/readdir.c   2010-02-24 13:52:17.000000000 -0500
31563 +++ linux-2.6.33/fs/readdir.c   2010-03-07 12:23:36.097602735 -0500
31564 @@ -16,6 +16,7 @@
31565  #include <linux/security.h>
31566  #include <linux/syscalls.h>
31567  #include <linux/unistd.h>
31568 +#include <linux/namei.h>
31569
31570  #include <asm/uaccess.h>
31571
31572 @@ -67,6 +68,7 @@ struct old_linux_dirent {
31573
31574  struct readdir_callback {
31575         struct old_linux_dirent __user * dirent;
31576 +       struct file * file;
31577         int result;
31578  };
31579
31580 @@ -84,6 +86,10 @@ static int fillonedir(void * __buf, cons
31581                 buf->result = -EOVERFLOW;
31582                 return -EOVERFLOW;
31583         }
31584 +
31585 +       if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
31586 +               return 0;
31587 +
31588         buf->result++;
31589         dirent = buf->dirent;
31590         if (!access_ok(VERIFY_WRITE, dirent,
31591 @@ -116,6 +122,7 @@ SYSCALL_DEFINE3(old_readdir, unsigned in
31592
31593         buf.result = 0;
31594         buf.dirent = dirent;
31595 +       buf.file = file;
31596
31597         error = vfs_readdir(file, fillonedir, &buf);
31598         if (buf.result)
31599 @@ -142,6 +149,7 @@ struct linux_dirent {
31600  struct getdents_callback {
31601         struct linux_dirent __user * current_dir;
31602         struct linux_dirent __user * previous;
31603 +       struct file * file;
31604         int count;
31605         int error;
31606  };
31607 @@ -162,6 +170,10 @@ static int filldir(void * __buf, const c
31608                 buf->error = -EOVERFLOW;
31609                 return -EOVERFLOW;
31610         }
31611 +
31612 +       if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
31613 +               return 0;
31614 +
31615         dirent = buf->previous;
31616         if (dirent) {
31617                 if (__put_user(offset, &dirent->d_off))
31618 @@ -209,6 +221,7 @@ SYSCALL_DEFINE3(getdents, unsigned int,
31619         buf.previous = NULL;
31620         buf.count = count;
31621         buf.error = 0;
31622 +       buf.file = file;
31623
31624         error = vfs_readdir(file, filldir, &buf);
31625         if (error >= 0)
31626 @@ -228,6 +241,7 @@ out:
31627  struct getdents_callback64 {
31628         struct linux_dirent64 __user * current_dir;
31629         struct linux_dirent64 __user * previous;
31630 +       struct file *file;
31631         int count;
31632         int error;
31633  };
31634 @@ -242,6 +256,10 @@ static int filldir64(void * __buf, const
31635         buf->error = -EINVAL;   /* only used if we fail.. */
31636         if (reclen > buf->count)
31637                 return -EINVAL;
31638 +
31639 +       if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
31640 +               return 0;
31641 +
31642         dirent = buf->previous;
31643         if (dirent) {
31644                 if (__put_user(offset, &dirent->d_off))
31645 @@ -289,6 +307,7 @@ SYSCALL_DEFINE3(getdents64, unsigned int
31646
31647         buf.current_dir = dirent;
31648         buf.previous = NULL;
31649 +       buf.file = file;
31650         buf.count = count;
31651         buf.error = 0;
31652
31653 diff -urNp linux-2.6.33/fs/reiserfs/do_balan.c linux-2.6.33/fs/reiserfs/do_balan.c
31654 --- linux-2.6.33/fs/reiserfs/do_balan.c 2010-02-24 13:52:17.000000000 -0500
31655 +++ linux-2.6.33/fs/reiserfs/do_balan.c 2010-03-07 12:23:36.097602735 -0500
31656 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
31657                 return;
31658         }
31659
31660 -       atomic_inc(&(fs_generation(tb->tb_sb)));
31661 +       atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
31662         do_balance_starts(tb);
31663
31664         /* balance leaf returns 0 except if combining L R and S into
31665 diff -urNp linux-2.6.33/fs/reiserfs/item_ops.c linux-2.6.33/fs/reiserfs/item_ops.c
31666 --- linux-2.6.33/fs/reiserfs/item_ops.c 2010-02-24 13:52:17.000000000 -0500
31667 +++ linux-2.6.33/fs/reiserfs/item_ops.c 2010-03-07 12:23:36.097602735 -0500
31668 @@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
31669                          vi->vi_index, vi->vi_type, vi->vi_ih);
31670  }
31671
31672 -static struct item_operations stat_data_ops = {
31673 +static const struct item_operations stat_data_ops = {
31674         .bytes_number = sd_bytes_number,
31675         .decrement_key = sd_decrement_key,
31676         .is_left_mergeable = sd_is_left_mergeable,
31677 @@ -196,7 +196,7 @@ static void direct_print_vi(struct virtu
31678                          vi->vi_index, vi->vi_type, vi->vi_ih);
31679  }
31680
31681 -static struct item_operations direct_ops = {
31682 +static const struct item_operations direct_ops = {
31683         .bytes_number = direct_bytes_number,
31684         .decrement_key = direct_decrement_key,
31685         .is_left_mergeable = direct_is_left_mergeable,
31686 @@ -341,7 +341,7 @@ static void indirect_print_vi(struct vir
31687                          vi->vi_index, vi->vi_type, vi->vi_ih);
31688  }
31689
31690 -static struct item_operations indirect_ops = {
31691 +static const struct item_operations indirect_ops = {
31692         .bytes_number = indirect_bytes_number,
31693         .decrement_key = indirect_decrement_key,
31694         .is_left_mergeable = indirect_is_left_mergeable,
31695 @@ -628,7 +628,7 @@ static void direntry_print_vi(struct vir
31696         printk("\n");
31697  }
31698
31699 -static struct item_operations direntry_ops = {
31700 +static const struct item_operations direntry_ops = {
31701         .bytes_number = direntry_bytes_number,
31702         .decrement_key = direntry_decrement_key,
31703         .is_left_mergeable = direntry_is_left_mergeable,
31704 @@ -724,7 +724,7 @@ static void errcatch_print_vi(struct vir
31705                          "Invalid item type observed, run fsck ASAP");
31706  }
31707
31708 -static struct item_operations errcatch_ops = {
31709 +static const struct item_operations errcatch_ops = {
31710         errcatch_bytes_number,
31711         errcatch_decrement_key,
31712         errcatch_is_left_mergeable,
31713 @@ -746,7 +746,7 @@ static struct item_operations errcatch_o
31714  #error Item types must use disk-format assigned values.
31715  #endif
31716
31717 -struct item_operations *item_ops[TYPE_ANY + 1] = {
31718 +const struct item_operations * const item_ops[TYPE_ANY + 1] = {
31719         &stat_data_ops,
31720         &indirect_ops,
31721         &direct_ops,
31722 diff -urNp linux-2.6.33/fs/reiserfs/procfs.c linux-2.6.33/fs/reiserfs/procfs.c
31723 --- linux-2.6.33/fs/reiserfs/procfs.c   2010-02-24 13:52:17.000000000 -0500
31724 +++ linux-2.6.33/fs/reiserfs/procfs.c   2010-03-07 12:23:36.101714273 -0500
31725 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
31726                    "SMALL_TAILS " : "NO_TAILS ",
31727                    replay_only(sb) ? "REPLAY_ONLY " : "",
31728                    convert_reiserfs(sb) ? "CONV " : "",
31729 -                  atomic_read(&r->s_generation_counter),
31730 +                  atomic_read_unchecked(&r->s_generation_counter),
31731                    SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
31732                    SF(s_do_balance), SF(s_unneeded_left_neighbor),
31733                    SF(s_good_search_by_key_reada), SF(s_bmaps),
31734 diff -urNp linux-2.6.33/fs/select.c linux-2.6.33/fs/select.c
31735 --- linux-2.6.33/fs/select.c    2010-02-24 13:52:17.000000000 -0500
31736 +++ linux-2.6.33/fs/select.c    2010-03-07 12:23:36.101714273 -0500
31737 @@ -20,6 +20,7 @@
31738  #include <linux/module.h>
31739  #include <linux/slab.h>
31740  #include <linux/poll.h>
31741 +#include <linux/security.h>
31742  #include <linux/personality.h> /* for STICKY_TIMEOUTS */
31743  #include <linux/file.h>
31744  #include <linux/fdtable.h>
31745 @@ -821,6 +822,7 @@ int do_sys_poll(struct pollfd __user *uf
31746         struct poll_list *walk = head;
31747         unsigned long todo = nfds;
31748
31749 +       gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
31750         if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
31751                 return -EINVAL;
31752
31753 diff -urNp linux-2.6.33/fs/seq_file.c linux-2.6.33/fs/seq_file.c
31754 --- linux-2.6.33/fs/seq_file.c  2010-02-24 13:52:17.000000000 -0500
31755 +++ linux-2.6.33/fs/seq_file.c  2010-03-07 12:23:36.101714273 -0500
31756 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m,
31757                 return 0;
31758         }
31759         if (!m->buf) {
31760 -               m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
31761 +               m->size = PAGE_SIZE;
31762 +               m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
31763                 if (!m->buf)
31764                         return -ENOMEM;
31765         }
31766 @@ -116,7 +117,8 @@ static int traverse(struct seq_file *m,
31767  Eoverflow:
31768         m->op->stop(m, p);
31769         kfree(m->buf);
31770 -       m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
31771 +       m->size <<= 1;
31772 +       m->buf = kmalloc(m->size, GFP_KERNEL);
31773         return !m->buf ? -ENOMEM : -EAGAIN;
31774  }
31775
31776 @@ -169,7 +171,8 @@ ssize_t seq_read(struct file *file, char
31777         m->version = file->f_version;
31778         /* grab buffer if we didn't have one */
31779         if (!m->buf) {
31780 -               m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
31781 +               m->size = PAGE_SIZE;
31782 +               m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
31783                 if (!m->buf)
31784                         goto Enomem;
31785         }
31786 @@ -210,7 +213,8 @@ ssize_t seq_read(struct file *file, char
31787                         goto Fill;
31788                 m->op->stop(m, p);
31789                 kfree(m->buf);
31790 -               m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
31791 +               m->size <<= 1;
31792 +               m->buf = kmalloc(m->size, GFP_KERNEL);
31793                 if (!m->buf)
31794                         goto Enomem;
31795                 m->count = 0;
31796 diff -urNp linux-2.6.33/fs/smbfs/symlink.c linux-2.6.33/fs/smbfs/symlink.c
31797 --- linux-2.6.33/fs/smbfs/symlink.c     2010-02-24 13:52:17.000000000 -0500
31798 +++ linux-2.6.33/fs/smbfs/symlink.c     2010-03-07 12:23:36.101714273 -0500
31799 @@ -55,7 +55,7 @@ static void *smb_follow_link(struct dent
31800
31801  static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
31802  {
31803 -       char *s = nd_get_link(nd);
31804 +       const char *s = nd_get_link(nd);
31805         if (!IS_ERR(s))
31806                 __putname(s);
31807  }
31808 diff -urNp linux-2.6.33/fs/splice.c linux-2.6.33/fs/splice.c
31809 --- linux-2.6.33/fs/splice.c    2010-02-24 13:52:17.000000000 -0500
31810 +++ linux-2.6.33/fs/splice.c    2010-03-07 12:23:36.101714273 -0500
31811 @@ -185,7 +185,7 @@ ssize_t splice_to_pipe(struct pipe_inode
31812         pipe_lock(pipe);
31813
31814         for (;;) {
31815 -               if (!pipe->readers) {
31816 +               if (!atomic_read(&pipe->readers)) {
31817                         send_sig(SIGPIPE, current, 0);
31818                         if (!ret)
31819                                 ret = -EPIPE;
31820 @@ -239,9 +239,9 @@ ssize_t splice_to_pipe(struct pipe_inode
31821                         do_wakeup = 0;
31822                 }
31823
31824 -               pipe->waiting_writers++;
31825 +               atomic_inc(&pipe->waiting_writers);
31826                 pipe_wait(pipe);
31827 -               pipe->waiting_writers--;
31828 +               atomic_dec(&pipe->waiting_writers);
31829         }
31830
31831         pipe_unlock(pipe);
31832 @@ -531,7 +531,7 @@ static ssize_t kernel_readv(struct file
31833         old_fs = get_fs();
31834         set_fs(get_ds());
31835         /* The cast to a user pointer is valid due to the set_fs() */
31836 -       res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
31837 +       res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
31838         set_fs(old_fs);
31839
31840         return res;
31841 @@ -546,7 +546,7 @@ static ssize_t kernel_write(struct file
31842         old_fs = get_fs();
31843         set_fs(get_ds());
31844         /* The cast to a user pointer is valid due to the set_fs() */
31845 -       res = vfs_write(file, (const char __user *)buf, count, &pos);
31846 +       res = vfs_write(file, (__force const char __user *)buf, count, &pos);
31847         set_fs(old_fs);
31848
31849         return res;
31850 @@ -588,7 +588,7 @@ ssize_t default_file_splice_read(struct
31851                         goto err;
31852
31853                 this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
31854 -               vec[i].iov_base = (void __user *) page_address(page);
31855 +               vec[i].iov_base = (__force void __user *) page_address(page);
31856                 vec[i].iov_len = this_len;
31857                 pages[i] = page;
31858                 spd.nr_pages++;
31859 @@ -810,10 +810,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
31860  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
31861  {
31862         while (!pipe->nrbufs) {
31863 -               if (!pipe->writers)
31864 +               if (!atomic_read(&pipe->writers))
31865                         return 0;
31866
31867 -               if (!pipe->waiting_writers && sd->num_spliced)
31868 +               if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
31869                         return 0;
31870
31871                 if (sd->flags & SPLICE_F_NONBLOCK)
31872 @@ -1150,7 +1150,7 @@ ssize_t splice_direct_to_actor(struct fi
31873                  * out of the pipe right after the splice_to_pipe(). So set
31874                  * PIPE_READERS appropriately.
31875                  */
31876 -               pipe->readers = 1;
31877 +               atomic_set(&pipe->readers, 1);
31878
31879                 current->splice_pipe = pipe;
31880         }
31881 @@ -1710,9 +1710,9 @@ static int ipipe_prep(struct pipe_inode_
31882                         ret = -ERESTARTSYS;
31883                         break;
31884                 }
31885 -               if (!pipe->writers)
31886 +               if (!atomic_read(&pipe->writers))
31887                         break;
31888 -               if (!pipe->waiting_writers) {
31889 +               if (!atomic_read(&pipe->waiting_writers)) {
31890                         if (flags & SPLICE_F_NONBLOCK) {
31891                                 ret = -EAGAIN;
31892                                 break;
31893 @@ -1744,7 +1744,7 @@ static int opipe_prep(struct pipe_inode_
31894         pipe_lock(pipe);
31895
31896         while (pipe->nrbufs >= PIPE_BUFFERS) {
31897 -               if (!pipe->readers) {
31898 +               if (!atomic_read(&pipe->readers)) {
31899                         send_sig(SIGPIPE, current, 0);
31900                         ret = -EPIPE;
31901                         break;
31902 @@ -1757,9 +1757,9 @@ static int opipe_prep(struct pipe_inode_
31903                         ret = -ERESTARTSYS;
31904                         break;
31905                 }
31906 -               pipe->waiting_writers++;
31907 +               atomic_inc(&pipe->waiting_writers);
31908                 pipe_wait(pipe);
31909 -               pipe->waiting_writers--;
31910 +               atomic_dec(&pipe->waiting_writers);
31911         }
31912
31913         pipe_unlock(pipe);
31914 @@ -1795,14 +1795,14 @@ retry:
31915         pipe_double_lock(ipipe, opipe);
31916
31917         do {
31918 -               if (!opipe->readers) {
31919 +               if (!atomic_read(&opipe->readers)) {
31920                         send_sig(SIGPIPE, current, 0);
31921                         if (!ret)
31922                                 ret = -EPIPE;
31923                         break;
31924                 }
31925
31926 -               if (!ipipe->nrbufs && !ipipe->writers)
31927 +               if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
31928                         break;
31929
31930                 /*
31931 @@ -1902,7 +1902,7 @@ static int link_pipe(struct pipe_inode_i
31932         pipe_double_lock(ipipe, opipe);
31933
31934         do {
31935 -               if (!opipe->readers) {
31936 +               if (!atomic_read(&opipe->readers)) {
31937                         send_sig(SIGPIPE, current, 0);
31938                         if (!ret)
31939                                 ret = -EPIPE;
31940 @@ -1947,7 +1947,7 @@ static int link_pipe(struct pipe_inode_i
31941          * return EAGAIN if we have the potential of some data in the
31942          * future, otherwise just return 0
31943          */
31944 -       if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
31945 +       if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
31946                 ret = -EAGAIN;
31947
31948         pipe_unlock(ipipe);
31949 diff -urNp linux-2.6.33/fs/sysfs/file.c linux-2.6.33/fs/sysfs/file.c
31950 --- linux-2.6.33/fs/sysfs/file.c        2010-02-24 13:52:17.000000000 -0500
31951 +++ linux-2.6.33/fs/sysfs/file.c        2010-03-07 12:23:36.101714273 -0500
31952 @@ -53,7 +53,7 @@ struct sysfs_buffer {
31953         size_t                  count;
31954         loff_t                  pos;
31955         char                    * page;
31956 -       struct sysfs_ops        * ops;
31957 +       const struct sysfs_ops  * ops;
31958         struct mutex            mutex;
31959         int                     needs_read_fill;
31960         int                     event;
31961 @@ -75,7 +75,7 @@ static int fill_read_buffer(struct dentr
31962  {
31963         struct sysfs_dirent *attr_sd = dentry->d_fsdata;
31964         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
31965 -       struct sysfs_ops * ops = buffer->ops;
31966 +       const struct sysfs_ops * ops = buffer->ops;
31967         int ret = 0;
31968         ssize_t count;
31969
31970 @@ -199,7 +199,7 @@ flush_write_buffer(struct dentry * dentr
31971  {
31972         struct sysfs_dirent *attr_sd = dentry->d_fsdata;
31973         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
31974 -       struct sysfs_ops * ops = buffer->ops;
31975 +       const struct sysfs_ops * ops = buffer->ops;
31976         int rc;
31977
31978         /* need attr_sd for attr and ops, its parent for kobj */
31979 @@ -335,7 +335,7 @@ static int sysfs_open_file(struct inode
31980         struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
31981         struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
31982         struct sysfs_buffer *buffer;
31983 -       struct sysfs_ops *ops;
31984 +       const struct sysfs_ops *ops;
31985         int error = -EACCES;
31986         char *p;
31987
31988 diff -urNp linux-2.6.33/fs/sysfs/symlink.c linux-2.6.33/fs/sysfs/symlink.c
31989 --- linux-2.6.33/fs/sysfs/symlink.c     2010-02-24 13:52:17.000000000 -0500
31990 +++ linux-2.6.33/fs/sysfs/symlink.c     2010-03-07 12:23:36.101714273 -0500
31991 @@ -204,7 +204,7 @@ static void *sysfs_follow_link(struct de
31992
31993  static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
31994  {
31995 -       char *page = nd_get_link(nd);
31996 +       const char *page = nd_get_link(nd);
31997         if (!IS_ERR(page))
31998                 free_page((unsigned long)page);
31999  }
32000 diff -urNp linux-2.6.33/fs/udf/balloc.c linux-2.6.33/fs/udf/balloc.c
32001 --- linux-2.6.33/fs/udf/balloc.c        2010-02-24 13:52:17.000000000 -0500
32002 +++ linux-2.6.33/fs/udf/balloc.c        2010-03-07 12:23:36.101714273 -0500
32003 @@ -172,9 +172,7 @@ static void udf_bitmap_free_blocks(struc
32004
32005         mutex_lock(&sbi->s_alloc_mutex);
32006         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
32007 -       if (bloc->logicalBlockNum < 0 ||
32008 -           (bloc->logicalBlockNum + count) >
32009 -               partmap->s_partition_len) {
32010 +       if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
32011                 udf_debug("%d < %d || %d + %d > %d\n",
32012                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
32013                           count, partmap->s_partition_len);
32014 @@ -436,9 +434,7 @@ static void udf_table_free_blocks(struct
32015
32016         mutex_lock(&sbi->s_alloc_mutex);
32017         partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
32018 -       if (bloc->logicalBlockNum < 0 ||
32019 -           (bloc->logicalBlockNum + count) >
32020 -               partmap->s_partition_len) {
32021 +       if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
32022                 udf_debug("%d < %d || %d + %d > %d\n",
32023                           bloc->logicalBlockNum, 0, bloc->logicalBlockNum, count,
32024                           partmap->s_partition_len);
32025 diff -urNp linux-2.6.33/fs/utimes.c linux-2.6.33/fs/utimes.c
32026 --- linux-2.6.33/fs/utimes.c    2010-02-24 13:52:17.000000000 -0500
32027 +++ linux-2.6.33/fs/utimes.c    2010-03-07 12:23:36.101714273 -0500
32028 @@ -1,6 +1,7 @@
32029  #include <linux/compiler.h>
32030  #include <linux/file.h>
32031  #include <linux/fs.h>
32032 +#include <linux/security.h>
32033  #include <linux/linkage.h>
32034  #include <linux/mount.h>
32035  #include <linux/namei.h>
32036 @@ -101,6 +102,12 @@ static int utimes_common(struct path *pa
32037                                 goto mnt_drop_write_and_out;
32038                 }
32039         }
32040 +
32041 +       if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
32042 +               error = -EACCES;
32043 +               goto mnt_drop_write_and_out;
32044 +       }
32045 +
32046         mutex_lock(&inode->i_mutex);
32047         error = notify_change(path->dentry, &newattrs);
32048         mutex_unlock(&inode->i_mutex);
32049 diff -urNp linux-2.6.33/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.33/fs/xfs/linux-2.6/xfs_ioctl.c
32050 --- linux-2.6.33/fs/xfs/linux-2.6/xfs_ioctl.c   2010-02-24 13:52:17.000000000 -0500
32051 +++ linux-2.6.33/fs/xfs/linux-2.6/xfs_ioctl.c   2010-03-07 12:23:36.101714273 -0500
32052 @@ -135,7 +135,7 @@ xfs_find_handle(
32053         }
32054
32055         error = -EFAULT;
32056 -       if (copy_to_user(hreq->ohandle, &handle, hsize) ||
32057 +       if (hsize > sizeof(handle) || copy_to_user(hreq->ohandle, &handle, hsize) ||
32058             copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
32059                 goto out_put;
32060
32061 diff -urNp linux-2.6.33/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.33/fs/xfs/linux-2.6/xfs_iops.c
32062 --- linux-2.6.33/fs/xfs/linux-2.6/xfs_iops.c    2010-02-24 13:52:17.000000000 -0500
32063 +++ linux-2.6.33/fs/xfs/linux-2.6/xfs_iops.c    2010-03-07 12:23:36.101714273 -0500
32064 @@ -469,7 +469,7 @@ xfs_vn_put_link(
32065         struct nameidata *nd,
32066         void            *p)
32067  {
32068 -       char            *s = nd_get_link(nd);
32069 +       const char      *s = nd_get_link(nd);
32070
32071         if (!IS_ERR(s))
32072                 kfree(s);
32073 diff -urNp linux-2.6.33/fs/xfs/xfs_bmap.c linux-2.6.33/fs/xfs/xfs_bmap.c
32074 --- linux-2.6.33/fs/xfs/xfs_bmap.c      2010-02-24 13:52:17.000000000 -0500
32075 +++ linux-2.6.33/fs/xfs/xfs_bmap.c      2010-03-07 12:23:36.101714273 -0500
32076 @@ -296,7 +296,7 @@ xfs_bmap_validate_ret(
32077         int                     nmap,
32078         int                     ret_nmap);
32079  #else
32080 -#define        xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
32081 +#define        xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
32082  #endif /* DEBUG */
32083
32084  STATIC int
32085 diff -urNp linux-2.6.33/grsecurity/gracl_alloc.c linux-2.6.33/grsecurity/gracl_alloc.c
32086 --- linux-2.6.33/grsecurity/gracl_alloc.c       1969-12-31 19:00:00.000000000 -0500
32087 +++ linux-2.6.33/grsecurity/gracl_alloc.c       2010-03-07 12:23:36.101714273 -0500
32088 @@ -0,0 +1,105 @@
32089 +#include <linux/kernel.h>
32090 +#include <linux/mm.h>
32091 +#include <linux/slab.h>
32092 +#include <linux/vmalloc.h>
32093 +#include <linux/gracl.h>
32094 +#include <linux/grsecurity.h>
32095 +
32096 +static unsigned long alloc_stack_next = 1;
32097 +static unsigned long alloc_stack_size = 1;
32098 +static void **alloc_stack;
32099 +
32100 +static __inline__ int
32101 +alloc_pop(void)
32102 +{
32103 +       if (alloc_stack_next == 1)
32104 +               return 0;
32105 +
32106 +       kfree(alloc_stack[alloc_stack_next - 2]);
32107 +
32108 +       alloc_stack_next--;
32109 +
32110 +       return 1;
32111 +}
32112 +
32113 +static __inline__ int
32114 +alloc_push(void *buf)
32115 +{
32116 +       if (alloc_stack_next >= alloc_stack_size)
32117 +               return 1;
32118 +
32119 +       alloc_stack[alloc_stack_next - 1] = buf;
32120 +
32121 +       alloc_stack_next++;
32122 +
32123 +       return 0;
32124 +}
32125 +
32126 +void *
32127 +acl_alloc(unsigned long len)
32128 +{
32129 +       void *ret = NULL;
32130 +
32131 +       if (!len || len > PAGE_SIZE)
32132 +               goto out;
32133 +
32134 +       ret = kmalloc(len, GFP_KERNEL);
32135 +
32136 +       if (ret) {
32137 +               if (alloc_push(ret)) {
32138 +                       kfree(ret);
32139 +                       ret = NULL;
32140 +               }
32141 +       }
32142 +
32143 +out:
32144 +       return ret;
32145 +}
32146 +
32147 +void *
32148 +acl_alloc_num(unsigned long num, unsigned long len)
32149 +{
32150 +       if (!len || (num > (PAGE_SIZE / len)))
32151 +               return NULL;
32152 +
32153 +       return acl_alloc(num * len);
32154 +}
32155 +
32156 +void
32157 +acl_free_all(void)
32158 +{
32159 +       if (gr_acl_is_enabled() || !alloc_stack)
32160 +               return;
32161 +
32162 +       while (alloc_pop()) ;
32163 +
32164 +       if (alloc_stack) {
32165 +               if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
32166 +                       kfree(alloc_stack);
32167 +               else
32168 +                       vfree(alloc_stack);
32169 +       }
32170 +
32171 +       alloc_stack = NULL;
32172 +       alloc_stack_size = 1;
32173 +       alloc_stack_next = 1;
32174 +
32175 +       return;
32176 +}
32177 +
32178 +int
32179 +acl_alloc_stack_init(unsigned long size)
32180 +{
32181 +       if ((size * sizeof (void *)) <= PAGE_SIZE)
32182 +               alloc_stack =
32183 +                   (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
32184 +       else
32185 +               alloc_stack = (void **) vmalloc(size * sizeof (void *));
32186 +
32187 +       alloc_stack_size = size;
32188 +
32189 +       if (!alloc_stack)
32190 +               return 0;
32191 +       else
32192 +               return 1;
32193 +}
32194 diff -urNp linux-2.6.33/grsecurity/gracl.c linux-2.6.33/grsecurity/gracl.c
32195 --- linux-2.6.33/grsecurity/gracl.c     1969-12-31 19:00:00.000000000 -0500
32196 +++ linux-2.6.33/grsecurity/gracl.c     2010-03-07 12:23:36.105670657 -0500
32197 @@ -0,0 +1,3918 @@
32198 +#include <linux/kernel.h>
32199 +#include <linux/module.h>
32200 +#include <linux/sched.h>
32201 +#include <linux/mm.h>
32202 +#include <linux/file.h>
32203 +#include <linux/fs.h>
32204 +#include <linux/namei.h>
32205 +#include <linux/mount.h>
32206 +#include <linux/tty.h>
32207 +#include <linux/proc_fs.h>
32208 +#include <linux/smp_lock.h>
32209 +#include <linux/slab.h>
32210 +#include <linux/vmalloc.h>
32211 +#include <linux/types.h>
32212 +#include <linux/sysctl.h>
32213 +#include <linux/netdevice.h>
32214 +#include <linux/ptrace.h>
32215 +#include <linux/gracl.h>
32216 +#include <linux/gralloc.h>
32217 +#include <linux/grsecurity.h>
32218 +#include <linux/grinternal.h>
32219 +#include <linux/pid_namespace.h>
32220 +#include <linux/fdtable.h>
32221 +#include <linux/percpu.h>
32222 +
32223 +#include <asm/uaccess.h>
32224 +#include <asm/errno.h>
32225 +#include <asm/mman.h>
32226 +
32227 +static struct acl_role_db acl_role_set;
32228 +static struct name_db name_set;
32229 +static struct inodev_db inodev_set;
32230 +
32231 +/* for keeping track of userspace pointers used for subjects, so we
32232 +   can share references in the kernel as well
32233 +*/
32234 +
32235 +static struct dentry *real_root;
32236 +static struct vfsmount *real_root_mnt;
32237 +
32238 +static struct acl_subj_map_db subj_map_set;
32239 +
32240 +static struct acl_role_label *default_role;
32241 +
32242 +static struct acl_role_label *role_list;
32243 +
32244 +static u16 acl_sp_role_value;
32245 +
32246 +extern char *gr_shared_page[4];
32247 +static DECLARE_MUTEX(gr_dev_sem);
32248 +DEFINE_RWLOCK(gr_inode_lock);
32249 +
32250 +struct gr_arg *gr_usermode;
32251 +
32252 +static unsigned int gr_status __read_only = GR_STATUS_INIT;
32253 +
32254 +extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
32255 +extern void gr_clear_learn_entries(void);
32256 +
32257 +#ifdef CONFIG_GRKERNSEC_RESLOG
32258 +extern void gr_log_resource(const struct task_struct *task,
32259 +                           const int res, const unsigned long wanted, const int gt);
32260 +#endif
32261 +
32262 +unsigned char *gr_system_salt;
32263 +unsigned char *gr_system_sum;
32264 +
32265 +static struct sprole_pw **acl_special_roles = NULL;
32266 +static __u16 num_sprole_pws = 0;
32267 +
32268 +static struct acl_role_label *kernel_role = NULL;
32269 +
32270 +static unsigned int gr_auth_attempts = 0;
32271 +static unsigned long gr_auth_expires = 0UL;
32272 +
32273 +extern struct vfsmount *sock_mnt;
32274 +extern struct vfsmount *pipe_mnt;
32275 +extern struct vfsmount *shm_mnt;
32276 +static struct acl_object_label *fakefs_obj;
32277 +
32278 +extern int gr_init_uidset(void);
32279 +extern void gr_free_uidset(void);
32280 +extern void gr_remove_uid(uid_t uid);
32281 +extern int gr_find_uid(uid_t uid);
32282 +
32283 +__inline__ int
32284 +gr_acl_is_enabled(void)
32285 +{
32286 +       return (gr_status & GR_READY);
32287 +}
32288 +
32289 +char gr_roletype_to_char(void)
32290 +{
32291 +       switch (current->role->roletype &
32292 +               (GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
32293 +                GR_ROLE_SPECIAL)) {
32294 +       case GR_ROLE_DEFAULT:
32295 +               return 'D';
32296 +       case GR_ROLE_USER:
32297 +               return 'U';
32298 +       case GR_ROLE_GROUP:
32299 +               return 'G';
32300 +       case GR_ROLE_SPECIAL:
32301 +               return 'S';
32302 +       }
32303 +
32304 +       return 'X';
32305 +}
32306 +
32307 +__inline__ int
32308 +gr_acl_tpe_check(void)
32309 +{
32310 +       if (unlikely(!(gr_status & GR_READY)))
32311 +               return 0;
32312 +       if (current->role->roletype & GR_ROLE_TPE)
32313 +               return 1;
32314 +       else
32315 +               return 0;
32316 +}
32317 +
32318 +int
32319 +gr_handle_rawio(const struct inode *inode)
32320 +{
32321 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
32322 +       if (inode && S_ISBLK(inode->i_mode) &&
32323 +           grsec_enable_chroot_caps && proc_is_chrooted(current) &&
32324 +           !capable(CAP_SYS_RAWIO))
32325 +               return 1;
32326 +#endif
32327 +       return 0;
32328 +}
32329 +
32330 +static int
32331 +gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
32332 +{
32333 +       int i;
32334 +       unsigned long *l1;
32335 +       unsigned long *l2;
32336 +       unsigned char *c1;
32337 +       unsigned char *c2;
32338 +       int num_longs;
32339 +
32340 +       if (likely(lena != lenb))
32341 +               return 0;
32342 +
32343 +       l1 = (unsigned long *)a;
32344 +       l2 = (unsigned long *)b;
32345 +
32346 +       num_longs = lena / sizeof(unsigned long);
32347 +
32348 +       for (i = num_longs; i--; l1++, l2++) {
32349 +               if (unlikely(*l1 != *l2))
32350 +                       return 0;
32351 +       }
32352 +
32353 +       c1 = (unsigned char *) l1;
32354 +       c2 = (unsigned char *) l2;
32355 +
32356 +       i = lena - (num_longs * sizeof(unsigned long));
32357 +
32358 +       for (; i--; c1++, c2++) {
32359 +               if (unlikely(*c1 != *c2))
32360 +                       return 0;
32361 +       }
32362 +
32363 +       return 1;
32364 +}
32365 +
32366 +static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
32367 +                          struct dentry *root, struct vfsmount *rootmnt,
32368 +                          char *buffer, int buflen)
32369 +{
32370 +       char * end = buffer+buflen;
32371 +       char * retval;
32372 +       int namelen;
32373 +
32374 +       *--end = '\0';
32375 +       buflen--;
32376 +
32377 +       if (buflen < 1)
32378 +               goto Elong;
32379 +       /* Get '/' right */
32380 +       retval = end-1;
32381 +       *retval = '/';
32382 +
32383 +       for (;;) {
32384 +               struct dentry * parent;
32385 +
32386 +               if (dentry == root && vfsmnt == rootmnt)
32387 +                       break;
32388 +               if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
32389 +                       /* Global root? */
32390 +                       spin_lock(&vfsmount_lock);
32391 +                       if (vfsmnt->mnt_parent == vfsmnt) {
32392 +                               spin_unlock(&vfsmount_lock);
32393 +                               goto global_root;
32394 +                       }
32395 +                       dentry = vfsmnt->mnt_mountpoint;
32396 +                       vfsmnt = vfsmnt->mnt_parent;
32397 +                       spin_unlock(&vfsmount_lock);
32398 +                       continue;
32399 +               }
32400 +               parent = dentry->d_parent;
32401 +               prefetch(parent);
32402 +               namelen = dentry->d_name.len;
32403 +               buflen -= namelen + 1;
32404 +               if (buflen < 0)
32405 +                       goto Elong;
32406 +               end -= namelen;
32407 +               memcpy(end, dentry->d_name.name, namelen);
32408 +               *--end = '/';
32409 +               retval = end;
32410 +               dentry = parent;
32411 +       }
32412 +
32413 +       return retval;
32414 +
32415 +global_root:
32416 +       namelen = dentry->d_name.len;
32417 +       buflen -= namelen;
32418 +       if (buflen < 0)
32419 +               goto Elong;
32420 +       retval -= namelen-1;    /* hit the slash */
32421 +       memcpy(retval, dentry->d_name.name, namelen);
32422 +       return retval;
32423 +Elong:
32424 +       return ERR_PTR(-ENAMETOOLONG);
32425 +}
32426 +
32427 +static char *
32428 +gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
32429 +              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
32430 +{
32431 +       char *retval;
32432 +
32433 +       retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
32434 +       if (unlikely(IS_ERR(retval)))
32435 +               retval = strcpy(buf, "<path too long>");
32436 +       else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
32437 +               retval[1] = '\0';
32438 +
32439 +       return retval;
32440 +}
32441 +
32442 +static char *
32443 +__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
32444 +               char *buf, int buflen)
32445 +{
32446 +       char *res;
32447 +
32448 +       /* we can use real_root, real_root_mnt, because this is only called
32449 +          by the RBAC system */
32450 +       res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
32451 +
32452 +       return res;
32453 +}
32454 +
32455 +static char *
32456 +d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
32457 +           char *buf, int buflen)
32458 +{
32459 +       char *res;
32460 +       struct dentry *root;
32461 +       struct vfsmount *rootmnt;
32462 +       struct task_struct *reaper = &init_task;
32463 +
32464 +       /* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
32465 +       read_lock(&reaper->fs->lock);
32466 +       root = dget(reaper->fs->root.dentry);
32467 +       rootmnt = mntget(reaper->fs->root.mnt);
32468 +       read_unlock(&reaper->fs->lock);
32469 +
32470 +       spin_lock(&dcache_lock);
32471 +       res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
32472 +       spin_unlock(&dcache_lock);
32473 +
32474 +       dput(root);
32475 +       mntput(rootmnt);
32476 +       return res;
32477 +}
32478 +
32479 +static char *
32480 +gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
32481 +{
32482 +       char *ret;
32483 +       spin_lock(&dcache_lock);
32484 +       ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
32485 +                            PAGE_SIZE);
32486 +       spin_unlock(&dcache_lock);
32487 +       return ret;
32488 +}
32489 +
32490 +char *
32491 +gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
32492 +{
32493 +       return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
32494 +                            PAGE_SIZE);
32495 +}
32496 +
32497 +char *
32498 +gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
32499 +{
32500 +       return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
32501 +                          PAGE_SIZE);
32502 +}
32503 +
32504 +char *
32505 +gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
32506 +{
32507 +       return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
32508 +                          PAGE_SIZE);
32509 +}
32510 +
32511 +char *
32512 +gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
32513 +{
32514 +       return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
32515 +                          PAGE_SIZE);
32516 +}
32517 +
32518 +char *
32519 +gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
32520 +{
32521 +       return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
32522 +                          PAGE_SIZE);
32523 +}
32524 +
32525 +__inline__ __u32
32526 +to_gr_audit(const __u32 reqmode)
32527 +{
32528 +       /* masks off auditable permission flags, then shifts them to create
32529 +          auditing flags, and adds the special case of append auditing if
32530 +          we're requesting write */
32531 +       return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
32532 +}
32533 +
32534 +struct acl_subject_label *
32535 +lookup_subject_map(const struct acl_subject_label *userp)
32536 +{
32537 +       unsigned int index = shash(userp, subj_map_set.s_size);
32538 +       struct subject_map *match;
32539 +
32540 +       match = subj_map_set.s_hash[index];
32541 +
32542 +       while (match && match->user != userp)
32543 +               match = match->next;
32544 +
32545 +       if (match != NULL)
32546 +               return match->kernel;
32547 +       else
32548 +               return NULL;
32549 +}
32550 +
32551 +static void
32552 +insert_subj_map_entry(struct subject_map *subjmap)
32553 +{
32554 +       unsigned int index = shash(subjmap->user, subj_map_set.s_size);
32555 +       struct subject_map **curr;
32556 +
32557 +       subjmap->prev = NULL;
32558 +
32559 +       curr = &subj_map_set.s_hash[index];
32560 +       if (*curr != NULL)
32561 +               (*curr)->prev = subjmap;
32562 +
32563 +       subjmap->next = *curr;
32564 +       *curr = subjmap;
32565 +
32566 +       return;
32567 +}
32568 +
32569 +static struct acl_role_label *
32570 +lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
32571 +                     const gid_t gid)
32572 +{
32573 +       unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
32574 +       struct acl_role_label *match;
32575 +       struct role_allowed_ip *ipp;
32576 +       unsigned int x;
32577 +
32578 +       match = acl_role_set.r_hash[index];
32579 +
32580 +       while (match) {
32581 +               if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
32582 +                       for (x = 0; x < match->domain_child_num; x++) {
32583 +                               if (match->domain_children[x] == uid)
32584 +                                       goto found;
32585 +                       }
32586 +               } else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
32587 +                       break;
32588 +               match = match->next;
32589 +       }
32590 +found:
32591 +       if (match == NULL) {
32592 +             try_group:
32593 +               index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
32594 +               match = acl_role_set.r_hash[index];
32595 +
32596 +               while (match) {
32597 +                       if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
32598 +                               for (x = 0; x < match->domain_child_num; x++) {
32599 +                                       if (match->domain_children[x] == gid)
32600 +                                               goto found2;
32601 +                               }
32602 +                       } else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
32603 +                               break;
32604 +                       match = match->next;
32605 +               }
32606 +found2:
32607 +               if (match == NULL)
32608 +                       match = default_role;
32609 +               if (match->allowed_ips == NULL)
32610 +                       return match;
32611 +               else {
32612 +                       for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
32613 +                               if (likely
32614 +                                   ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
32615 +                                    (ntohl(ipp->addr) & ipp->netmask)))
32616 +                                       return match;
32617 +                       }
32618 +                       match = default_role;
32619 +               }
32620 +       } else if (match->allowed_ips == NULL) {
32621 +               return match;
32622 +       } else {
32623 +               for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
32624 +                       if (likely
32625 +                           ((ntohl(task->signal->curr_ip) & ipp->netmask) ==
32626 +                            (ntohl(ipp->addr) & ipp->netmask)))
32627 +                               return match;
32628 +               }
32629 +               goto try_group;
32630 +       }
32631 +
32632 +       return match;
32633 +}
32634 +
32635 +struct acl_subject_label *
32636 +lookup_acl_subj_label(const ino_t ino, const dev_t dev,
32637 +                     const struct acl_role_label *role)
32638 +{
32639 +       unsigned int index = fhash(ino, dev, role->subj_hash_size);
32640 +       struct acl_subject_label *match;
32641 +
32642 +       match = role->subj_hash[index];
32643 +
32644 +       while (match && (match->inode != ino || match->device != dev ||
32645 +              (match->mode & GR_DELETED))) {
32646 +               match = match->next;
32647 +       }
32648 +
32649 +       if (match && !(match->mode & GR_DELETED))
32650 +               return match;
32651 +       else
32652 +               return NULL;
32653 +}
32654 +
32655 +struct acl_subject_label *
32656 +lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
32657 +                         const struct acl_role_label *role)
32658 +{
32659 +       unsigned int index = fhash(ino, dev, role->subj_hash_size);
32660 +       struct acl_subject_label *match;
32661 +
32662 +       match = role->subj_hash[index];
32663 +
32664 +       while (match && (match->inode != ino || match->device != dev ||
32665 +              !(match->mode & GR_DELETED))) {
32666 +               match = match->next;
32667 +       }
32668 +
32669 +       if (match && (match->mode & GR_DELETED))
32670 +               return match;
32671 +       else
32672 +               return NULL;
32673 +}
32674 +
32675 +static struct acl_object_label *
32676 +lookup_acl_obj_label(const ino_t ino, const dev_t dev,
32677 +                    const struct acl_subject_label *subj)
32678 +{
32679 +       unsigned int index = fhash(ino, dev, subj->obj_hash_size);
32680 +       struct acl_object_label *match;
32681 +
32682 +       match = subj->obj_hash[index];
32683 +
32684 +       while (match && (match->inode != ino || match->device != dev ||
32685 +              (match->mode & GR_DELETED))) {
32686 +               match = match->next;
32687 +       }
32688 +
32689 +       if (match && !(match->mode & GR_DELETED))
32690 +               return match;
32691 +       else
32692 +               return NULL;
32693 +}
32694 +
32695 +static struct acl_object_label *
32696 +lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
32697 +                    const struct acl_subject_label *subj)
32698 +{
32699 +       unsigned int index = fhash(ino, dev, subj->obj_hash_size);
32700 +       struct acl_object_label *match;
32701 +
32702 +       match = subj->obj_hash[index];
32703 +
32704 +       while (match && (match->inode != ino || match->device != dev ||
32705 +              !(match->mode & GR_DELETED))) {
32706 +               match = match->next;
32707 +       }
32708 +
32709 +       if (match && (match->mode & GR_DELETED))
32710 +               return match;
32711 +
32712 +       match = subj->obj_hash[index];
32713 +
32714 +       while (match && (match->inode != ino || match->device != dev ||
32715 +              (match->mode & GR_DELETED))) {
32716 +               match = match->next;
32717 +       }
32718 +
32719 +       if (match && !(match->mode & GR_DELETED))
32720 +               return match;
32721 +       else
32722 +               return NULL;
32723 +}
32724 +
32725 +static struct name_entry *
32726 +lookup_name_entry(const char *name)
32727 +{
32728 +       unsigned int len = strlen(name);
32729 +       unsigned int key = full_name_hash(name, len);
32730 +       unsigned int index = key % name_set.n_size;
32731 +       struct name_entry *match;
32732 +
32733 +       match = name_set.n_hash[index];
32734 +
32735 +       while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
32736 +               match = match->next;
32737 +
32738 +       return match;
32739 +}
32740 +
32741 +static struct name_entry *
32742 +lookup_name_entry_create(const char *name)
32743 +{
32744 +       unsigned int len = strlen(name);
32745 +       unsigned int key = full_name_hash(name, len);
32746 +       unsigned int index = key % name_set.n_size;
32747 +       struct name_entry *match;
32748 +
32749 +       match = name_set.n_hash[index];
32750 +
32751 +       while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
32752 +                        !match->deleted))
32753 +               match = match->next;
32754 +
32755 +       if (match && match->deleted)
32756 +               return match;
32757 +
32758 +       match = name_set.n_hash[index];
32759 +
32760 +       while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
32761 +                        match->deleted))
32762 +               match = match->next;
32763 +
32764 +       if (match && !match->deleted)
32765 +               return match;
32766 +       else
32767 +               return NULL;
32768 +}
32769 +
32770 +static struct inodev_entry *
32771 +lookup_inodev_entry(const ino_t ino, const dev_t dev)
32772 +{
32773 +       unsigned int index = fhash(ino, dev, inodev_set.i_size);
32774 +       struct inodev_entry *match;
32775 +
32776 +       match = inodev_set.i_hash[index];
32777 +
32778 +       while (match && (match->nentry->inode != ino || match->nentry->device != dev))
32779 +               match = match->next;
32780 +
32781 +       return match;
32782 +}
32783 +
32784 +static void
32785 +insert_inodev_entry(struct inodev_entry *entry)
32786 +{
32787 +       unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
32788 +                                   inodev_set.i_size);
32789 +       struct inodev_entry **curr;
32790 +
32791 +       entry->prev = NULL;
32792 +
32793 +       curr = &inodev_set.i_hash[index];
32794 +       if (*curr != NULL)
32795 +               (*curr)->prev = entry;
32796 +
32797 +       entry->next = *curr;
32798 +       *curr = entry;
32799 +
32800 +       return;
32801 +}
32802 +
32803 +static void
32804 +__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
32805 +{
32806 +       unsigned int index =
32807 +           rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
32808 +       struct acl_role_label **curr;
32809 +       struct acl_role_label *tmp;
32810 +
32811 +       curr = &acl_role_set.r_hash[index];
32812 +
32813 +       /* if role was already inserted due to domains and already has
32814 +          a role in the same bucket as it attached, then we need to
32815 +          combine these two buckets
32816 +       */
32817 +       if (role->next) {
32818 +               tmp = role->next;
32819 +               while (tmp->next)
32820 +                       tmp = tmp->next;
32821 +               tmp->next = *curr;
32822 +       } else
32823 +               role->next = *curr;
32824 +       *curr = role;
32825 +
32826 +       return;
32827 +}
32828 +
32829 +static void
32830 +insert_acl_role_label(struct acl_role_label *role)
32831 +{
32832 +       int i;
32833 +
32834 +       if (role_list == NULL) {
32835 +               role_list = role;
32836 +               role->prev = NULL;
32837 +       } else {
32838 +               role->prev = role_list;
32839 +               role_list = role;
32840 +       }
32841 +
32842 +       /* used for hash chains */
32843 +       role->next = NULL;
32844 +
32845 +       if (role->roletype & GR_ROLE_DOMAIN) {
32846 +               for (i = 0; i < role->domain_child_num; i++)
32847 +                       __insert_acl_role_label(role, role->domain_children[i]);
32848 +       } else
32849 +               __insert_acl_role_label(role, role->uidgid);
32850 +}
32851 +
32852 +static int
32853 +insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
32854 +{
32855 +       struct name_entry **curr, *nentry;
32856 +       struct inodev_entry *ientry;
32857 +       unsigned int len = strlen(name);
32858 +       unsigned int key = full_name_hash(name, len);
32859 +       unsigned int index = key % name_set.n_size;
32860 +
32861 +       curr = &name_set.n_hash[index];
32862 +
32863 +       while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
32864 +               curr = &((*curr)->next);
32865 +
32866 +       if (*curr != NULL)
32867 +               return 1;
32868 +
32869 +       nentry = acl_alloc(sizeof (struct name_entry));
32870 +       if (nentry == NULL)
32871 +               return 0;
32872 +       ientry = acl_alloc(sizeof (struct inodev_entry));
32873 +       if (ientry == NULL)
32874 +               return 0;
32875 +       ientry->nentry = nentry;
32876 +
32877 +       nentry->key = key;
32878 +       nentry->name = name;
32879 +       nentry->inode = inode;
32880 +       nentry->device = device;
32881 +       nentry->len = len;
32882 +       nentry->deleted = deleted;
32883 +
32884 +       nentry->prev = NULL;
32885 +       curr = &name_set.n_hash[index];
32886 +       if (*curr != NULL)
32887 +               (*curr)->prev = nentry;
32888 +       nentry->next = *curr;
32889 +       *curr = nentry;
32890 +
32891 +       /* insert us into the table searchable by inode/dev */
32892 +       insert_inodev_entry(ientry);
32893 +
32894 +       return 1;
32895 +}
32896 +
32897 +static void
32898 +insert_acl_obj_label(struct acl_object_label *obj,
32899 +                    struct acl_subject_label *subj)
32900 +{
32901 +       unsigned int index =
32902 +           fhash(obj->inode, obj->device, subj->obj_hash_size);
32903 +       struct acl_object_label **curr;
32904 +
32905 +
32906 +       obj->prev = NULL;
32907 +
32908 +       curr = &subj->obj_hash[index];
32909 +       if (*curr != NULL)
32910 +               (*curr)->prev = obj;
32911 +
32912 +       obj->next = *curr;
32913 +       *curr = obj;
32914 +
32915 +       return;
32916 +}
32917 +
32918 +static void
32919 +insert_acl_subj_label(struct acl_subject_label *obj,
32920 +                     struct acl_role_label *role)
32921 +{
32922 +       unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
32923 +       struct acl_subject_label **curr;
32924 +
32925 +       obj->prev = NULL;
32926 +
32927 +       curr = &role->subj_hash[index];
32928 +       if (*curr != NULL)
32929 +               (*curr)->prev = obj;
32930 +
32931 +       obj->next = *curr;
32932 +       *curr = obj;
32933 +
32934 +       return;
32935 +}
32936 +
32937 +/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
32938 +
32939 +static void *
32940 +create_table(__u32 * len, int elementsize)
32941 +{
32942 +       unsigned int table_sizes[] = {
32943 +               7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
32944 +               32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
32945 +               4194301, 8388593, 16777213, 33554393, 67108859
32946 +       };
32947 +       void *newtable = NULL;
32948 +       unsigned int pwr = 0;
32949 +
32950 +       while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
32951 +              table_sizes[pwr] <= *len)
32952 +               pwr++;
32953 +
32954 +       if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
32955 +               return newtable;
32956 +
32957 +       if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
32958 +               newtable =
32959 +                   kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
32960 +       else
32961 +               newtable = vmalloc(table_sizes[pwr] * elementsize);
32962 +
32963 +       *len = table_sizes[pwr];
32964 +
32965 +       return newtable;
32966 +}
32967 +
32968 +static int
32969 +init_variables(const struct gr_arg *arg)
32970 +{
32971 +       struct task_struct *reaper = &init_task;
32972 +       unsigned int stacksize;
32973 +
32974 +       subj_map_set.s_size = arg->role_db.num_subjects;
32975 +       acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
32976 +       name_set.n_size = arg->role_db.num_objects;
32977 +       inodev_set.i_size = arg->role_db.num_objects;
32978 +
32979 +       if (!subj_map_set.s_size || !acl_role_set.r_size ||
32980 +           !name_set.n_size || !inodev_set.i_size)
32981 +               return 1;
32982 +
32983 +       if (!gr_init_uidset())
32984 +               return 1;
32985 +
32986 +       /* set up the stack that holds allocation info */
32987 +
32988 +       stacksize = arg->role_db.num_pointers + 5;
32989 +
32990 +       if (!acl_alloc_stack_init(stacksize))
32991 +               return 1;
32992 +
32993 +       /* grab reference for the real root dentry and vfsmount */
32994 +       read_lock(&reaper->fs->lock);
32995 +       real_root_mnt = mntget(reaper->fs->root.mnt);
32996 +       real_root = dget(reaper->fs->root.dentry);
32997 +       read_unlock(&reaper->fs->lock);
32998 +
32999 +       fakefs_obj = acl_alloc(sizeof(struct acl_object_label));
33000 +       if (fakefs_obj == NULL)
33001 +               return 1;
33002 +       fakefs_obj->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
33003 +
33004 +       subj_map_set.s_hash =
33005 +           (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
33006 +       acl_role_set.r_hash =
33007 +           (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
33008 +       name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
33009 +       inodev_set.i_hash =
33010 +           (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
33011 +
33012 +       if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
33013 +           !name_set.n_hash || !inodev_set.i_hash)
33014 +               return 1;
33015 +
33016 +       memset(subj_map_set.s_hash, 0,
33017 +              sizeof(struct subject_map *) * subj_map_set.s_size);
33018 +       memset(acl_role_set.r_hash, 0,
33019 +              sizeof (struct acl_role_label *) * acl_role_set.r_size);
33020 +       memset(name_set.n_hash, 0,
33021 +              sizeof (struct name_entry *) * name_set.n_size);
33022 +       memset(inodev_set.i_hash, 0,
33023 +              sizeof (struct inodev_entry *) * inodev_set.i_size);
33024 +
33025 +       return 0;
33026 +}
33027 +
33028 +/* free information not needed after startup
33029 +   currently contains user->kernel pointer mappings for subjects
33030 +*/
33031 +
33032 +static void
33033 +free_init_variables(void)
33034 +{
33035 +       __u32 i;
33036 +
33037 +       if (subj_map_set.s_hash) {
33038 +               for (i = 0; i < subj_map_set.s_size; i++) {
33039 +                       if (subj_map_set.s_hash[i]) {
33040 +                               kfree(subj_map_set.s_hash[i]);
33041 +                               subj_map_set.s_hash[i] = NULL;
33042 +                       }
33043 +               }
33044 +
33045 +               if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
33046 +                   PAGE_SIZE)
33047 +                       kfree(subj_map_set.s_hash);
33048 +               else
33049 +                       vfree(subj_map_set.s_hash);
33050 +       }
33051 +
33052 +       return;
33053 +}
33054 +
33055 +static void
33056 +free_variables(void)
33057 +{
33058 +       struct acl_subject_label *s;
33059 +       struct acl_role_label *r;
33060 +       struct task_struct *task, *task2;
33061 +       unsigned int x;
33062 +
33063 +       gr_clear_learn_entries();
33064 +
33065 +       read_lock(&tasklist_lock);
33066 +       do_each_thread(task2, task) {
33067 +               task->acl_sp_role = 0;
33068 +               task->acl_role_id = 0;
33069 +               task->acl = NULL;
33070 +               task->role = NULL;
33071 +       } while_each_thread(task2, task);
33072 +       read_unlock(&tasklist_lock);
33073 +
33074 +       /* release the reference to the real root dentry and vfsmount */
33075 +       if (real_root)
33076 +               dput(real_root);
33077 +       real_root = NULL;
33078 +       if (real_root_mnt)
33079 +               mntput(real_root_mnt);
33080 +       real_root_mnt = NULL;
33081 +
33082 +       /* free all object hash tables */
33083 +
33084 +       FOR_EACH_ROLE_START(r)
33085 +               if (r->subj_hash == NULL)
33086 +                       goto next_role;
33087 +               FOR_EACH_SUBJECT_START(r, s, x)
33088 +                       if (s->obj_hash == NULL)
33089 +                               break;
33090 +                       if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
33091 +                               kfree(s->obj_hash);
33092 +                       else
33093 +                               vfree(s->obj_hash);
33094 +               FOR_EACH_SUBJECT_END(s, x)
33095 +               FOR_EACH_NESTED_SUBJECT_START(r, s)
33096 +                       if (s->obj_hash == NULL)
33097 +                               break;
33098 +                       if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
33099 +                               kfree(s->obj_hash);
33100 +                       else
33101 +                               vfree(s->obj_hash);
33102 +               FOR_EACH_NESTED_SUBJECT_END(s)
33103 +               if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
33104 +                       kfree(r->subj_hash);
33105 +               else
33106 +                       vfree(r->subj_hash);
33107 +               r->subj_hash = NULL;
33108 +next_role:
33109 +       FOR_EACH_ROLE_END(r)
33110 +
33111 +       acl_free_all();
33112 +
33113 +       if (acl_role_set.r_hash) {
33114 +               if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
33115 +                   PAGE_SIZE)
33116 +                       kfree(acl_role_set.r_hash);
33117 +               else
33118 +                       vfree(acl_role_set.r_hash);
33119 +       }
33120 +       if (name_set.n_hash) {
33121 +               if ((name_set.n_size * sizeof (struct name_entry *)) <=
33122 +                   PAGE_SIZE)
33123 +                       kfree(name_set.n_hash);
33124 +               else
33125 +                       vfree(name_set.n_hash);
33126 +       }
33127 +
33128 +       if (inodev_set.i_hash) {
33129 +               if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
33130 +                   PAGE_SIZE)
33131 +                       kfree(inodev_set.i_hash);
33132 +               else
33133 +                       vfree(inodev_set.i_hash);
33134 +       }
33135 +
33136 +       gr_free_uidset();
33137 +
33138 +       memset(&name_set, 0, sizeof (struct name_db));
33139 +       memset(&inodev_set, 0, sizeof (struct inodev_db));
33140 +       memset(&acl_role_set, 0, sizeof (struct acl_role_db));
33141 +       memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
33142 +
33143 +       default_role = NULL;
33144 +       role_list = NULL;
33145 +
33146 +       return;
33147 +}
33148 +
33149 +static __u32
33150 +count_user_objs(struct acl_object_label *userp)
33151 +{
33152 +       struct acl_object_label o_tmp;
33153 +       __u32 num = 0;
33154 +
33155 +       while (userp) {
33156 +               if (copy_from_user(&o_tmp, userp,
33157 +                                  sizeof (struct acl_object_label)))
33158 +                       break;
33159 +
33160 +               userp = o_tmp.prev;
33161 +               num++;
33162 +       }
33163 +
33164 +       return num;
33165 +}
33166 +
33167 +static struct acl_subject_label *
33168 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
33169 +
33170 +static int
33171 +copy_user_glob(struct acl_object_label *obj)
33172 +{
33173 +       struct acl_object_label *g_tmp, **guser;
33174 +       unsigned int len;
33175 +       char *tmp;
33176 +
33177 +       if (obj->globbed == NULL)
33178 +               return 0;
33179 +
33180 +       guser = &obj->globbed;
33181 +       while (*guser) {
33182 +               g_tmp = (struct acl_object_label *)
33183 +                       acl_alloc(sizeof (struct acl_object_label));
33184 +               if (g_tmp == NULL)
33185 +                       return -ENOMEM;
33186 +
33187 +               if (copy_from_user(g_tmp, *guser,
33188 +                                  sizeof (struct acl_object_label)))
33189 +                       return -EFAULT;
33190 +
33191 +               len = strnlen_user(g_tmp->filename, PATH_MAX);
33192 +
33193 +               if (!len || len >= PATH_MAX)
33194 +                       return -EINVAL;
33195 +
33196 +               if ((tmp = (char *) acl_alloc(len)) == NULL)
33197 +                       return -ENOMEM;
33198 +
33199 +               if (copy_from_user(tmp, g_tmp->filename, len))
33200 +                       return -EFAULT;
33201 +               tmp[len-1] = '\0';
33202 +               g_tmp->filename = tmp;
33203 +
33204 +               *guser = g_tmp;
33205 +               guser = &(g_tmp->next);
33206 +       }
33207 +
33208 +       return 0;
33209 +}
33210 +
33211 +static int
33212 +copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
33213 +              struct acl_role_label *role)
33214 +{
33215 +       struct acl_object_label *o_tmp;
33216 +       unsigned int len;
33217 +       int ret;
33218 +       char *tmp;
33219 +
33220 +       while (userp) {
33221 +               if ((o_tmp = (struct acl_object_label *)
33222 +                    acl_alloc(sizeof (struct acl_object_label))) == NULL)
33223 +                       return -ENOMEM;
33224 +
33225 +               if (copy_from_user(o_tmp, userp,
33226 +                                  sizeof (struct acl_object_label)))
33227 +                       return -EFAULT;
33228 +
33229 +               userp = o_tmp->prev;
33230 +
33231 +               len = strnlen_user(o_tmp->filename, PATH_MAX);
33232 +
33233 +               if (!len || len >= PATH_MAX)
33234 +                       return -EINVAL;
33235 +
33236 +               if ((tmp = (char *) acl_alloc(len)) == NULL)
33237 +                       return -ENOMEM;
33238 +
33239 +               if (copy_from_user(tmp, o_tmp->filename, len))
33240 +                       return -EFAULT;
33241 +               tmp[len-1] = '\0';
33242 +               o_tmp->filename = tmp;
33243 +
33244 +               insert_acl_obj_label(o_tmp, subj);
33245 +               if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
33246 +                                      o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
33247 +                       return -ENOMEM;
33248 +
33249 +               ret = copy_user_glob(o_tmp);
33250 +               if (ret)
33251 +                       return ret;
33252 +
33253 +               if (o_tmp->nested) {
33254 +                       o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
33255 +                       if (IS_ERR(o_tmp->nested))
33256 +                               return PTR_ERR(o_tmp->nested);
33257 +
33258 +                       /* insert into nested subject list */
33259 +                       o_tmp->nested->next = role->hash->first;
33260 +                       role->hash->first = o_tmp->nested;
33261 +               }
33262 +       }
33263 +
33264 +       return 0;
33265 +}
33266 +
33267 +static __u32
33268 +count_user_subjs(struct acl_subject_label *userp)
33269 +{
33270 +       struct acl_subject_label s_tmp;
33271 +       __u32 num = 0;
33272 +
33273 +       while (userp) {
33274 +               if (copy_from_user(&s_tmp, userp,
33275 +                                  sizeof (struct acl_subject_label)))
33276 +                       break;
33277 +
33278 +               userp = s_tmp.prev;
33279 +               /* do not count nested subjects against this count, since
33280 +                  they are not included in the hash table, but are
33281 +                  attached to objects.  We have already counted
33282 +                  the subjects in userspace for the allocation
33283 +                  stack
33284 +               */
33285 +               if (!(s_tmp.mode & GR_NESTED))
33286 +                       num++;
33287 +       }
33288 +
33289 +       return num;
33290 +}
33291 +
33292 +static int
33293 +copy_user_allowedips(struct acl_role_label *rolep)
33294 +{
33295 +       struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
33296 +
33297 +       ruserip = rolep->allowed_ips;
33298 +
33299 +       while (ruserip) {
33300 +               rlast = rtmp;
33301 +
33302 +               if ((rtmp = (struct role_allowed_ip *)
33303 +                    acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
33304 +                       return -ENOMEM;
33305 +
33306 +               if (copy_from_user(rtmp, ruserip,
33307 +                                  sizeof (struct role_allowed_ip)))
33308 +                       return -EFAULT;
33309 +
33310 +               ruserip = rtmp->prev;
33311 +
33312 +               if (!rlast) {
33313 +                       rtmp->prev = NULL;
33314 +                       rolep->allowed_ips = rtmp;
33315 +               } else {
33316 +                       rlast->next = rtmp;
33317 +                       rtmp->prev = rlast;
33318 +               }
33319 +
33320 +               if (!ruserip)
33321 +                       rtmp->next = NULL;
33322 +       }
33323 +
33324 +       return 0;
33325 +}
33326 +
33327 +static int
33328 +copy_user_transitions(struct acl_role_label *rolep)
33329 +{
33330 +       struct role_transition *rusertp, *rtmp = NULL, *rlast;
33331 +
33332 +       unsigned int len;
33333 +       char *tmp;
33334 +
33335 +       rusertp = rolep->transitions;
33336 +
33337 +       while (rusertp) {
33338 +               rlast = rtmp;
33339 +
33340 +               if ((rtmp = (struct role_transition *)
33341 +                    acl_alloc(sizeof (struct role_transition))) == NULL)
33342 +                       return -ENOMEM;
33343 +
33344 +               if (copy_from_user(rtmp, rusertp,
33345 +                                  sizeof (struct role_transition)))
33346 +                       return -EFAULT;
33347 +
33348 +               rusertp = rtmp->prev;
33349 +
33350 +               len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
33351 +
33352 +               if (!len || len >= GR_SPROLE_LEN)
33353 +                       return -EINVAL;
33354 +
33355 +               if ((tmp = (char *) acl_alloc(len)) == NULL)
33356 +                       return -ENOMEM;
33357 +
33358 +               if (copy_from_user(tmp, rtmp->rolename, len))
33359 +                       return -EFAULT;
33360 +               tmp[len-1] = '\0';
33361 +               rtmp->rolename = tmp;
33362 +
33363 +               if (!rlast) {
33364 +                       rtmp->prev = NULL;
33365 +                       rolep->transitions = rtmp;
33366 +               } else {
33367 +                       rlast->next = rtmp;
33368 +                       rtmp->prev = rlast;
33369 +               }
33370 +
33371 +               if (!rusertp)
33372 +                       rtmp->next = NULL;
33373 +       }
33374 +
33375 +       return 0;
33376 +}
33377 +
33378 +static struct acl_subject_label *
33379 +do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
33380 +{
33381 +       struct acl_subject_label *s_tmp = NULL, *s_tmp2;
33382 +       unsigned int len;
33383 +       char *tmp;
33384 +       __u32 num_objs;
33385 +       struct acl_ip_label **i_tmp, *i_utmp2;
33386 +       struct gr_hash_struct ghash;
33387 +       struct subject_map *subjmap;
33388 +       unsigned int i_num;
33389 +       int err;
33390 +
33391 +       s_tmp = lookup_subject_map(userp);
33392 +
33393 +       /* we've already copied this subject into the kernel, just return
33394 +          the reference to it, and don't copy it over again
33395 +       */
33396 +       if (s_tmp)
33397 +               return(s_tmp);
33398 +
33399 +       if ((s_tmp = (struct acl_subject_label *)
33400 +           acl_alloc(sizeof (struct acl_subject_label))) == NULL)
33401 +               return ERR_PTR(-ENOMEM);
33402 +
33403 +       subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
33404 +       if (subjmap == NULL)
33405 +               return ERR_PTR(-ENOMEM);
33406 +
33407 +       subjmap->user = userp;
33408 +       subjmap->kernel = s_tmp;
33409 +       insert_subj_map_entry(subjmap);
33410 +
33411 +       if (copy_from_user(s_tmp, userp,
33412 +                          sizeof (struct acl_subject_label)))
33413 +               return ERR_PTR(-EFAULT);
33414 +
33415 +       len = strnlen_user(s_tmp->filename, PATH_MAX);
33416 +
33417 +       if (!len || len >= PATH_MAX)
33418 +               return ERR_PTR(-EINVAL);
33419 +
33420 +       if ((tmp = (char *) acl_alloc(len)) == NULL)
33421 +               return ERR_PTR(-ENOMEM);
33422 +
33423 +       if (copy_from_user(tmp, s_tmp->filename, len))
33424 +               return ERR_PTR(-EFAULT);
33425 +       tmp[len-1] = '\0';
33426 +       s_tmp->filename = tmp;
33427 +
33428 +       if (!strcmp(s_tmp->filename, "/"))
33429 +               role->root_label = s_tmp;
33430 +
33431 +       if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
33432 +               return ERR_PTR(-EFAULT);
33433 +
33434 +       /* copy user and group transition tables */
33435 +
33436 +       if (s_tmp->user_trans_num) {
33437 +               uid_t *uidlist;
33438 +
33439 +               uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
33440 +               if (uidlist == NULL)
33441 +                       return ERR_PTR(-ENOMEM);
33442 +               if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
33443 +                       return ERR_PTR(-EFAULT);
33444 +
33445 +               s_tmp->user_transitions = uidlist;
33446 +       }
33447 +
33448 +       if (s_tmp->group_trans_num) {
33449 +               gid_t *gidlist;
33450 +
33451 +               gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
33452 +               if (gidlist == NULL)
33453 +                       return ERR_PTR(-ENOMEM);
33454 +               if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
33455 +                       return ERR_PTR(-EFAULT);
33456 +
33457 +               s_tmp->group_transitions = gidlist;
33458 +       }
33459 +
33460 +       /* set up object hash table */
33461 +       num_objs = count_user_objs(ghash.first);
33462 +
33463 +       s_tmp->obj_hash_size = num_objs;
33464 +       s_tmp->obj_hash =
33465 +           (struct acl_object_label **)
33466 +           create_table(&(s_tmp->obj_hash_size), sizeof(void *));
33467 +
33468 +       if (!s_tmp->obj_hash)
33469 +               return ERR_PTR(-ENOMEM);
33470 +
33471 +       memset(s_tmp->obj_hash, 0,
33472 +              s_tmp->obj_hash_size *
33473 +              sizeof (struct acl_object_label *));
33474 +
33475 +       /* add in objects */
33476 +       err = copy_user_objs(ghash.first, s_tmp, role);
33477 +
33478 +       if (err)
33479 +               return ERR_PTR(err);
33480 +
33481 +       /* set pointer for parent subject */
33482 +       if (s_tmp->parent_subject) {
33483 +               s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
33484 +
33485 +               if (IS_ERR(s_tmp2))
33486 +                       return s_tmp2;
33487 +
33488 +               s_tmp->parent_subject = s_tmp2;
33489 +       }
33490 +
33491 +       /* add in ip acls */
33492 +
33493 +       if (!s_tmp->ip_num) {
33494 +               s_tmp->ips = NULL;
33495 +               goto insert;
33496 +       }
33497 +
33498 +       i_tmp =
33499 +           (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
33500 +                                              sizeof (struct acl_ip_label *));
33501 +
33502 +       if (!i_tmp)
33503 +               return ERR_PTR(-ENOMEM);
33504 +
33505 +       for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
33506 +               *(i_tmp + i_num) =
33507 +                   (struct acl_ip_label *)
33508 +                   acl_alloc(sizeof (struct acl_ip_label));
33509 +               if (!*(i_tmp + i_num))
33510 +                       return ERR_PTR(-ENOMEM);
33511 +
33512 +               if (copy_from_user
33513 +                   (&i_utmp2, s_tmp->ips + i_num,
33514 +                    sizeof (struct acl_ip_label *)))
33515 +                       return ERR_PTR(-EFAULT);
33516 +
33517 +               if (copy_from_user
33518 +                   (*(i_tmp + i_num), i_utmp2,
33519 +                    sizeof (struct acl_ip_label)))
33520 +                       return ERR_PTR(-EFAULT);
33521 +
33522 +               if ((*(i_tmp + i_num))->iface == NULL)
33523 +                       continue;
33524 +
33525 +               len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
33526 +               if (!len || len >= IFNAMSIZ)
33527 +                       return ERR_PTR(-EINVAL);
33528 +               tmp = acl_alloc(len);
33529 +               if (tmp == NULL)
33530 +                       return ERR_PTR(-ENOMEM);
33531 +               if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
33532 +                       return ERR_PTR(-EFAULT);
33533 +               (*(i_tmp + i_num))->iface = tmp;
33534 +       }
33535 +
33536 +       s_tmp->ips = i_tmp;
33537 +
33538 +insert:
33539 +       if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
33540 +                              s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
33541 +               return ERR_PTR(-ENOMEM);
33542 +
33543 +       return s_tmp;
33544 +}
33545 +
33546 +static int
33547 +copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
33548 +{
33549 +       struct acl_subject_label s_pre;
33550 +       struct acl_subject_label * ret;
33551 +       int err;
33552 +
33553 +       while (userp) {
33554 +               if (copy_from_user(&s_pre, userp,
33555 +                                  sizeof (struct acl_subject_label)))
33556 +                       return -EFAULT;
33557 +
33558 +               /* do not add nested subjects here, add
33559 +                  while parsing objects
33560 +               */
33561 +
33562 +               if (s_pre.mode & GR_NESTED) {
33563 +                       userp = s_pre.prev;
33564 +                       continue;
33565 +               }
33566 +
33567 +               ret = do_copy_user_subj(userp, role);
33568 +
33569 +               err = PTR_ERR(ret);
33570 +               if (IS_ERR(ret))
33571 +                       return err;
33572 +
33573 +               insert_acl_subj_label(ret, role);
33574 +
33575 +               userp = s_pre.prev;
33576 +       }
33577 +
33578 +       return 0;
33579 +}
33580 +
33581 +static int
33582 +copy_user_acl(struct gr_arg *arg)
33583 +{
33584 +       struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
33585 +       struct sprole_pw *sptmp;
33586 +       struct gr_hash_struct *ghash;
33587 +       uid_t *domainlist;
33588 +       unsigned int r_num;
33589 +       unsigned int len;
33590 +       char *tmp;
33591 +       int err = 0;
33592 +       __u16 i;
33593 +       __u32 num_subjs;
33594 +
33595 +       /* we need a default and kernel role */
33596 +       if (arg->role_db.num_roles < 2)
33597 +               return -EINVAL;
33598 +
33599 +       /* copy special role authentication info from userspace */
33600 +
33601 +       num_sprole_pws = arg->num_sprole_pws;
33602 +       acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
33603 +
33604 +       if (!acl_special_roles) {
33605 +               err = -ENOMEM;
33606 +               goto cleanup;
33607 +       }
33608 +
33609 +       for (i = 0; i < num_sprole_pws; i++) {
33610 +               sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
33611 +               if (!sptmp) {
33612 +                       err = -ENOMEM;
33613 +                       goto cleanup;
33614 +               }
33615 +               if (copy_from_user(sptmp, arg->sprole_pws + i,
33616 +                                  sizeof (struct sprole_pw))) {
33617 +                       err = -EFAULT;
33618 +                       goto cleanup;
33619 +               }
33620 +
33621 +               len =
33622 +                   strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
33623 +
33624 +               if (!len || len >= GR_SPROLE_LEN) {
33625 +                       err = -EINVAL;
33626 +                       goto cleanup;
33627 +               }
33628 +
33629 +               if ((tmp = (char *) acl_alloc(len)) == NULL) {
33630 +                       err = -ENOMEM;
33631 +                       goto cleanup;
33632 +               }
33633 +
33634 +               if (copy_from_user(tmp, sptmp->rolename, len)) {
33635 +                       err = -EFAULT;
33636 +                       goto cleanup;
33637 +               }
33638 +               tmp[len-1] = '\0';
33639 +#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
33640 +               printk(KERN_ALERT "Copying special role %s\n", tmp);
33641 +#endif
33642 +               sptmp->rolename = tmp;
33643 +               acl_special_roles[i] = sptmp;
33644 +       }
33645 +
33646 +       r_utmp = (struct acl_role_label **) arg->role_db.r_table;
33647 +
33648 +       for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
33649 +               r_tmp = acl_alloc(sizeof (struct acl_role_label));
33650 +
33651 +               if (!r_tmp) {
33652 +                       err = -ENOMEM;
33653 +                       goto cleanup;
33654 +               }
33655 +
33656 +               if (copy_from_user(&r_utmp2, r_utmp + r_num,
33657 +                                  sizeof (struct acl_role_label *))) {
33658 +                       err = -EFAULT;
33659 +                       goto cleanup;
33660 +               }
33661 +
33662 +               if (copy_from_user(r_tmp, r_utmp2,
33663 +                                  sizeof (struct acl_role_label))) {
33664 +                       err = -EFAULT;
33665 +                       goto cleanup;
33666 +               }
33667 +
33668 +               len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
33669 +
33670 +               if (!len || len >= PATH_MAX) {
33671 +                       err = -EINVAL;
33672 +                       goto cleanup;
33673 +               }
33674 +
33675 +               if ((tmp = (char *) acl_alloc(len)) == NULL) {
33676 +                       err = -ENOMEM;
33677 +                       goto cleanup;
33678 +               }
33679 +               if (copy_from_user(tmp, r_tmp->rolename, len)) {
33680 +                       err = -EFAULT;
33681 +                       goto cleanup;
33682 +               }
33683 +               tmp[len-1] = '\0';
33684 +               r_tmp->rolename = tmp;
33685 +
33686 +               if (!strcmp(r_tmp->rolename, "default")
33687 +                   && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
33688 +                       default_role = r_tmp;
33689 +               } else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
33690 +                       kernel_role = r_tmp;
33691 +               }
33692 +
33693 +               if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
33694 +                       err = -ENOMEM;
33695 +                       goto cleanup;
33696 +               }
33697 +               if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
33698 +                       err = -EFAULT;
33699 +                       goto cleanup;
33700 +               }
33701 +
33702 +               r_tmp->hash = ghash;
33703 +
33704 +               num_subjs = count_user_subjs(r_tmp->hash->first);
33705 +
33706 +               r_tmp->subj_hash_size = num_subjs;
33707 +               r_tmp->subj_hash =
33708 +                   (struct acl_subject_label **)
33709 +                   create_table(&(r_tmp->subj_hash_size), sizeof(void *));
33710 +
33711 +               if (!r_tmp->subj_hash) {
33712 +                       err = -ENOMEM;
33713 +                       goto cleanup;
33714 +               }
33715 +
33716 +               err = copy_user_allowedips(r_tmp);
33717 +               if (err)
33718 +                       goto cleanup;
33719 +
33720 +               /* copy domain info */
33721 +               if (r_tmp->domain_children != NULL) {
33722 +                       domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
33723 +                       if (domainlist == NULL) {
33724 +                               err = -ENOMEM;
33725 +                               goto cleanup;
33726 +                       }
33727 +                       if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
33728 +                               err = -EFAULT;
33729 +                               goto cleanup;
33730 +                       }
33731 +                       r_tmp->domain_children = domainlist;
33732 +               }
33733 +
33734 +               err = copy_user_transitions(r_tmp);
33735 +               if (err)
33736 +                       goto cleanup;
33737 +
33738 +               memset(r_tmp->subj_hash, 0,
33739 +                      r_tmp->subj_hash_size *
33740 +                      sizeof (struct acl_subject_label *));
33741 +
33742 +               err = copy_user_subjs(r_tmp->hash->first, r_tmp);
33743 +
33744 +               if (err)
33745 +                       goto cleanup;
33746 +
33747 +               /* set nested subject list to null */
33748 +               r_tmp->hash->first = NULL;
33749 +
33750 +               insert_acl_role_label(r_tmp);
33751 +       }
33752 +
33753 +       goto return_err;
33754 +      cleanup:
33755 +       free_variables();
33756 +      return_err:
33757 +       return err;
33758 +
33759 +}
33760 +
33761 +static int
33762 +gracl_init(struct gr_arg *args)
33763 +{
33764 +       int error = 0;
33765 +
33766 +       memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
33767 +       memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
33768 +
33769 +       if (init_variables(args)) {
33770 +               gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
33771 +               error = -ENOMEM;
33772 +               free_variables();
33773 +               goto out;
33774 +       }
33775 +
33776 +       error = copy_user_acl(args);
33777 +       free_init_variables();
33778 +       if (error) {
33779 +               free_variables();
33780 +               goto out;
33781 +       }
33782 +
33783 +       if ((error = gr_set_acls(0))) {
33784 +               free_variables();
33785 +               goto out;
33786 +       }
33787 +
33788 +       pax_open_kernel();
33789 +       gr_status |= GR_READY;
33790 +       pax_close_kernel();
33791 +
33792 +      out:
33793 +       return error;
33794 +}
33795 +
33796 +/* derived from glibc fnmatch() 0: match, 1: no match*/
33797 +
33798 +static int
33799 +glob_match(const char *p, const char *n)
33800 +{
33801 +       char c;
33802 +
33803 +       while ((c = *p++) != '\0') {
33804 +       switch (c) {
33805 +               case '?':
33806 +                       if (*n == '\0')
33807 +                               return 1;
33808 +                       else if (*n == '/')
33809 +                               return 1;
33810 +                       break;
33811 +               case '\\':
33812 +                       if (*n != c)
33813 +                               return 1;
33814 +                       break;
33815 +               case '*':
33816 +                       for (c = *p++; c == '?' || c == '*'; c = *p++) {
33817 +                               if (*n == '/')
33818 +                                       return 1;
33819 +                               else if (c == '?') {
33820 +                                       if (*n == '\0')
33821 +                                               return 1;
33822 +                                       else
33823 +                                               ++n;
33824 +                               }
33825 +                       }
33826 +                       if (c == '\0') {
33827 +                               return 0;
33828 +                       } else {
33829 +                               const char *endp;
33830 +
33831 +                               if ((endp = strchr(n, '/')) == NULL)
33832 +                                       endp = n + strlen(n);
33833 +
33834 +                               if (c == '[') {
33835 +                                       for (--p; n < endp; ++n)
33836 +                                               if (!glob_match(p, n))
33837 +                                                       return 0;
33838 +                               } else if (c == '/') {
33839 +                                       while (*n != '\0' && *n != '/')
33840 +                                               ++n;
33841 +                                       if (*n == '/' && !glob_match(p, n + 1))
33842 +                                               return 0;
33843 +                               } else {
33844 +                                       for (--p; n < endp; ++n)
33845 +                                               if (*n == c && !glob_match(p, n))
33846 +                                                       return 0;
33847 +                               }
33848 +
33849 +                               return 1;
33850 +                       }
33851 +               case '[':
33852 +                       {
33853 +                       int not;
33854 +                       char cold;
33855 +
33856 +                       if (*n == '\0' || *n == '/')
33857 +                               return 1;
33858 +
33859 +                       not = (*p == '!' || *p == '^');
33860 +                       if (not)
33861 +                               ++p;
33862 +
33863 +                       c = *p++;
33864 +                       for (;;) {
33865 +                               unsigned char fn = (unsigned char)*n;
33866 +
33867 +                               if (c == '\0')
33868 +                                       return 1;
33869 +                               else {
33870 +                                       if (c == fn)
33871 +                                               goto matched;
33872 +                                       cold = c;
33873 +                                       c = *p++;
33874 +
33875 +                                       if (c == '-' && *p != ']') {
33876 +                                               unsigned char cend = *p++;
33877 +
33878 +                                               if (cend == '\0')
33879 +                                                       return 1;
33880 +
33881 +                                               if (cold <= fn && fn <= cend)
33882 +                                                       goto matched;
33883 +
33884 +                                               c = *p++;
33885 +                                       }
33886 +                               }
33887 +
33888 +                               if (c == ']')
33889 +                                       break;
33890 +                       }
33891 +                       if (!not)
33892 +                               return 1;
33893 +                       break;
33894 +               matched:
33895 +                       while (c != ']') {
33896 +                               if (c == '\0')
33897 +                                       return 1;
33898 +
33899 +                               c = *p++;
33900 +                       }
33901 +                       if (not)
33902 +                               return 1;
33903 +               }
33904 +               break;
33905 +       default:
33906 +               if (c != *n)
33907 +                       return 1;
33908 +       }
33909 +
33910 +       ++n;
33911 +       }
33912 +
33913 +       if (*n == '\0')
33914 +               return 0;
33915 +
33916 +       if (*n == '/')
33917 +               return 0;
33918 +
33919 +       return 1;
33920 +}
33921 +
33922 +static struct acl_object_label *
33923 +chk_glob_label(struct acl_object_label *globbed,
33924 +       struct dentry *dentry, struct vfsmount *mnt, char **path)
33925 +{
33926 +       struct acl_object_label *tmp;
33927 +
33928 +       if (*path == NULL)
33929 +               *path = gr_to_filename_nolock(dentry, mnt);
33930 +
33931 +       tmp = globbed;
33932 +
33933 +       while (tmp) {
33934 +               if (!glob_match(tmp->filename, *path))
33935 +                       return tmp;
33936 +               tmp = tmp->next;
33937 +       }
33938 +
33939 +       return NULL;
33940 +}
33941 +
33942 +static struct acl_object_label *
33943 +__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
33944 +           const ino_t curr_ino, const dev_t curr_dev,
33945 +           const struct acl_subject_label *subj, char **path, const int checkglob)
33946 +{
33947 +       struct acl_subject_label *tmpsubj;
33948 +       struct acl_object_label *retval;
33949 +       struct acl_object_label *retval2;
33950 +
33951 +       tmpsubj = (struct acl_subject_label *) subj;
33952 +       read_lock(&gr_inode_lock);
33953 +       do {
33954 +               retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
33955 +               if (retval) {
33956 +                       if (checkglob && retval->globbed) {
33957 +                               retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
33958 +                                               (struct vfsmount *)orig_mnt, path);
33959 +                               if (retval2)
33960 +                                       retval = retval2;
33961 +                       }
33962 +                       break;
33963 +               }
33964 +       } while ((tmpsubj = tmpsubj->parent_subject));
33965 +       read_unlock(&gr_inode_lock);
33966 +
33967 +       return retval;
33968 +}
33969 +
33970 +static __inline__ struct acl_object_label *
33971 +full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
33972 +           const struct dentry *curr_dentry,
33973 +           const struct acl_subject_label *subj, char **path, const int checkglob)
33974 +{
33975 +       return __full_lookup(orig_dentry, orig_mnt,
33976 +                            curr_dentry->d_inode->i_ino,
33977 +                            curr_dentry->d_inode->i_sb->s_dev, subj, path, checkglob);
33978 +}
33979 +
33980 +static struct acl_object_label *
33981 +__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
33982 +             const struct acl_subject_label *subj, char *path, const int checkglob)
33983 +{
33984 +       struct dentry *dentry = (struct dentry *) l_dentry;
33985 +       struct vfsmount *mnt = (struct vfsmount *) l_mnt;
33986 +       struct acl_object_label *retval;
33987 +
33988 +       spin_lock(&dcache_lock);
33989 +
33990 +       if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
33991 +               /* ignore Eric Biederman */
33992 +           IS_PRIVATE(l_dentry->d_inode))) {
33993 +               retval = fakefs_obj;
33994 +               goto out;
33995 +       }
33996 +
33997 +       for (;;) {
33998 +               if (dentry == real_root && mnt == real_root_mnt)
33999 +                       break;
34000 +
34001 +               if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
34002 +                       if (mnt->mnt_parent == mnt)
34003 +                               break;
34004 +
34005 +                       retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
34006 +                       if (retval != NULL)
34007 +                               goto out;
34008 +
34009 +                       dentry = mnt->mnt_mountpoint;
34010 +                       mnt = mnt->mnt_parent;
34011 +                       continue;
34012 +               }
34013 +
34014 +               retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
34015 +               if (retval != NULL)
34016 +                       goto out;
34017 +
34018 +               dentry = dentry->d_parent;
34019 +       }
34020 +
34021 +       retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
34022 +
34023 +       if (retval == NULL)
34024 +               retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
34025 +out:
34026 +       spin_unlock(&dcache_lock);
34027 +       return retval;
34028 +}
34029 +
34030 +static __inline__ struct acl_object_label *
34031 +chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
34032 +             const struct acl_subject_label *subj)
34033 +{
34034 +       char *path = NULL;
34035 +       return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
34036 +}
34037 +
34038 +static __inline__ struct acl_object_label *
34039 +chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
34040 +             const struct acl_subject_label *subj)
34041 +{
34042 +       char *path = NULL;
34043 +       return __chk_obj_label(l_dentry, l_mnt, subj, path, 0);
34044 +}
34045 +
34046 +static __inline__ struct acl_object_label *
34047 +chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
34048 +                    const struct acl_subject_label *subj, char *path)
34049 +{
34050 +       return __chk_obj_label(l_dentry, l_mnt, subj, path, 1);
34051 +}
34052 +
34053 +static struct acl_subject_label *
34054 +chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
34055 +              const struct acl_role_label *role)
34056 +{
34057 +       struct dentry *dentry = (struct dentry *) l_dentry;
34058 +       struct vfsmount *mnt = (struct vfsmount *) l_mnt;
34059 +       struct acl_subject_label *retval;
34060 +
34061 +       spin_lock(&dcache_lock);
34062 +
34063 +       for (;;) {
34064 +               if (dentry == real_root && mnt == real_root_mnt)
34065 +                       break;
34066 +               if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
34067 +                       if (mnt->mnt_parent == mnt)
34068 +                               break;
34069 +
34070 +                       read_lock(&gr_inode_lock);
34071 +                       retval =
34072 +                               lookup_acl_subj_label(dentry->d_inode->i_ino,
34073 +                                               dentry->d_inode->i_sb->s_dev, role);
34074 +                       read_unlock(&gr_inode_lock);
34075 +                       if (retval != NULL)
34076 +                               goto out;
34077 +
34078 +                       dentry = mnt->mnt_mountpoint;
34079 +                       mnt = mnt->mnt_parent;
34080 +                       continue;
34081 +               }
34082 +
34083 +               read_lock(&gr_inode_lock);
34084 +               retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
34085 +                                         dentry->d_inode->i_sb->s_dev, role);
34086 +               read_unlock(&gr_inode_lock);
34087 +               if (retval != NULL)
34088 +                       goto out;
34089 +
34090 +               dentry = dentry->d_parent;
34091 +       }
34092 +
34093 +       read_lock(&gr_inode_lock);
34094 +       retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
34095 +                                 dentry->d_inode->i_sb->s_dev, role);
34096 +       read_unlock(&gr_inode_lock);
34097 +
34098 +       if (unlikely(retval == NULL)) {
34099 +               read_lock(&gr_inode_lock);
34100 +               retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
34101 +                                         real_root->d_inode->i_sb->s_dev, role);
34102 +               read_unlock(&gr_inode_lock);
34103 +       }
34104 +out:
34105 +       spin_unlock(&dcache_lock);
34106 +
34107 +       return retval;
34108 +}
34109 +
34110 +static void
34111 +gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
34112 +{
34113 +       struct task_struct *task = current;
34114 +       const struct cred *cred = current_cred();
34115 +
34116 +       security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
34117 +                      cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
34118 +                      task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
34119 +                      1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->curr_ip);
34120 +
34121 +       return;
34122 +}
34123 +
34124 +static void
34125 +gr_log_learn_sysctl(const char *path, const __u32 mode)
34126 +{
34127 +       struct task_struct *task = current;
34128 +       const struct cred *cred = current_cred();
34129 +
34130 +       security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
34131 +                      cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
34132 +                      task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
34133 +                      1UL, 1UL, path, (unsigned long) mode, &task->signal->curr_ip);
34134 +
34135 +       return;
34136 +}
34137 +
34138 +static void
34139 +gr_log_learn_id_change(const char type, const unsigned int real,
34140 +                      const unsigned int effective, const unsigned int fs)
34141 +{
34142 +       struct task_struct *task = current;
34143 +       const struct cred *cred = current_cred();
34144 +
34145 +       security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
34146 +                      cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
34147 +                      task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
34148 +                      type, real, effective, fs, &task->signal->curr_ip);
34149 +
34150 +       return;
34151 +}
34152 +
34153 +__u32
34154 +gr_check_link(const struct dentry * new_dentry,
34155 +             const struct dentry * parent_dentry,
34156 +             const struct vfsmount * parent_mnt,
34157 +             const struct dentry * old_dentry, const struct vfsmount * old_mnt)
34158 +{
34159 +       struct acl_object_label *obj;
34160 +       __u32 oldmode, newmode;
34161 +       __u32 needmode;
34162 +
34163 +       if (unlikely(!(gr_status & GR_READY)))
34164 +               return (GR_CREATE | GR_LINK);
34165 +
34166 +       obj = chk_obj_label(old_dentry, old_mnt, current->acl);
34167 +       oldmode = obj->mode;
34168 +
34169 +       if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
34170 +               oldmode |= (GR_CREATE | GR_LINK);
34171 +
34172 +       needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
34173 +       if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
34174 +               needmode |= GR_SETID | GR_AUDIT_SETID;
34175 +
34176 +       newmode =
34177 +           gr_check_create(new_dentry, parent_dentry, parent_mnt,
34178 +                           oldmode | needmode);
34179 +
34180 +       needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
34181 +                             GR_SETID | GR_READ | GR_FIND | GR_DELETE |
34182 +                             GR_INHERIT | GR_AUDIT_INHERIT);
34183 +
34184 +       if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
34185 +               goto bad;
34186 +
34187 +       if ((oldmode & needmode) != needmode)
34188 +               goto bad;
34189 +
34190 +       needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
34191 +       if ((newmode & needmode) != needmode)
34192 +               goto bad;
34193 +
34194 +       if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
34195 +               return newmode;
34196 +bad:
34197 +       needmode = oldmode;
34198 +       if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
34199 +               needmode |= GR_SETID;
34200 +
34201 +       if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
34202 +               gr_log_learn(old_dentry, old_mnt, needmode);
34203 +               return (GR_CREATE | GR_LINK);
34204 +       } else if (newmode & GR_SUPPRESS)
34205 +               return GR_SUPPRESS;
34206 +       else
34207 +               return 0;
34208 +}
34209 +
34210 +__u32
34211 +gr_search_file(const struct dentry * dentry, const __u32 mode,
34212 +              const struct vfsmount * mnt)
34213 +{
34214 +       __u32 retval = mode;
34215 +       struct acl_subject_label *curracl;
34216 +       struct acl_object_label *currobj;
34217 +
34218 +       if (unlikely(!(gr_status & GR_READY)))
34219 +               return (mode & ~GR_AUDITS);
34220 +
34221 +       curracl = current->acl;
34222 +
34223 +       currobj = chk_obj_label(dentry, mnt, curracl);
34224 +       retval = currobj->mode & mode;
34225 +
34226 +       if (unlikely
34227 +           ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
34228 +            && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
34229 +               __u32 new_mode = mode;
34230 +
34231 +               new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
34232 +
34233 +               retval = new_mode;
34234 +
34235 +               if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
34236 +                       new_mode |= GR_INHERIT;
34237 +
34238 +               if (!(mode & GR_NOLEARN))
34239 +                       gr_log_learn(dentry, mnt, new_mode);
34240 +       }
34241 +
34242 +       return retval;
34243 +}
34244 +
34245 +__u32
34246 +gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
34247 +               const struct vfsmount * mnt, const __u32 mode)
34248 +{
34249 +       struct name_entry *match;
34250 +       struct acl_object_label *matchpo;
34251 +       struct acl_subject_label *curracl;
34252 +       char *path;
34253 +       __u32 retval;
34254 +
34255 +       if (unlikely(!(gr_status & GR_READY)))
34256 +               return (mode & ~GR_AUDITS);
34257 +
34258 +       preempt_disable();
34259 +       path = gr_to_filename_rbac(new_dentry, mnt);
34260 +       match = lookup_name_entry_create(path);
34261 +
34262 +       if (!match)
34263 +               goto check_parent;
34264 +
34265 +       curracl = current->acl;
34266 +
34267 +       read_lock(&gr_inode_lock);
34268 +       matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
34269 +       read_unlock(&gr_inode_lock);
34270 +
34271 +       if (matchpo) {
34272 +               if ((matchpo->mode & mode) !=
34273 +                   (mode & ~(GR_AUDITS | GR_SUPPRESS))
34274 +                   && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
34275 +                       __u32 new_mode = mode;
34276 +
34277 +                       new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
34278 +
34279 +                       gr_log_learn(new_dentry, mnt, new_mode);
34280 +
34281 +                       preempt_enable();
34282 +                       return new_mode;
34283 +               }
34284 +               preempt_enable();
34285 +               return (matchpo->mode & mode);
34286 +       }
34287 +
34288 +      check_parent:
34289 +       curracl = current->acl;
34290 +
34291 +       matchpo = chk_obj_create_label(parent, mnt, curracl, path);
34292 +       retval = matchpo->mode & mode;
34293 +
34294 +       if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
34295 +           && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
34296 +               __u32 new_mode = mode;
34297 +
34298 +               new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
34299 +
34300 +               gr_log_learn(new_dentry, mnt, new_mode);
34301 +               preempt_enable();
34302 +               return new_mode;
34303 +       }
34304 +
34305 +       preempt_enable();
34306 +       return retval;
34307 +}
34308 +
34309 +int
34310 +gr_check_hidden_task(const struct task_struct *task)
34311 +{
34312 +       if (unlikely(!(gr_status & GR_READY)))
34313 +               return 0;
34314 +
34315 +       if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
34316 +               return 1;
34317 +
34318 +       return 0;
34319 +}
34320 +
34321 +int
34322 +gr_check_protected_task(const struct task_struct *task)
34323 +{
34324 +       if (unlikely(!(gr_status & GR_READY) || !task))
34325 +               return 0;
34326 +
34327 +       if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
34328 +           task->acl != current->acl)
34329 +               return 1;
34330 +
34331 +       return 0;
34332 +}
34333 +
34334 +void
34335 +gr_copy_label(struct task_struct *tsk)
34336 +{
34337 +       tsk->signal->used_accept = 0;
34338 +       tsk->acl_sp_role = 0;
34339 +       tsk->acl_role_id = current->acl_role_id;
34340 +       tsk->acl = current->acl;
34341 +       tsk->role = current->role;
34342 +       tsk->signal->curr_ip = current->signal->curr_ip;
34343 +       if (current->exec_file)
34344 +               get_file(current->exec_file);
34345 +       tsk->exec_file = current->exec_file;
34346 +       tsk->is_writable = current->is_writable;
34347 +       if (unlikely(current->signal->used_accept))
34348 +               current->signal->curr_ip = 0;
34349 +
34350 +       return;
34351 +}
34352 +
34353 +static void
34354 +gr_set_proc_res(struct task_struct *task)
34355 +{
34356 +       struct acl_subject_label *proc;
34357 +       unsigned short i;
34358 +
34359 +       proc = task->acl;
34360 +
34361 +       if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
34362 +               return;
34363 +
34364 +       for (i = 0; i < RLIM_NLIMITS; i++) {
34365 +               if (!(proc->resmask & (1 << i)))
34366 +                       continue;
34367 +
34368 +               task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
34369 +               task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
34370 +       }
34371 +
34372 +       return;
34373 +}
34374 +
34375 +int
34376 +gr_check_user_change(int real, int effective, int fs)
34377 +{
34378 +       unsigned int i;
34379 +       __u16 num;
34380 +       uid_t *uidlist;
34381 +       int curuid;
34382 +       int realok = 0;
34383 +       int effectiveok = 0;
34384 +       int fsok = 0;
34385 +
34386 +       if (unlikely(!(gr_status & GR_READY)))
34387 +               return 0;
34388 +
34389 +       if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
34390 +               gr_log_learn_id_change('u', real, effective, fs);
34391 +
34392 +       num = current->acl->user_trans_num;
34393 +       uidlist = current->acl->user_transitions;
34394 +
34395 +       if (uidlist == NULL)
34396 +               return 0;
34397 +
34398 +       if (real == -1)
34399 +               realok = 1;
34400 +       if (effective == -1)
34401 +               effectiveok = 1;
34402 +       if (fs == -1)
34403 +               fsok = 1;
34404 +
34405 +       if (current->acl->user_trans_type & GR_ID_ALLOW) {
34406 +               for (i = 0; i < num; i++) {
34407 +                       curuid = (int)uidlist[i];
34408 +                       if (real == curuid)
34409 +                               realok = 1;
34410 +                       if (effective == curuid)
34411 +                               effectiveok = 1;
34412 +                       if (fs == curuid)
34413 +                               fsok = 1;
34414 +               }
34415 +       } else if (current->acl->user_trans_type & GR_ID_DENY) {
34416 +               for (i = 0; i < num; i++) {
34417 +                       curuid = (int)uidlist[i];
34418 +                       if (real == curuid)
34419 +                               break;
34420 +                       if (effective == curuid)
34421 +                               break;
34422 +                       if (fs == curuid)
34423 +                               break;
34424 +               }
34425 +               /* not in deny list */
34426 +               if (i == num) {
34427 +                       realok = 1;
34428 +                       effectiveok = 1;
34429 +                       fsok = 1;
34430 +               }
34431 +       }
34432 +
34433 +       if (realok && effectiveok && fsok)
34434 +               return 0;
34435 +       else {
34436 +               gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
34437 +               return 1;
34438 +       }
34439 +}
34440 +
34441 +int
34442 +gr_check_group_change(int real, int effective, int fs)
34443 +{
34444 +       unsigned int i;
34445 +       __u16 num;
34446 +       gid_t *gidlist;
34447 +       int curgid;
34448 +       int realok = 0;
34449 +       int effectiveok = 0;
34450 +       int fsok = 0;
34451 +
34452 +       if (unlikely(!(gr_status & GR_READY)))
34453 +               return 0;
34454 +
34455 +       if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
34456 +               gr_log_learn_id_change('g', real, effective, fs);
34457 +
34458 +       num = current->acl->group_trans_num;
34459 +       gidlist = current->acl->group_transitions;
34460 +
34461 +       if (gidlist == NULL)
34462 +               return 0;
34463 +
34464 +       if (real == -1)
34465 +               realok = 1;
34466 +       if (effective == -1)
34467 +               effectiveok = 1;
34468 +       if (fs == -1)
34469 +               fsok = 1;
34470 +
34471 +       if (current->acl->group_trans_type & GR_ID_ALLOW) {
34472 +               for (i = 0; i < num; i++) {
34473 +                       curgid = (int)gidlist[i];
34474 +                       if (real == curgid)
34475 +                               realok = 1;
34476 +                       if (effective == curgid)
34477 +                               effectiveok = 1;
34478 +                       if (fs == curgid)
34479 +                               fsok = 1;
34480 +               }
34481 +       } else if (current->acl->group_trans_type & GR_ID_DENY) {
34482 +               for (i = 0; i < num; i++) {
34483 +                       curgid = (int)gidlist[i];
34484 +                       if (real == curgid)
34485 +                               break;
34486 +                       if (effective == curgid)
34487 +                               break;
34488 +                       if (fs == curgid)
34489 +                               break;
34490 +               }
34491 +               /* not in deny list */
34492 +               if (i == num) {
34493 +                       realok = 1;
34494 +                       effectiveok = 1;
34495 +                       fsok = 1;
34496 +               }
34497 +       }
34498 +
34499 +       if (realok && effectiveok && fsok)
34500 +               return 0;
34501 +       else {
34502 +               gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
34503 +               return 1;
34504 +       }
34505 +}
34506 +
34507 +void
34508 +gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
34509 +{
34510 +       struct acl_role_label *role = task->role;
34511 +       struct acl_subject_label *subj = NULL;
34512 +       struct acl_object_label *obj;
34513 +       struct file *filp;
34514 +
34515 +       if (unlikely(!(gr_status & GR_READY)))
34516 +               return;
34517 +
34518 +       filp = task->exec_file;
34519 +
34520 +       /* kernel process, we'll give them the kernel role */
34521 +       if (unlikely(!filp)) {
34522 +               task->role = kernel_role;
34523 +               task->acl = kernel_role->root_label;
34524 +               return;
34525 +       } else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
34526 +               role = lookup_acl_role_label(task, uid, gid);
34527 +
34528 +       /* perform subject lookup in possibly new role
34529 +          we can use this result below in the case where role == task->role
34530 +       */
34531 +       subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
34532 +
34533 +       /* if we changed uid/gid, but result in the same role
34534 +          and are using inheritance, don't lose the inherited subject
34535 +          if current subject is other than what normal lookup
34536 +          would result in, we arrived via inheritance, don't
34537 +          lose subject
34538 +       */
34539 +       if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
34540 +                                  (subj == task->acl)))
34541 +               task->acl = subj;
34542 +
34543 +       task->role = role;
34544 +
34545 +       task->is_writable = 0;
34546 +
34547 +       /* ignore additional mmap checks for processes that are writable
34548 +          by the default ACL */
34549 +       obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
34550 +       if (unlikely(obj->mode & GR_WRITE))
34551 +               task->is_writable = 1;
34552 +       obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
34553 +       if (unlikely(obj->mode & GR_WRITE))
34554 +               task->is_writable = 1;
34555 +
34556 +#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
34557 +       printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
34558 +#endif
34559 +
34560 +       gr_set_proc_res(task);
34561 +
34562 +       return;
34563 +}
34564 +
34565 +int
34566 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
34567 +                 const int unsafe_share)
34568 +{
34569 +       struct task_struct *task = current;
34570 +       struct acl_subject_label *newacl;
34571 +       struct acl_object_label *obj;
34572 +       __u32 retmode;
34573 +
34574 +       if (unlikely(!(gr_status & GR_READY)))
34575 +               return 0;
34576 +
34577 +       newacl = chk_subj_label(dentry, mnt, task->role);
34578 +
34579 +       task_lock(task);
34580 +       if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
34581 +            !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
34582 +            !(task->role->roletype & GR_ROLE_GOD) &&
34583 +            !gr_search_file(dentry, GR_PTRACERD, mnt) &&
34584 +            !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
34585 +                task_unlock(task);
34586 +               if (unsafe_share)
34587 +                       gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
34588 +               else
34589 +                       gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
34590 +               return -EACCES;
34591 +       }
34592 +       task_unlock(task);
34593 +
34594 +       obj = chk_obj_label(dentry, mnt, task->acl);
34595 +       retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
34596 +
34597 +       if (!(task->acl->mode & GR_INHERITLEARN) &&
34598 +           ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
34599 +               if (obj->nested)
34600 +                       task->acl = obj->nested;
34601 +               else
34602 +                       task->acl = newacl;
34603 +       } else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
34604 +               gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
34605 +
34606 +       task->is_writable = 0;
34607 +
34608 +       /* ignore additional mmap checks for processes that are writable
34609 +          by the default ACL */
34610 +       obj = chk_obj_label(dentry, mnt, default_role->root_label);
34611 +       if (unlikely(obj->mode & GR_WRITE))
34612 +               task->is_writable = 1;
34613 +       obj = chk_obj_label(dentry, mnt, task->role->root_label);
34614 +       if (unlikely(obj->mode & GR_WRITE))
34615 +               task->is_writable = 1;
34616 +
34617 +       gr_set_proc_res(task);
34618 +
34619 +#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
34620 +       printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
34621 +#endif
34622 +       return 0;
34623 +}
34624 +
34625 +/* always called with valid inodev ptr */
34626 +static void
34627 +do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
34628 +{
34629 +       struct acl_object_label *matchpo;
34630 +       struct acl_subject_label *matchps;
34631 +       struct acl_subject_label *subj;
34632 +       struct acl_role_label *role;
34633 +       unsigned int x;
34634 +
34635 +       FOR_EACH_ROLE_START(role)
34636 +               FOR_EACH_SUBJECT_START(role, subj, x)
34637 +                       if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
34638 +                               matchpo->mode |= GR_DELETED;
34639 +               FOR_EACH_SUBJECT_END(subj,x)
34640 +               FOR_EACH_NESTED_SUBJECT_START(role, subj)
34641 +                       if (subj->inode == ino && subj->device == dev)
34642 +                               subj->mode |= GR_DELETED;
34643 +               FOR_EACH_NESTED_SUBJECT_END(subj)
34644 +               if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
34645 +                       matchps->mode |= GR_DELETED;
34646 +       FOR_EACH_ROLE_END(role)
34647 +
34648 +       inodev->nentry->deleted = 1;
34649 +
34650 +       return;
34651 +}
34652 +
34653 +void
34654 +gr_handle_delete(const ino_t ino, const dev_t dev)
34655 +{
34656 +       struct inodev_entry *inodev;
34657 +
34658 +       if (unlikely(!(gr_status & GR_READY)))
34659 +               return;
34660 +
34661 +       write_lock(&gr_inode_lock);
34662 +       inodev = lookup_inodev_entry(ino, dev);
34663 +       if (inodev != NULL)
34664 +               do_handle_delete(inodev, ino, dev);
34665 +       write_unlock(&gr_inode_lock);
34666 +
34667 +       return;
34668 +}
34669 +
34670 +static void
34671 +update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
34672 +                    const ino_t newinode, const dev_t newdevice,
34673 +                    struct acl_subject_label *subj)
34674 +{
34675 +       unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
34676 +       struct acl_object_label *match;
34677 +
34678 +       match = subj->obj_hash[index];
34679 +
34680 +       while (match && (match->inode != oldinode ||
34681 +              match->device != olddevice ||
34682 +              !(match->mode & GR_DELETED)))
34683 +               match = match->next;
34684 +
34685 +       if (match && (match->inode == oldinode)
34686 +           && (match->device == olddevice)
34687 +           && (match->mode & GR_DELETED)) {
34688 +               if (match->prev == NULL) {
34689 +                       subj->obj_hash[index] = match->next;
34690 +                       if (match->next != NULL)
34691 +                               match->next->prev = NULL;
34692 +               } else {
34693 +                       match->prev->next = match->next;
34694 +                       if (match->next != NULL)
34695 +                               match->next->prev = match->prev;
34696 +               }
34697 +               match->prev = NULL;
34698 +               match->next = NULL;
34699 +               match->inode = newinode;
34700 +               match->device = newdevice;
34701 +               match->mode &= ~GR_DELETED;
34702 +
34703 +               insert_acl_obj_label(match, subj);
34704 +       }
34705 +
34706 +       return;
34707 +}
34708 +
34709 +static void
34710 +update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
34711 +                     const ino_t newinode, const dev_t newdevice,
34712 +                     struct acl_role_label *role)
34713 +{
34714 +       unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
34715 +       struct acl_subject_label *match;
34716 +
34717 +       match = role->subj_hash[index];
34718 +
34719 +       while (match && (match->inode != oldinode ||
34720 +              match->device != olddevice ||
34721 +              !(match->mode & GR_DELETED)))
34722 +               match = match->next;
34723 +
34724 +       if (match && (match->inode == oldinode)
34725 +           && (match->device == olddevice)
34726 +           && (match->mode & GR_DELETED)) {
34727 +               if (match->prev == NULL) {
34728 +                       role->subj_hash[index] = match->next;
34729 +                       if (match->next != NULL)
34730 +                               match->next->prev = NULL;
34731 +               } else {
34732 +                       match->prev->next = match->next;
34733 +                       if (match->next != NULL)
34734 +                               match->next->prev = match->prev;
34735 +               }
34736 +               match->prev = NULL;
34737 +               match->next = NULL;
34738 +               match->inode = newinode;
34739 +               match->device = newdevice;
34740 +               match->mode &= ~GR_DELETED;
34741 +
34742 +               insert_acl_subj_label(match, role);
34743 +       }
34744 +
34745 +       return;
34746 +}
34747 +
34748 +static void
34749 +update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
34750 +                   const ino_t newinode, const dev_t newdevice)
34751 +{
34752 +       unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
34753 +       struct inodev_entry *match;
34754 +
34755 +       match = inodev_set.i_hash[index];
34756 +
34757 +       while (match && (match->nentry->inode != oldinode ||
34758 +              match->nentry->device != olddevice || !match->nentry->deleted))
34759 +               match = match->next;
34760 +
34761 +       if (match && (match->nentry->inode == oldinode)
34762 +           && (match->nentry->device == olddevice) &&
34763 +           match->nentry->deleted) {
34764 +               if (match->prev == NULL) {
34765 +                       inodev_set.i_hash[index] = match->next;
34766 +                       if (match->next != NULL)
34767 +                               match->next->prev = NULL;
34768 +               } else {
34769 +                       match->prev->next = match->next;
34770 +                       if (match->next != NULL)
34771 +                               match->next->prev = match->prev;
34772 +               }
34773 +               match->prev = NULL;
34774 +               match->next = NULL;
34775 +               match->nentry->inode = newinode;
34776 +               match->nentry->device = newdevice;
34777 +               match->nentry->deleted = 0;
34778 +
34779 +               insert_inodev_entry(match);
34780 +       }
34781 +
34782 +       return;
34783 +}
34784 +
34785 +static void
34786 +do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
34787 +                const struct vfsmount *mnt)
34788 +{
34789 +       struct acl_subject_label *subj;
34790 +       struct acl_role_label *role;
34791 +       unsigned int x;
34792 +
34793 +       FOR_EACH_ROLE_START(role)
34794 +               update_acl_subj_label(matchn->inode, matchn->device,
34795 +                                     dentry->d_inode->i_ino,
34796 +                                     dentry->d_inode->i_sb->s_dev, role);
34797 +
34798 +               FOR_EACH_NESTED_SUBJECT_START(role, subj)
34799 +                       if ((subj->inode == dentry->d_inode->i_ino) &&
34800 +                           (subj->device == dentry->d_inode->i_sb->s_dev)) {
34801 +                               subj->inode = dentry->d_inode->i_ino;
34802 +                               subj->device = dentry->d_inode->i_sb->s_dev;
34803 +                       }
34804 +               FOR_EACH_NESTED_SUBJECT_END(subj)
34805 +               FOR_EACH_SUBJECT_START(role, subj, x)
34806 +                       update_acl_obj_label(matchn->inode, matchn->device,
34807 +                                            dentry->d_inode->i_ino,
34808 +                                            dentry->d_inode->i_sb->s_dev, subj);
34809 +               FOR_EACH_SUBJECT_END(subj,x)
34810 +       FOR_EACH_ROLE_END(role)
34811 +
34812 +       update_inodev_entry(matchn->inode, matchn->device,
34813 +                           dentry->d_inode->i_ino, dentry->d_inode->i_sb->s_dev);
34814 +
34815 +       return;
34816 +}
34817 +
34818 +void
34819 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
34820 +{
34821 +       struct name_entry *matchn;
34822 +
34823 +       if (unlikely(!(gr_status & GR_READY)))
34824 +               return;
34825 +
34826 +       preempt_disable();
34827 +       matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
34828 +
34829 +       if (unlikely((unsigned long)matchn)) {
34830 +               write_lock(&gr_inode_lock);
34831 +               do_handle_create(matchn, dentry, mnt);
34832 +               write_unlock(&gr_inode_lock);
34833 +       }
34834 +       preempt_enable();
34835 +
34836 +       return;
34837 +}
34838 +
34839 +void
34840 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
34841 +                struct dentry *old_dentry,
34842 +                struct dentry *new_dentry,
34843 +                struct vfsmount *mnt, const __u8 replace)
34844 +{
34845 +       struct name_entry *matchn;
34846 +       struct inodev_entry *inodev;
34847 +
34848 +       /* vfs_rename swaps the name and parent link for old_dentry and
34849 +          new_dentry
34850 +          at this point, old_dentry has the new name, parent link, and inode
34851 +          for the renamed file
34852 +          if a file is being replaced by a rename, new_dentry has the inode
34853 +          and name for the replaced file
34854 +       */
34855 +
34856 +       if (unlikely(!(gr_status & GR_READY)))
34857 +               return;
34858 +
34859 +       preempt_disable();
34860 +       matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
34861 +
34862 +       /* we wouldn't have to check d_inode if it weren't for
34863 +          NFS silly-renaming
34864 +        */
34865 +
34866 +       write_lock(&gr_inode_lock);
34867 +       if (unlikely(replace && new_dentry->d_inode)) {
34868 +               inodev = lookup_inodev_entry(new_dentry->d_inode->i_ino,
34869 +                                            new_dentry->d_inode->i_sb->s_dev);
34870 +               if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
34871 +                       do_handle_delete(inodev, new_dentry->d_inode->i_ino,
34872 +                                        new_dentry->d_inode->i_sb->s_dev);
34873 +       }
34874 +
34875 +       inodev = lookup_inodev_entry(old_dentry->d_inode->i_ino,
34876 +                                    old_dentry->d_inode->i_sb->s_dev);
34877 +       if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
34878 +               do_handle_delete(inodev, old_dentry->d_inode->i_ino,
34879 +                                old_dentry->d_inode->i_sb->s_dev);
34880 +
34881 +       if (unlikely((unsigned long)matchn))
34882 +               do_handle_create(matchn, old_dentry, mnt);
34883 +
34884 +       write_unlock(&gr_inode_lock);
34885 +       preempt_enable();
34886 +
34887 +       return;
34888 +}
34889 +
34890 +static int
34891 +lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
34892 +                        unsigned char **sum)
34893 +{
34894 +       struct acl_role_label *r;
34895 +       struct role_allowed_ip *ipp;
34896 +       struct role_transition *trans;
34897 +       unsigned int i;
34898 +       int found = 0;
34899 +
34900 +       /* check transition table */
34901 +
34902 +       for (trans = current->role->transitions; trans; trans = trans->next) {
34903 +               if (!strcmp(rolename, trans->rolename)) {
34904 +                       found = 1;
34905 +                       break;
34906 +               }
34907 +       }
34908 +
34909 +       if (!found)
34910 +               return 0;
34911 +
34912 +       /* handle special roles that do not require authentication
34913 +          and check ip */
34914 +
34915 +       FOR_EACH_ROLE_START(r)
34916 +               if (!strcmp(rolename, r->rolename) &&
34917 +                   (r->roletype & GR_ROLE_SPECIAL)) {
34918 +                       found = 0;
34919 +                       if (r->allowed_ips != NULL) {
34920 +                               for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
34921 +                                       if ((ntohl(current->signal->curr_ip) & ipp->netmask) ==
34922 +                                            (ntohl(ipp->addr) & ipp->netmask))
34923 +                                               found = 1;
34924 +                               }
34925 +                       } else
34926 +                               found = 2;
34927 +                       if (!found)
34928 +                               return 0;
34929 +
34930 +                       if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
34931 +                           ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
34932 +                               *salt = NULL;
34933 +                               *sum = NULL;
34934 +                               return 1;
34935 +                       }
34936 +               }
34937 +       FOR_EACH_ROLE_END(r)
34938 +
34939 +       for (i = 0; i < num_sprole_pws; i++) {
34940 +               if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
34941 +                       *salt = acl_special_roles[i]->salt;
34942 +                       *sum = acl_special_roles[i]->sum;
34943 +                       return 1;
34944 +               }
34945 +       }
34946 +
34947 +       return 0;
34948 +}
34949 +
34950 +static void
34951 +assign_special_role(char *rolename)
34952 +{
34953 +       struct acl_object_label *obj;
34954 +       struct acl_role_label *r;
34955 +       struct acl_role_label *assigned = NULL;
34956 +       struct task_struct *tsk;
34957 +       struct file *filp;
34958 +
34959 +       FOR_EACH_ROLE_START(r)
34960 +               if (!strcmp(rolename, r->rolename) &&
34961 +                   (r->roletype & GR_ROLE_SPECIAL)) {
34962 +                       assigned = r;
34963 +                       break;
34964 +               }
34965 +       FOR_EACH_ROLE_END(r)
34966 +
34967 +       if (!assigned)
34968 +               return;
34969 +
34970 +       read_lock(&tasklist_lock);
34971 +       read_lock(&grsec_exec_file_lock);
34972 +
34973 +       tsk = current->parent;
34974 +       if (tsk == NULL)
34975 +               goto out_unlock;
34976 +
34977 +       filp = tsk->exec_file;
34978 +       if (filp == NULL)
34979 +               goto out_unlock;
34980 +
34981 +       tsk->is_writable = 0;
34982 +
34983 +       tsk->acl_sp_role = 1;
34984 +       tsk->acl_role_id = ++acl_sp_role_value;
34985 +       tsk->role = assigned;
34986 +       tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
34987 +
34988 +       /* ignore additional mmap checks for processes that are writable
34989 +          by the default ACL */
34990 +       obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
34991 +       if (unlikely(obj->mode & GR_WRITE))
34992 +               tsk->is_writable = 1;
34993 +       obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
34994 +       if (unlikely(obj->mode & GR_WRITE))
34995 +               tsk->is_writable = 1;
34996 +
34997 +#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
34998 +       printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
34999 +#endif
35000 +
35001 +out_unlock:
35002 +       read_unlock(&grsec_exec_file_lock);
35003 +       read_unlock(&tasklist_lock);
35004 +       return;
35005 +}
35006 +
35007 +int gr_check_secure_terminal(struct task_struct *task)
35008 +{
35009 +       struct task_struct *p, *p2, *p3;
35010 +       struct files_struct *files;
35011 +       struct fdtable *fdt;
35012 +       struct file *our_file = NULL, *file;
35013 +       int i;
35014 +
35015 +       if (task->signal->tty == NULL)
35016 +               return 1;
35017 +
35018 +       files = get_files_struct(task);
35019 +       if (files != NULL) {
35020 +               rcu_read_lock();
35021 +               fdt = files_fdtable(files);
35022 +               for (i=0; i < fdt->max_fds; i++) {
35023 +                       file = fcheck_files(files, i);
35024 +                       if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
35025 +                               get_file(file);
35026 +                               our_file = file;
35027 +                       }
35028 +               }
35029 +               rcu_read_unlock();
35030 +               put_files_struct(files);
35031 +       }
35032 +
35033 +       if (our_file == NULL)
35034 +               return 1;
35035 +
35036 +       read_lock(&tasklist_lock);
35037 +       do_each_thread(p2, p) {
35038 +               files = get_files_struct(p);
35039 +               if (files == NULL ||
35040 +                   (p->signal && p->signal->tty == task->signal->tty)) {
35041 +                       if (files != NULL)
35042 +                               put_files_struct(files);
35043 +                       continue;
35044 +               }
35045 +               rcu_read_lock();
35046 +               fdt = files_fdtable(files);
35047 +               for (i=0; i < fdt->max_fds; i++) {
35048 +                       file = fcheck_files(files, i);
35049 +                       if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
35050 +                           file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
35051 +                               p3 = task;
35052 +                               while (p3->pid > 0) {
35053 +                                       if (p3 == p)
35054 +                                               break;
35055 +                                       p3 = p3->parent;
35056 +                               }
35057 +                               if (p3 == p)
35058 +                                       break;
35059 +                               gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
35060 +                               gr_handle_alertkill(p);
35061 +                               rcu_read_unlock();
35062 +                               put_files_struct(files);
35063 +                               read_unlock(&tasklist_lock);
35064 +                               fput(our_file);
35065 +                               return 0;
35066 +                       }
35067 +               }
35068 +               rcu_read_unlock();
35069 +               put_files_struct(files);
35070 +       } while_each_thread(p2, p);
35071 +       read_unlock(&tasklist_lock);
35072 +
35073 +       fput(our_file);
35074 +       return 1;
35075 +}
35076 +
35077 +ssize_t
35078 +write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
35079 +{
35080 +       struct gr_arg_wrapper uwrap;
35081 +       unsigned char *sprole_salt = NULL;
35082 +       unsigned char *sprole_sum = NULL;
35083 +       int error = sizeof (struct gr_arg_wrapper);
35084 +       int error2 = 0;
35085 +
35086 +       down(&gr_dev_sem);
35087 +
35088 +       if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
35089 +               error = -EPERM;
35090 +               goto out;
35091 +       }
35092 +
35093 +       if (count != sizeof (struct gr_arg_wrapper)) {
35094 +               gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
35095 +               error = -EINVAL;
35096 +               goto out;
35097 +       }
35098 +
35099 +
35100 +       if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
35101 +               gr_auth_expires = 0;
35102 +               gr_auth_attempts = 0;
35103 +       }
35104 +
35105 +       if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
35106 +               error = -EFAULT;
35107 +               goto out;
35108 +       }
35109 +
35110 +       if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
35111 +               error = -EINVAL;
35112 +               goto out;
35113 +       }
35114 +
35115 +       if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
35116 +               error = -EFAULT;
35117 +               goto out;
35118 +       }
35119 +
35120 +       if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
35121 +           gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
35122 +           time_after(gr_auth_expires, get_seconds())) {
35123 +               error = -EBUSY;
35124 +               goto out;
35125 +       }
35126 +
35127 +       /* if non-root trying to do anything other than use a special role,
35128 +          do not attempt authentication, do not count towards authentication
35129 +          locking
35130 +        */
35131 +
35132 +       if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
35133 +           gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
35134 +           current_uid()) {
35135 +               error = -EPERM;
35136 +               goto out;
35137 +       }
35138 +
35139 +       /* ensure pw and special role name are null terminated */
35140 +
35141 +       gr_usermode->pw[GR_PW_LEN - 1] = '\0';
35142 +       gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
35143 +
35144 +       /* Okay.
35145 +        * We have our enough of the argument structure..(we have yet
35146 +        * to copy_from_user the tables themselves) . Copy the tables
35147 +        * only if we need them, i.e. for loading operations. */
35148 +
35149 +       switch (gr_usermode->mode) {
35150 +       case GR_STATUS:
35151 +                       if (gr_status & GR_READY) {
35152 +                               error = 1;
35153 +                               if (!gr_check_secure_terminal(current))
35154 +                                       error = 3;
35155 +                       } else
35156 +                               error = 2;
35157 +                       goto out;
35158 +       case GR_SHUTDOWN:
35159 +               if ((gr_status & GR_READY)
35160 +                   && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
35161 +                       pax_open_kernel();
35162 +                       gr_status &= ~GR_READY;
35163 +                       pax_close_kernel();
35164 +
35165 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
35166 +                       free_variables();
35167 +                       memset(gr_usermode, 0, sizeof (struct gr_arg));
35168 +                       memset(gr_system_salt, 0, GR_SALT_LEN);
35169 +                       memset(gr_system_sum, 0, GR_SHA_LEN);
35170 +               } else if (gr_status & GR_READY) {
35171 +                       gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
35172 +                       error = -EPERM;
35173 +               } else {
35174 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
35175 +                       error = -EAGAIN;
35176 +               }
35177 +               break;
35178 +       case GR_ENABLE:
35179 +               if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
35180 +                       gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
35181 +               else {
35182 +                       if (gr_status & GR_READY)
35183 +                               error = -EAGAIN;
35184 +                       else
35185 +                               error = error2;
35186 +                       gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
35187 +               }
35188 +               break;
35189 +       case GR_RELOAD:
35190 +               if (!(gr_status & GR_READY)) {
35191 +                       gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
35192 +                       error = -EAGAIN;
35193 +               } else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
35194 +                       lock_kernel();
35195 +
35196 +                       pax_open_kernel();
35197 +                       gr_status &= ~GR_READY;
35198 +                       pax_close_kernel();
35199 +
35200 +                       free_variables();
35201 +                       if (!(error2 = gracl_init(gr_usermode))) {
35202 +                               unlock_kernel();
35203 +                               gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
35204 +                       } else {
35205 +                               unlock_kernel();
35206 +                               error = error2;
35207 +                               gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
35208 +                       }
35209 +               } else {
35210 +                       gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
35211 +                       error = -EPERM;
35212 +               }
35213 +               break;
35214 +       case GR_SEGVMOD:
35215 +               if (unlikely(!(gr_status & GR_READY))) {
35216 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
35217 +                       error = -EAGAIN;
35218 +                       break;
35219 +               }
35220 +
35221 +               if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
35222 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
35223 +                       if (gr_usermode->segv_device && gr_usermode->segv_inode) {
35224 +                               struct acl_subject_label *segvacl;
35225 +                               segvacl =
35226 +                                   lookup_acl_subj_label(gr_usermode->segv_inode,
35227 +                                                         gr_usermode->segv_device,
35228 +                                                         current->role);
35229 +                               if (segvacl) {
35230 +                                       segvacl->crashes = 0;
35231 +                                       segvacl->expires = 0;
35232 +                               }
35233 +                       } else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
35234 +                               gr_remove_uid(gr_usermode->segv_uid);
35235 +                       }
35236 +               } else {
35237 +                       gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
35238 +                       error = -EPERM;
35239 +               }
35240 +               break;
35241 +       case GR_SPROLE:
35242 +       case GR_SPROLEPAM:
35243 +               if (unlikely(!(gr_status & GR_READY))) {
35244 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
35245 +                       error = -EAGAIN;
35246 +                       break;
35247 +               }
35248 +
35249 +               if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
35250 +                       current->role->expires = 0;
35251 +                       current->role->auth_attempts = 0;
35252 +               }
35253 +
35254 +               if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
35255 +                   time_after(current->role->expires, get_seconds())) {
35256 +                       error = -EBUSY;
35257 +                       goto out;
35258 +               }
35259 +
35260 +               if (lookup_special_role_auth
35261 +                   (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
35262 +                   && ((!sprole_salt && !sprole_sum)
35263 +                       || !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
35264 +                       char *p = "";
35265 +                       assign_special_role(gr_usermode->sp_role);
35266 +                       read_lock(&tasklist_lock);
35267 +                       if (current->parent)
35268 +                               p = current->parent->role->rolename;
35269 +                       read_unlock(&tasklist_lock);
35270 +                       gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
35271 +                                       p, acl_sp_role_value);
35272 +               } else {
35273 +                       gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
35274 +                       error = -EPERM;
35275 +                       if(!(current->role->auth_attempts++))
35276 +                               current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
35277 +
35278 +                       goto out;
35279 +               }
35280 +               break;
35281 +       case GR_UNSPROLE:
35282 +               if (unlikely(!(gr_status & GR_READY))) {
35283 +                       gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
35284 +                       error = -EAGAIN;
35285 +                       break;
35286 +               }
35287 +
35288 +               if (current->role->roletype & GR_ROLE_SPECIAL) {
35289 +                       char *p = "";
35290 +                       int i = 0;
35291 +
35292 +                       read_lock(&tasklist_lock);
35293 +                       if (current->parent) {
35294 +                               p = current->parent->role->rolename;
35295 +                               i = current->parent->acl_role_id;
35296 +                       }
35297 +                       read_unlock(&tasklist_lock);
35298 +
35299 +                       gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
35300 +                       gr_set_acls(1);
35301 +               } else {
35302 +                       gr_log_str(GR_DONT_AUDIT, GR_UNSPROLEF_ACL_MSG, current->role->rolename);
35303 +                       error = -EPERM;
35304 +                       goto out;
35305 +               }
35306 +               break;
35307 +       default:
35308 +               gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
35309 +               error = -EINVAL;
35310 +               break;
35311 +       }
35312 +
35313 +       if (error != -EPERM)
35314 +               goto out;
35315 +
35316 +       if(!(gr_auth_attempts++))
35317 +               gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
35318 +
35319 +      out:
35320 +       up(&gr_dev_sem);
35321 +       return error;
35322 +}
35323 +
35324 +int
35325 +gr_set_acls(const int type)
35326 +{
35327 +       struct acl_object_label *obj;
35328 +       struct task_struct *task, *task2;
35329 +       struct file *filp;
35330 +       struct acl_role_label *role = current->role;
35331 +       __u16 acl_role_id = current->acl_role_id;
35332 +       const struct cred *cred;
35333 +       char *tmpname;
35334 +       struct name_entry *nmatch;
35335 +       struct acl_subject_label *tmpsubj;
35336 +
35337 +       rcu_read_lock();
35338 +       read_lock(&tasklist_lock);
35339 +       read_lock(&grsec_exec_file_lock);
35340 +       do_each_thread(task2, task) {
35341 +               /* check to see if we're called from the exit handler,
35342 +                  if so, only replace ACLs that have inherited the admin
35343 +                  ACL */
35344 +
35345 +               if (type && (task->role != role ||
35346 +                            task->acl_role_id != acl_role_id))
35347 +                       continue;
35348 +
35349 +               task->acl_role_id = 0;
35350 +               task->acl_sp_role = 0;
35351 +
35352 +               if ((filp = task->exec_file)) {
35353 +                       cred = __task_cred(task);
35354 +                       task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
35355 +
35356 +                       /* the following is to apply the correct subject
35357 +                          on binaries running when the RBAC system
35358 +                          is enabled, when the binaries have been
35359 +                          replaced or deleted since their execution
35360 +                          -----
35361 +                          when the RBAC system starts, the inode/dev
35362 +                          from exec_file will be one the RBAC system
35363 +                          is unaware of.  It only knows the inode/dev
35364 +                          of the present file on disk, or the absence
35365 +                          of it.
35366 +                       */
35367 +                       preempt_disable();
35368 +                       tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
35369 +
35370 +                       nmatch = lookup_name_entry(tmpname);
35371 +                       preempt_enable();
35372 +                       tmpsubj = NULL;
35373 +                       if (nmatch) {
35374 +                               if (nmatch->deleted)
35375 +                                       tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
35376 +                               else
35377 +                                       tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
35378 +                               if (tmpsubj != NULL)
35379 +                                       task->acl = tmpsubj;
35380 +                       }
35381 +                       if (tmpsubj == NULL)
35382 +                               task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
35383 +                                                          task->role);
35384 +                       if (task->acl) {
35385 +                               struct acl_subject_label *curr;
35386 +                               curr = task->acl;
35387 +
35388 +                               task->is_writable = 0;
35389 +                               /* ignore additional mmap checks for processes that are writable
35390 +                                  by the default ACL */
35391 +                               obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
35392 +                               if (unlikely(obj->mode & GR_WRITE))
35393 +                                       task->is_writable = 1;
35394 +                               obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
35395 +                               if (unlikely(obj->mode & GR_WRITE))
35396 +                                       task->is_writable = 1;
35397 +
35398 +                               gr_set_proc_res(task);
35399 +
35400 +#ifdef CONFIG_GRKERNSEC_ACL_DEBUG
35401 +                               printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
35402 +#endif
35403 +                       } else {
35404 +                               read_unlock(&grsec_exec_file_lock);
35405 +                               read_unlock(&tasklist_lock);
35406 +                               rcu_read_unlock();
35407 +                               gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
35408 +                               return 1;
35409 +                       }
35410 +               } else {
35411 +                       // it's a kernel process
35412 +                       task->role = kernel_role;
35413 +                       task->acl = kernel_role->root_label;
35414 +#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
35415 +                       task->acl->mode &= ~GR_PROCFIND;
35416 +#endif
35417 +               }
35418 +       } while_each_thread(task2, task);
35419 +       read_unlock(&grsec_exec_file_lock);
35420 +       read_unlock(&tasklist_lock);
35421 +       rcu_read_unlock();
35422 +
35423 +       return 0;
35424 +}
35425 +
35426 +void
35427 +gr_learn_resource(const struct task_struct *task,
35428 +                 const int res, const unsigned long wanted, const int gt)
35429 +{
35430 +       struct acl_subject_label *acl;
35431 +       const struct cred *cred;
35432 +
35433 +       if (unlikely((gr_status & GR_READY) &&
35434 +                    task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
35435 +               goto skip_reslog;
35436 +
35437 +#ifdef CONFIG_GRKERNSEC_RESLOG
35438 +       gr_log_resource(task, res, wanted, gt);
35439 +#endif
35440 +      skip_reslog:
35441 +
35442 +       if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
35443 +               return;
35444 +
35445 +       acl = task->acl;
35446 +
35447 +       if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
35448 +                  !(acl->resmask & (1 << (unsigned short) res))))
35449 +               return;
35450 +
35451 +       if (wanted >= acl->res[res].rlim_cur) {
35452 +               unsigned long res_add;
35453 +
35454 +               res_add = wanted;
35455 +               switch (res) {
35456 +               case RLIMIT_CPU:
35457 +                       res_add += GR_RLIM_CPU_BUMP;
35458 +                       break;
35459 +               case RLIMIT_FSIZE:
35460 +                       res_add += GR_RLIM_FSIZE_BUMP;
35461 +                       break;
35462 +               case RLIMIT_DATA:
35463 +                       res_add += GR_RLIM_DATA_BUMP;
35464 +                       break;
35465 +               case RLIMIT_STACK:
35466 +                       res_add += GR_RLIM_STACK_BUMP;
35467 +                       break;
35468 +               case RLIMIT_CORE:
35469 +                       res_add += GR_RLIM_CORE_BUMP;
35470 +                       break;
35471 +               case RLIMIT_RSS:
35472 +                       res_add += GR_RLIM_RSS_BUMP;
35473 +                       break;
35474 +               case RLIMIT_NPROC:
35475 +                       res_add += GR_RLIM_NPROC_BUMP;
35476 +                       break;
35477 +               case RLIMIT_NOFILE:
35478 +                       res_add += GR_RLIM_NOFILE_BUMP;
35479 +                       break;
35480 +               case RLIMIT_MEMLOCK:
35481 +                       res_add += GR_RLIM_MEMLOCK_BUMP;
35482 +                       break;
35483 +               case RLIMIT_AS:
35484 +                       res_add += GR_RLIM_AS_BUMP;
35485 +                       break;
35486 +               case RLIMIT_LOCKS:
35487 +                       res_add += GR_RLIM_LOCKS_BUMP;
35488 +                       break;
35489 +               case RLIMIT_SIGPENDING:
35490 +                       res_add += GR_RLIM_SIGPENDING_BUMP;
35491 +                       break;
35492 +               case RLIMIT_MSGQUEUE:
35493 +                       res_add += GR_RLIM_MSGQUEUE_BUMP;
35494 +                       break;
35495 +               case RLIMIT_NICE:
35496 +                       res_add += GR_RLIM_NICE_BUMP;
35497 +                       break;
35498 +               case RLIMIT_RTPRIO:
35499 +                       res_add += GR_RLIM_RTPRIO_BUMP;
35500 +                       break;
35501 +               case RLIMIT_RTTIME:
35502 +                       res_add += GR_RLIM_RTTIME_BUMP;
35503 +                       break;
35504 +               }
35505 +
35506 +               acl->res[res].rlim_cur = res_add;
35507 +
35508 +               if (wanted > acl->res[res].rlim_max)
35509 +                       acl->res[res].rlim_max = res_add;
35510 +
35511 +               /* only log the subject filename, since resource logging is supported for
35512 +                  single-subject learning only */
35513 +               rcu_read_lock();
35514 +               cred = __task_cred(task);
35515 +               security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
35516 +                              task->role->roletype, cred->uid, cred->gid, acl->filename,
35517 +                              acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
35518 +                              "", (unsigned long) res, &task->signal->curr_ip);
35519 +               rcu_read_unlock();
35520 +       }
35521 +
35522 +       return;
35523 +}
35524 +
35525 +#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
35526 +void
35527 +pax_set_initial_flags(struct linux_binprm *bprm)
35528 +{
35529 +       struct task_struct *task = current;
35530 +        struct acl_subject_label *proc;
35531 +       unsigned long flags;
35532 +
35533 +        if (unlikely(!(gr_status & GR_READY)))
35534 +                return;
35535 +
35536 +       flags = pax_get_flags(task);
35537 +
35538 +        proc = task->acl;
35539 +
35540 +       if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
35541 +               flags &= ~MF_PAX_PAGEEXEC;
35542 +       if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
35543 +               flags &= ~MF_PAX_SEGMEXEC;
35544 +       if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
35545 +               flags &= ~MF_PAX_RANDMMAP;
35546 +       if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
35547 +               flags &= ~MF_PAX_EMUTRAMP;
35548 +       if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
35549 +               flags &= ~MF_PAX_MPROTECT;
35550 +
35551 +       if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
35552 +               flags |= MF_PAX_PAGEEXEC;
35553 +       if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
35554 +               flags |= MF_PAX_SEGMEXEC;
35555 +       if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
35556 +               flags |= MF_PAX_RANDMMAP;
35557 +       if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
35558 +               flags |= MF_PAX_EMUTRAMP;
35559 +       if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
35560 +               flags |= MF_PAX_MPROTECT;
35561 +
35562 +       pax_set_flags(task, flags);
35563 +
35564 +        return;
35565 +}
35566 +#endif
35567 +
35568 +#ifdef CONFIG_SYSCTL
35569 +/* Eric Biederman likes breaking userland ABI and every inode-based security
35570 +   system to save 35kb of memory */
35571 +
35572 +/* we modify the passed in filename, but adjust it back before returning */
35573 +static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
35574 +{
35575 +       struct name_entry *nmatch;
35576 +       char *p, *lastp = NULL;
35577 +       struct acl_object_label *obj = NULL, *tmp;
35578 +       struct acl_subject_label *tmpsubj;
35579 +       char c = '\0';
35580 +
35581 +       read_lock(&gr_inode_lock);
35582 +
35583 +       p = name + len - 1;
35584 +       do {
35585 +               nmatch = lookup_name_entry(name);
35586 +               if (lastp != NULL)
35587 +                       *lastp = c;
35588 +
35589 +               if (nmatch == NULL)
35590 +                       goto next_component;
35591 +               tmpsubj = current->acl;
35592 +               do {
35593 +                       obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
35594 +                       if (obj != NULL) {
35595 +                               tmp = obj->globbed;
35596 +                               while (tmp) {
35597 +                                       if (!glob_match(tmp->filename, name)) {
35598 +                                               obj = tmp;
35599 +                                               goto found_obj;
35600 +                                       }
35601 +                                       tmp = tmp->next;
35602 +                               }
35603 +                               goto found_obj;
35604 +                       }
35605 +               } while ((tmpsubj = tmpsubj->parent_subject));
35606 +next_component:
35607 +               /* end case */
35608 +               if (p == name)
35609 +                       break;
35610 +
35611 +               while (*p != '/')
35612 +                       p--;
35613 +               if (p == name)
35614 +                       lastp = p + 1;
35615 +               else {
35616 +                       lastp = p;
35617 +                       p--;
35618 +               }
35619 +               c = *lastp;
35620 +               *lastp = '\0';
35621 +       } while (1);
35622 +found_obj:
35623 +       read_unlock(&gr_inode_lock);
35624 +       /* obj returned will always be non-null */
35625 +       return obj;
35626 +}
35627 +
35628 +/* returns 0 when allowing, non-zero on error
35629 +   op of 0 is used for readdir, so we don't log the names of hidden files
35630 +*/
35631 +__u32
35632 +gr_handle_sysctl(const struct ctl_table *table, const int op)
35633 +{
35634 +       ctl_table *tmp;
35635 +       const char *proc_sys = "/proc/sys";
35636 +       char *path;
35637 +       struct acl_object_label *obj;
35638 +       unsigned short len = 0, pos = 0, depth = 0, i;
35639 +       __u32 err = 0;
35640 +       __u32 mode = 0;
35641 +
35642 +       if (unlikely(!(gr_status & GR_READY)))
35643 +               return 0;
35644 +
35645 +       /* for now, ignore operations on non-sysctl entries if it's not a
35646 +          readdir*/
35647 +       if (table->child != NULL && op != 0)
35648 +               return 0;
35649 +
35650 +       mode |= GR_FIND;
35651 +       /* it's only a read if it's an entry, read on dirs is for readdir */
35652 +       if (op & MAY_READ)
35653 +               mode |= GR_READ;
35654 +       if (op & MAY_WRITE)
35655 +               mode |= GR_WRITE;
35656 +
35657 +       preempt_disable();
35658 +
35659 +       path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
35660 +
35661 +       /* it's only a read/write if it's an actual entry, not a dir
35662 +          (which are opened for readdir)
35663 +       */
35664 +
35665 +       /* convert the requested sysctl entry into a pathname */
35666 +
35667 +       for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
35668 +               len += strlen(tmp->procname);
35669 +               len++;
35670 +               depth++;
35671 +       }
35672 +
35673 +       if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
35674 +               /* deny */
35675 +               goto out;
35676 +       }
35677 +
35678 +       memset(path, 0, PAGE_SIZE);
35679 +
35680 +       memcpy(path, proc_sys, strlen(proc_sys));
35681 +
35682 +       pos += strlen(proc_sys);
35683 +
35684 +       for (; depth > 0; depth--) {
35685 +               path[pos] = '/';
35686 +               pos++;
35687 +               for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
35688 +                       if (depth == i) {
35689 +                               memcpy(path + pos, tmp->procname,
35690 +                                      strlen(tmp->procname));
35691 +                               pos += strlen(tmp->procname);
35692 +                       }
35693 +                       i++;
35694 +               }
35695 +       }
35696 +
35697 +       obj = gr_lookup_by_name(path, pos);
35698 +       err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
35699 +
35700 +       if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
35701 +                    ((err & mode) != mode))) {
35702 +               __u32 new_mode = mode;
35703 +
35704 +               new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
35705 +
35706 +               err = 0;
35707 +               gr_log_learn_sysctl(path, new_mode);
35708 +       } else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
35709 +               gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
35710 +               err = -ENOENT;
35711 +       } else if (!(err & GR_FIND)) {
35712 +               err = -ENOENT;
35713 +       } else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
35714 +               gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
35715 +                              path, (mode & GR_READ) ? " reading" : "",
35716 +                              (mode & GR_WRITE) ? " writing" : "");
35717 +               err = -EACCES;
35718 +       } else if ((err & mode) != mode) {
35719 +               err = -EACCES;
35720 +       } else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
35721 +               gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
35722 +                              path, (mode & GR_READ) ? " reading" : "",
35723 +                              (mode & GR_WRITE) ? " writing" : "");
35724 +               err = 0;
35725 +       } else
35726 +               err = 0;
35727 +
35728 +      out:
35729 +       preempt_enable();
35730 +
35731 +       return err;
35732 +}
35733 +#endif
35734 +
35735 +int
35736 +gr_handle_proc_ptrace(struct task_struct *task)
35737 +{
35738 +       struct file *filp;
35739 +       struct task_struct *tmp = task;
35740 +       struct task_struct *curtemp = current;
35741 +       __u32 retmode;
35742 +
35743 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
35744 +       if (unlikely(!(gr_status & GR_READY)))
35745 +               return 0;
35746 +#endif
35747 +
35748 +       read_lock(&tasklist_lock);
35749 +       read_lock(&grsec_exec_file_lock);
35750 +       filp = task->exec_file;
35751 +
35752 +       while (tmp->pid > 0) {
35753 +               if (tmp == curtemp)
35754 +                       break;
35755 +               tmp = tmp->parent;
35756 +       }
35757 +
35758 +       if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
35759 +                               ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE))))) {
35760 +               read_unlock(&grsec_exec_file_lock);
35761 +               read_unlock(&tasklist_lock);
35762 +               return 1;
35763 +       }
35764 +
35765 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
35766 +       if (!(gr_status & GR_READY)) {
35767 +               read_unlock(&grsec_exec_file_lock);
35768 +               read_unlock(&tasklist_lock);
35769 +               return 0;
35770 +       }
35771 +#endif
35772 +
35773 +       retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
35774 +       read_unlock(&grsec_exec_file_lock);
35775 +       read_unlock(&tasklist_lock);
35776 +
35777 +       if (retmode & GR_NOPTRACE)
35778 +               return 1;
35779 +
35780 +       if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
35781 +           && (current->acl != task->acl || (current->acl != current->role->root_label
35782 +           && current->pid != task->pid)))
35783 +               return 1;
35784 +
35785 +       return 0;
35786 +}
35787 +
35788 +int
35789 +gr_handle_ptrace(struct task_struct *task, const long request)
35790 +{
35791 +       struct task_struct *tmp = task;
35792 +       struct task_struct *curtemp = current;
35793 +       __u32 retmode;
35794 +
35795 +#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
35796 +       if (unlikely(!(gr_status & GR_READY)))
35797 +               return 0;
35798 +#endif
35799 +
35800 +       read_lock(&tasklist_lock);
35801 +       while (tmp->pid > 0) {
35802 +               if (tmp == curtemp)
35803 +                       break;
35804 +               tmp = tmp->parent;
35805 +       }
35806 +
35807 +       if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
35808 +                               ((gr_status & GR_READY) && !(current->acl->mode & GR_RELAXPTRACE)))) {
35809 +               read_unlock(&tasklist_lock);
35810 +               gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
35811 +               return 1;
35812 +       }
35813 +       read_unlock(&tasklist_lock);
35814 +
35815 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
35816 +       if (!(gr_status & GR_READY))
35817 +               return 0;
35818 +#endif
35819 +
35820 +       read_lock(&grsec_exec_file_lock);
35821 +       if (unlikely(!task->exec_file)) {
35822 +               read_unlock(&grsec_exec_file_lock);
35823 +               return 0;
35824 +       }
35825 +
35826 +       retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
35827 +       read_unlock(&grsec_exec_file_lock);
35828 +
35829 +       if (retmode & GR_NOPTRACE) {
35830 +               gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
35831 +               return 1;
35832 +       }
35833 +
35834 +       if (retmode & GR_PTRACERD) {
35835 +               switch (request) {
35836 +               case PTRACE_POKETEXT:
35837 +               case PTRACE_POKEDATA:
35838 +               case PTRACE_POKEUSR:
35839 +#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
35840 +               case PTRACE_SETREGS:
35841 +               case PTRACE_SETFPREGS:
35842 +#endif
35843 +#ifdef CONFIG_X86
35844 +               case PTRACE_SETFPXREGS:
35845 +#endif
35846 +#ifdef CONFIG_ALTIVEC
35847 +               case PTRACE_SETVRREGS:
35848 +#endif
35849 +                       return 1;
35850 +               default:
35851 +                       return 0;
35852 +               }
35853 +       } else if (!(current->acl->mode & GR_POVERRIDE) &&
35854 +                  !(current->role->roletype & GR_ROLE_GOD) &&
35855 +                  (current->acl != task->acl)) {
35856 +               gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
35857 +               return 1;
35858 +       }
35859 +
35860 +       return 0;
35861 +}
35862 +
35863 +static int is_writable_mmap(const struct file *filp)
35864 +{
35865 +       struct task_struct *task = current;
35866 +       struct acl_object_label *obj, *obj2;
35867 +
35868 +       if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
35869 +           !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode)) {
35870 +               obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
35871 +               obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
35872 +                                    task->role->root_label);
35873 +               if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
35874 +                       gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
35875 +                       return 1;
35876 +               }
35877 +       }
35878 +       return 0;
35879 +}
35880 +
35881 +int
35882 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
35883 +{
35884 +       __u32 mode;
35885 +
35886 +       if (unlikely(!file || !(prot & PROT_EXEC)))
35887 +               return 1;
35888 +
35889 +       if (is_writable_mmap(file))
35890 +               return 0;
35891 +
35892 +       mode =
35893 +           gr_search_file(file->f_path.dentry,
35894 +                          GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
35895 +                          file->f_path.mnt);
35896 +
35897 +       if (!gr_tpe_allow(file))
35898 +               return 0;
35899 +
35900 +       if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
35901 +               gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
35902 +               return 0;
35903 +       } else if (unlikely(!(mode & GR_EXEC))) {
35904 +               return 0;
35905 +       } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
35906 +               gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
35907 +               return 1;
35908 +       }
35909 +
35910 +       return 1;
35911 +}
35912 +
35913 +int
35914 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
35915 +{
35916 +       __u32 mode;
35917 +
35918 +       if (unlikely(!file || !(prot & PROT_EXEC)))
35919 +               return 1;
35920 +
35921 +       if (is_writable_mmap(file))
35922 +               return 0;
35923 +
35924 +       mode =
35925 +           gr_search_file(file->f_path.dentry,
35926 +                          GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
35927 +                          file->f_path.mnt);
35928 +
35929 +       if (!gr_tpe_allow(file))
35930 +               return 0;
35931 +
35932 +       if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
35933 +               gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
35934 +               return 0;
35935 +       } else if (unlikely(!(mode & GR_EXEC))) {
35936 +               return 0;
35937 +       } else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
35938 +               gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
35939 +               return 1;
35940 +       }
35941 +
35942 +       return 1;
35943 +}
35944 +
35945 +void
35946 +gr_acl_handle_psacct(struct task_struct *task, const long code)
35947 +{
35948 +       unsigned long runtime;
35949 +       unsigned long cputime;
35950 +       unsigned int wday, cday;
35951 +       __u8 whr, chr;
35952 +       __u8 wmin, cmin;
35953 +       __u8 wsec, csec;
35954 +       struct timespec timeval;
35955 +
35956 +       if (unlikely(!(gr_status & GR_READY) || !task->acl ||
35957 +                    !(task->acl->mode & GR_PROCACCT)))
35958 +               return;
35959 +
35960 +       do_posix_clock_monotonic_gettime(&timeval);
35961 +       runtime = timeval.tv_sec - task->start_time.tv_sec;
35962 +       wday = runtime / (3600 * 24);
35963 +       runtime -= wday * (3600 * 24);
35964 +       whr = runtime / 3600;
35965 +       runtime -= whr * 3600;
35966 +       wmin = runtime / 60;
35967 +       runtime -= wmin * 60;
35968 +       wsec = runtime;
35969 +
35970 +       cputime = (task->utime + task->stime) / HZ;
35971 +       cday = cputime / (3600 * 24);
35972 +       cputime -= cday * (3600 * 24);
35973 +       chr = cputime / 3600;
35974 +       cputime -= chr * 3600;
35975 +       cmin = cputime / 60;
35976 +       cputime -= cmin * 60;
35977 +       csec = cputime;
35978 +
35979 +       gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
35980 +
35981 +       return;
35982 +}
35983 +
35984 +void gr_set_kernel_label(struct task_struct *task)
35985 +{
35986 +       if (gr_status & GR_READY) {
35987 +               task->role = kernel_role;
35988 +               task->acl = kernel_role->root_label;
35989 +       }
35990 +       return;
35991 +}
35992 +
35993 +#ifdef CONFIG_TASKSTATS
35994 +int gr_is_taskstats_denied(int pid)
35995 +{
35996 +       struct task_struct *task;
35997 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
35998 +       const struct cred *cred;
35999 +#endif
36000 +       int ret = 0;
36001 +
36002 +       /* restrict taskstats viewing to un-chrooted root users
36003 +          who have the 'view' subject flag if the RBAC system is enabled
36004 +       */
36005 +
36006 +       read_lock(&tasklist_lock);
36007 +       task = find_task_by_vpid(pid);
36008 +       if (task) {
36009 +               gr_fs_read_lock(task);
36010 +#ifdef CONFIG_GRKERNSEC_CHROOT
36011 +               if (proc_is_chrooted(task))
36012 +                       ret = -EACCES;
36013 +#endif
36014 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36015 +               cred = __task_cred(task);
36016 +#ifdef CONFIG_GRKERNSEC_PROC_USER
36017 +               if (cred->uid != 0)
36018 +                       ret = -EACCES;
36019 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
36020 +               if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
36021 +                       ret = -EACCES;
36022 +#endif
36023 +#endif
36024 +               if (gr_status & GR_READY) {
36025 +                       if (!(task->acl->mode & GR_VIEW))
36026 +                               ret = -EACCES;
36027 +               }
36028 +
36029 +               gr_fs_read_unlock(task);
36030 +       } else
36031 +               ret = -ENOENT;
36032 +
36033 +       read_unlock(&tasklist_lock);
36034 +
36035 +       return ret;
36036 +}
36037 +#endif
36038 +
36039 +int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
36040 +{
36041 +       struct task_struct *task = current;
36042 +       struct dentry *dentry = file->f_path.dentry;
36043 +       struct vfsmount *mnt = file->f_path.mnt;
36044 +       struct acl_object_label *obj, *tmp;
36045 +       struct acl_subject_label *subj;
36046 +       unsigned int bufsize;
36047 +       int is_not_root;
36048 +       char *path;
36049 +
36050 +       if (unlikely(!(gr_status & GR_READY)))
36051 +               return 1;
36052 +
36053 +       if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
36054 +               return 1;
36055 +
36056 +       /* ignore Eric Biederman */
36057 +       if (IS_PRIVATE(dentry->d_inode))
36058 +               return 1;
36059 +
36060 +       subj = task->acl;
36061 +       do {
36062 +               obj = lookup_acl_obj_label(ino, dentry->d_inode->i_sb->s_dev, subj);
36063 +               if (obj != NULL)
36064 +                       return (obj->mode & GR_FIND) ? 1 : 0;
36065 +       } while ((subj = subj->parent_subject));
36066 +
36067 +       /* this is purely an optimization since we're looking for an object
36068 +          for the directory we're doing a readdir on
36069 +          if it's possible for any globbed object to match the entry we're
36070 +          filling into the directory, then the object we find here will be
36071 +          an anchor point with attached globbed objects
36072 +       */
36073 +       obj = chk_obj_label_noglob(dentry, mnt, task->acl);
36074 +       if (obj->globbed == NULL)
36075 +               return (obj->mode & GR_FIND) ? 1 : 0;
36076 +
36077 +       is_not_root = ((obj->filename[0] == '/') &&
36078 +                  (obj->filename[1] == '\0')) ? 0 : 1;
36079 +       bufsize = PAGE_SIZE - namelen - is_not_root;
36080 +
36081 +       /* check bufsize > PAGE_SIZE || bufsize == 0 */
36082 +       if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
36083 +               return 1;
36084 +
36085 +       preempt_disable();
36086 +       path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
36087 +                          bufsize);
36088 +
36089 +       bufsize = strlen(path);
36090 +
36091 +       /* if base is "/", don't append an additional slash */
36092 +       if (is_not_root)
36093 +               *(path + bufsize) = '/';
36094 +       memcpy(path + bufsize + is_not_root, name, namelen);
36095 +       *(path + bufsize + namelen + is_not_root) = '\0';
36096 +
36097 +       tmp = obj->globbed;
36098 +       while (tmp) {
36099 +               if (!glob_match(tmp->filename, path)) {
36100 +                       preempt_enable();
36101 +                       return (tmp->mode & GR_FIND) ? 1 : 0;
36102 +               }
36103 +               tmp = tmp->next;
36104 +       }
36105 +       preempt_enable();
36106 +       return (obj->mode & GR_FIND) ? 1 : 0;
36107 +}
36108 +
36109 +EXPORT_SYMBOL(gr_learn_resource);
36110 +EXPORT_SYMBOL(gr_set_kernel_label);
36111 +#ifdef CONFIG_SECURITY
36112 +EXPORT_SYMBOL(gr_check_user_change);
36113 +EXPORT_SYMBOL(gr_check_group_change);
36114 +#endif
36115 +
36116 diff -urNp linux-2.6.33/grsecurity/gracl_cap.c linux-2.6.33/grsecurity/gracl_cap.c
36117 --- linux-2.6.33/grsecurity/gracl_cap.c 1969-12-31 19:00:00.000000000 -0500
36118 +++ linux-2.6.33/grsecurity/gracl_cap.c 2010-03-07 12:23:36.105670657 -0500
36119 @@ -0,0 +1,131 @@
36120 +#include <linux/kernel.h>
36121 +#include <linux/module.h>
36122 +#include <linux/sched.h>
36123 +#include <linux/gracl.h>
36124 +#include <linux/grsecurity.h>
36125 +#include <linux/grinternal.h>
36126 +
36127 +static const char *captab_log[] = {
36128 +       "CAP_CHOWN",
36129 +       "CAP_DAC_OVERRIDE",
36130 +       "CAP_DAC_READ_SEARCH",
36131 +       "CAP_FOWNER",
36132 +       "CAP_FSETID",
36133 +       "CAP_KILL",
36134 +       "CAP_SETGID",
36135 +       "CAP_SETUID",
36136 +       "CAP_SETPCAP",
36137 +       "CAP_LINUX_IMMUTABLE",
36138 +       "CAP_NET_BIND_SERVICE",
36139 +       "CAP_NET_BROADCAST",
36140 +       "CAP_NET_ADMIN",
36141 +       "CAP_NET_RAW",
36142 +       "CAP_IPC_LOCK",
36143 +       "CAP_IPC_OWNER",
36144 +       "CAP_SYS_MODULE",
36145 +       "CAP_SYS_RAWIO",
36146 +       "CAP_SYS_CHROOT",
36147 +       "CAP_SYS_PTRACE",
36148 +       "CAP_SYS_PACCT",
36149 +       "CAP_SYS_ADMIN",
36150 +       "CAP_SYS_BOOT",
36151 +       "CAP_SYS_NICE",
36152 +       "CAP_SYS_RESOURCE",
36153 +       "CAP_SYS_TIME",
36154 +       "CAP_SYS_TTY_CONFIG",
36155 +       "CAP_MKNOD",
36156 +       "CAP_LEASE",
36157 +       "CAP_AUDIT_WRITE",
36158 +       "CAP_AUDIT_CONTROL",
36159 +       "CAP_SETFCAP",
36160 +       "CAP_MAC_OVERRIDE",
36161 +       "CAP_MAC_ADMIN"
36162 +};
36163 +
36164 +EXPORT_SYMBOL(gr_is_capable);
36165 +EXPORT_SYMBOL(gr_is_capable_nolog);
36166 +
36167 +int
36168 +gr_is_capable(const int cap)
36169 +{
36170 +       struct task_struct *task = current;
36171 +       const struct cred *cred = current_cred();
36172 +       struct acl_subject_label *curracl;
36173 +       kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
36174 +
36175 +       if (!gr_acl_is_enabled())
36176 +               return 1;
36177 +
36178 +       curracl = task->acl;
36179 +
36180 +       cap_drop = curracl->cap_lower;
36181 +       cap_mask = curracl->cap_mask;
36182 +
36183 +       while ((curracl = curracl->parent_subject)) {
36184 +               /* if the cap isn't specified in the current computed mask but is specified in the
36185 +                  current level subject, and is lowered in the current level subject, then add
36186 +                  it to the set of dropped capabilities
36187 +                  otherwise, add the current level subject's mask to the current computed mask
36188 +                */
36189 +               if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
36190 +                       cap_raise(cap_mask, cap);
36191 +                       if (cap_raised(curracl->cap_lower, cap))
36192 +                               cap_raise(cap_drop, cap);
36193 +               }
36194 +       }
36195 +
36196 +       if (!cap_raised(cap_drop, cap))
36197 +               return 1;
36198 +
36199 +       curracl = task->acl;
36200 +
36201 +       if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
36202 +           && cap_raised(cred->cap_effective, cap)) {
36203 +               security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
36204 +                              task->role->roletype, cred->uid,
36205 +                              cred->gid, task->exec_file ?
36206 +                              gr_to_filename(task->exec_file->f_path.dentry,
36207 +                              task->exec_file->f_path.mnt) : curracl->filename,
36208 +                              curracl->filename, 0UL,
36209 +                              0UL, "", (unsigned long) cap, &task->signal->curr_ip);
36210 +               return 1;
36211 +       }
36212 +
36213 +       if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap))
36214 +               gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
36215 +       return 0;
36216 +}
36217 +
36218 +int
36219 +gr_is_capable_nolog(const int cap)
36220 +{
36221 +       struct acl_subject_label *curracl;
36222 +       kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
36223 +
36224 +       if (!gr_acl_is_enabled())
36225 +               return 1;
36226 +
36227 +       curracl = current->acl;
36228 +
36229 +       cap_drop = curracl->cap_lower;
36230 +       cap_mask = curracl->cap_mask;
36231 +
36232 +       while ((curracl = curracl->parent_subject)) {
36233 +               /* if the cap isn't specified in the current computed mask but is specified in the
36234 +                  current level subject, and is lowered in the current level subject, then add
36235 +                  it to the set of dropped capabilities
36236 +                  otherwise, add the current level subject's mask to the current computed mask
36237 +                */
36238 +               if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
36239 +                       cap_raise(cap_mask, cap);
36240 +                       if (cap_raised(curracl->cap_lower, cap))
36241 +                               cap_raise(cap_drop, cap);
36242 +               }
36243 +       }
36244 +
36245 +       if (!cap_raised(cap_drop, cap))
36246 +               return 1;
36247 +
36248 +       return 0;
36249 +}
36250 +
36251 diff -urNp linux-2.6.33/grsecurity/gracl_fs.c linux-2.6.33/grsecurity/gracl_fs.c
36252 --- linux-2.6.33/grsecurity/gracl_fs.c  1969-12-31 19:00:00.000000000 -0500
36253 +++ linux-2.6.33/grsecurity/gracl_fs.c  2010-03-07 12:23:36.105670657 -0500
36254 @@ -0,0 +1,424 @@
36255 +#include <linux/kernel.h>
36256 +#include <linux/sched.h>
36257 +#include <linux/types.h>
36258 +#include <linux/fs.h>
36259 +#include <linux/file.h>
36260 +#include <linux/stat.h>
36261 +#include <linux/grsecurity.h>
36262 +#include <linux/grinternal.h>
36263 +#include <linux/gracl.h>
36264 +
36265 +__u32
36266 +gr_acl_handle_hidden_file(const struct dentry * dentry,
36267 +                         const struct vfsmount * mnt)
36268 +{
36269 +       __u32 mode;
36270 +
36271 +       if (unlikely(!dentry->d_inode))
36272 +               return GR_FIND;
36273 +
36274 +       mode =
36275 +           gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
36276 +
36277 +       if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
36278 +               gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
36279 +               return mode;
36280 +       } else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
36281 +               gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
36282 +               return 0;
36283 +       } else if (unlikely(!(mode & GR_FIND)))
36284 +               return 0;
36285 +
36286 +       return GR_FIND;
36287 +}
36288 +
36289 +__u32
36290 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
36291 +                  const int fmode)
36292 +{
36293 +       __u32 reqmode = GR_FIND;
36294 +       __u32 mode;
36295 +
36296 +       if (unlikely(!dentry->d_inode))
36297 +               return reqmode;
36298 +
36299 +       if (unlikely(fmode & O_APPEND))
36300 +               reqmode |= GR_APPEND;
36301 +       else if (unlikely(fmode & FMODE_WRITE))
36302 +               reqmode |= GR_WRITE;
36303 +       if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
36304 +               reqmode |= GR_READ;
36305 +       if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
36306 +               reqmode &= ~GR_READ;
36307 +       mode =
36308 +           gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
36309 +                          mnt);
36310 +
36311 +       if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
36312 +               gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
36313 +                              reqmode & GR_READ ? " reading" : "",
36314 +                              reqmode & GR_WRITE ? " writing" : reqmode &
36315 +                              GR_APPEND ? " appending" : "");
36316 +               return reqmode;
36317 +       } else
36318 +           if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
36319 +       {
36320 +               gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
36321 +                              reqmode & GR_READ ? " reading" : "",
36322 +                              reqmode & GR_WRITE ? " writing" : reqmode &
36323 +                              GR_APPEND ? " appending" : "");
36324 +               return 0;
36325 +       } else if (unlikely((mode & reqmode) != reqmode))
36326 +               return 0;
36327 +
36328 +       return reqmode;
36329 +}
36330 +
36331 +__u32
36332 +gr_acl_handle_creat(const struct dentry * dentry,
36333 +                   const struct dentry * p_dentry,
36334 +                   const struct vfsmount * p_mnt, const int fmode,
36335 +                   const int imode)
36336 +{
36337 +       __u32 reqmode = GR_WRITE | GR_CREATE;
36338 +       __u32 mode;
36339 +
36340 +       if (unlikely(fmode & O_APPEND))
36341 +               reqmode |= GR_APPEND;
36342 +       if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
36343 +               reqmode |= GR_READ;
36344 +       if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
36345 +               reqmode |= GR_SETID;
36346 +
36347 +       mode =
36348 +           gr_check_create(dentry, p_dentry, p_mnt,
36349 +                           reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
36350 +
36351 +       if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
36352 +               gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
36353 +                              reqmode & GR_READ ? " reading" : "",
36354 +                              reqmode & GR_WRITE ? " writing" : reqmode &
36355 +                              GR_APPEND ? " appending" : "");
36356 +               return reqmode;
36357 +       } else
36358 +           if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
36359 +       {
36360 +               gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
36361 +                              reqmode & GR_READ ? " reading" : "",
36362 +                              reqmode & GR_WRITE ? " writing" : reqmode &
36363 +                              GR_APPEND ? " appending" : "");
36364 +               return 0;
36365 +       } else if (unlikely((mode & reqmode) != reqmode))
36366 +               return 0;
36367 +
36368 +       return reqmode;
36369 +}
36370 +
36371 +__u32
36372 +gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
36373 +                    const int fmode)
36374 +{
36375 +       __u32 mode, reqmode = GR_FIND;
36376 +
36377 +       if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
36378 +               reqmode |= GR_EXEC;
36379 +       if (fmode & S_IWOTH)
36380 +               reqmode |= GR_WRITE;
36381 +       if (fmode & S_IROTH)
36382 +               reqmode |= GR_READ;
36383 +
36384 +       mode =
36385 +           gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
36386 +                          mnt);
36387 +
36388 +       if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
36389 +               gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
36390 +                              reqmode & GR_READ ? " reading" : "",
36391 +                              reqmode & GR_WRITE ? " writing" : "",
36392 +                              reqmode & GR_EXEC ? " executing" : "");
36393 +               return reqmode;
36394 +       } else
36395 +           if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
36396 +       {
36397 +               gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
36398 +                              reqmode & GR_READ ? " reading" : "",
36399 +                              reqmode & GR_WRITE ? " writing" : "",
36400 +                              reqmode & GR_EXEC ? " executing" : "");
36401 +               return 0;
36402 +       } else if (unlikely((mode & reqmode) != reqmode))
36403 +               return 0;
36404 +
36405 +       return reqmode;
36406 +}
36407 +
36408 +static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
36409 +{
36410 +       __u32 mode;
36411 +
36412 +       mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
36413 +
36414 +       if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
36415 +               gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
36416 +               return mode;
36417 +       } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
36418 +               gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
36419 +               return 0;
36420 +       } else if (unlikely((mode & (reqmode)) != (reqmode)))
36421 +               return 0;
36422 +
36423 +       return (reqmode);
36424 +}
36425 +
36426 +__u32
36427 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
36428 +{
36429 +       return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
36430 +}
36431 +
36432 +__u32
36433 +gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
36434 +{
36435 +       return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
36436 +}
36437 +
36438 +__u32
36439 +gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
36440 +{
36441 +       return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
36442 +}
36443 +
36444 +__u32
36445 +gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
36446 +{
36447 +       return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
36448 +}
36449 +
36450 +__u32
36451 +gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
36452 +                    mode_t mode)
36453 +{
36454 +       if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
36455 +               return 1;
36456 +
36457 +       if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
36458 +               return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
36459 +                                  GR_FCHMOD_ACL_MSG);
36460 +       } else {
36461 +               return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
36462 +       }
36463 +}
36464 +
36465 +__u32
36466 +gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
36467 +                   mode_t mode)
36468 +{
36469 +       if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
36470 +               return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
36471 +                                  GR_CHMOD_ACL_MSG);
36472 +       } else {
36473 +               return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
36474 +       }
36475 +}
36476 +
36477 +__u32
36478 +gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
36479 +{
36480 +       return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
36481 +}
36482 +
36483 +__u32
36484 +gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
36485 +{
36486 +       return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
36487 +}
36488 +
36489 +__u32
36490 +gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
36491 +{
36492 +       return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
36493 +                          GR_UNIXCONNECT_ACL_MSG);
36494 +}
36495 +
36496 +/* hardlinks require at minimum create permission,
36497 +   any additional privilege required is based on the
36498 +   privilege of the file being linked to
36499 +*/
36500 +__u32
36501 +gr_acl_handle_link(const struct dentry * new_dentry,
36502 +                  const struct dentry * parent_dentry,
36503 +                  const struct vfsmount * parent_mnt,
36504 +                  const struct dentry * old_dentry,
36505 +                  const struct vfsmount * old_mnt, const char *to)
36506 +{
36507 +       __u32 mode;
36508 +       __u32 needmode = GR_CREATE | GR_LINK;
36509 +       __u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
36510 +
36511 +       mode =
36512 +           gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
36513 +                         old_mnt);
36514 +
36515 +       if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
36516 +               gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
36517 +               return mode;
36518 +       } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
36519 +               gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
36520 +               return 0;
36521 +       } else if (unlikely((mode & needmode) != needmode))
36522 +               return 0;
36523 +
36524 +       return 1;
36525 +}
36526 +
36527 +__u32
36528 +gr_acl_handle_symlink(const struct dentry * new_dentry,
36529 +                     const struct dentry * parent_dentry,
36530 +                     const struct vfsmount * parent_mnt, const char *from)
36531 +{
36532 +       __u32 needmode = GR_WRITE | GR_CREATE;
36533 +       __u32 mode;
36534 +
36535 +       mode =
36536 +           gr_check_create(new_dentry, parent_dentry, parent_mnt,
36537 +                           GR_CREATE | GR_AUDIT_CREATE |
36538 +                           GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
36539 +
36540 +       if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
36541 +               gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
36542 +               return mode;
36543 +       } else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
36544 +               gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
36545 +               return 0;
36546 +       } else if (unlikely((mode & needmode) != needmode))
36547 +               return 0;
36548 +
36549 +       return (GR_WRITE | GR_CREATE);
36550 +}
36551 +
36552 +static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
36553 +{
36554 +       __u32 mode;
36555 +
36556 +       mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
36557 +
36558 +       if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
36559 +               gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
36560 +               return mode;
36561 +       } else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
36562 +               gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
36563 +               return 0;
36564 +       } else if (unlikely((mode & (reqmode)) != (reqmode)))
36565 +               return 0;
36566 +
36567 +       return (reqmode);
36568 +}
36569 +
36570 +__u32
36571 +gr_acl_handle_mknod(const struct dentry * new_dentry,
36572 +                   const struct dentry * parent_dentry,
36573 +                   const struct vfsmount * parent_mnt,
36574 +                   const int mode)
36575 +{
36576 +       __u32 reqmode = GR_WRITE | GR_CREATE;
36577 +       if (unlikely(mode & (S_ISUID | S_ISGID)))
36578 +               reqmode |= GR_SETID;
36579 +
36580 +       return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
36581 +                                 reqmode, GR_MKNOD_ACL_MSG);
36582 +}
36583 +
36584 +__u32
36585 +gr_acl_handle_mkdir(const struct dentry *new_dentry,
36586 +                   const struct dentry *parent_dentry,
36587 +                   const struct vfsmount *parent_mnt)
36588 +{
36589 +       return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
36590 +                                 GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
36591 +}
36592 +
36593 +#define RENAME_CHECK_SUCCESS(old, new) \
36594 +       (((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
36595 +        ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
36596 +
36597 +int
36598 +gr_acl_handle_rename(struct dentry *new_dentry,
36599 +                    struct dentry *parent_dentry,
36600 +                    const struct vfsmount *parent_mnt,
36601 +                    struct dentry *old_dentry,
36602 +                    struct inode *old_parent_inode,
36603 +                    struct vfsmount *old_mnt, const char *newname)
36604 +{
36605 +       __u32 comp1, comp2;
36606 +       int error = 0;
36607 +
36608 +       if (unlikely(!gr_acl_is_enabled()))
36609 +               return 0;
36610 +
36611 +       if (!new_dentry->d_inode) {
36612 +               comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
36613 +                                       GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
36614 +                                       GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
36615 +               comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
36616 +                                      GR_DELETE | GR_AUDIT_DELETE |
36617 +                                      GR_AUDIT_READ | GR_AUDIT_WRITE |
36618 +                                      GR_SUPPRESS, old_mnt);
36619 +       } else {
36620 +               comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
36621 +                                      GR_CREATE | GR_DELETE |
36622 +                                      GR_AUDIT_CREATE | GR_AUDIT_DELETE |
36623 +                                      GR_AUDIT_READ | GR_AUDIT_WRITE |
36624 +                                      GR_SUPPRESS, parent_mnt);
36625 +               comp2 =
36626 +                   gr_search_file(old_dentry,
36627 +                                  GR_READ | GR_WRITE | GR_AUDIT_READ |
36628 +                                  GR_DELETE | GR_AUDIT_DELETE |
36629 +                                  GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
36630 +       }
36631 +
36632 +       if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
36633 +           ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
36634 +               gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
36635 +       else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
36636 +                && !(comp2 & GR_SUPPRESS)) {
36637 +               gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
36638 +               error = -EACCES;
36639 +       } else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
36640 +               error = -EACCES;
36641 +
36642 +       return error;
36643 +}
36644 +
36645 +void
36646 +gr_acl_handle_exit(void)
36647 +{
36648 +       u16 id;
36649 +       char *rolename;
36650 +       struct file *exec_file;
36651 +
36652 +       if (unlikely(current->acl_sp_role && gr_acl_is_enabled())) {
36653 +               id = current->acl_role_id;
36654 +               rolename = current->role->rolename;
36655 +               gr_set_acls(1);
36656 +               gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
36657 +       }
36658 +
36659 +       write_lock(&grsec_exec_file_lock);
36660 +       exec_file = current->exec_file;
36661 +       current->exec_file = NULL;
36662 +       write_unlock(&grsec_exec_file_lock);
36663 +
36664 +       if (exec_file)
36665 +               fput(exec_file);
36666 +}
36667 +
36668 +int
36669 +gr_acl_handle_procpidmem(const struct task_struct *task)
36670 +{
36671 +       if (unlikely(!gr_acl_is_enabled()))
36672 +               return 0;
36673 +
36674 +       if (task != current && task->acl->mode & GR_PROTPROCFD)
36675 +               return -EACCES;
36676 +
36677 +       return 0;
36678 +}
36679 diff -urNp linux-2.6.33/grsecurity/gracl_ip.c linux-2.6.33/grsecurity/gracl_ip.c
36680 --- linux-2.6.33/grsecurity/gracl_ip.c  1969-12-31 19:00:00.000000000 -0500
36681 +++ linux-2.6.33/grsecurity/gracl_ip.c  2010-03-07 12:23:36.105670657 -0500
36682 @@ -0,0 +1,339 @@
36683 +#include <linux/kernel.h>
36684 +#include <asm/uaccess.h>
36685 +#include <asm/errno.h>
36686 +#include <net/sock.h>
36687 +#include <linux/file.h>
36688 +#include <linux/fs.h>
36689 +#include <linux/net.h>
36690 +#include <linux/in.h>
36691 +#include <linux/skbuff.h>
36692 +#include <linux/ip.h>
36693 +#include <linux/udp.h>
36694 +#include <linux/smp_lock.h>
36695 +#include <linux/types.h>
36696 +#include <linux/sched.h>
36697 +#include <linux/netdevice.h>
36698 +#include <linux/inetdevice.h>
36699 +#include <linux/gracl.h>
36700 +#include <linux/grsecurity.h>
36701 +#include <linux/grinternal.h>
36702 +
36703 +#define GR_BIND                        0x01
36704 +#define GR_CONNECT             0x02
36705 +#define GR_INVERT              0x04
36706 +#define GR_BINDOVERRIDE                0x08
36707 +#define GR_CONNECTOVERRIDE     0x10
36708 +
36709 +static const char * gr_protocols[256] = {
36710 +       "ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
36711 +       "egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
36712 +       "chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
36713 +       "trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
36714 +       "merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
36715 +       "il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
36716 +       "mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
36717 +       "tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
36718 +       "sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
36719 +       "cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak",
36720 +       "iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf",
36721 +       "eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
36722 +       "scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
36723 +       "aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
36724 +       "vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
36725 +       "uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
36726 +       "sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
36727 +       "unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
36728 +       "unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
36729 +       "unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
36730 +       "unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
36731 +       "unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
36732 +       "unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
36733 +       "unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
36734 +       "unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
36735 +       "unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
36736 +       "unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
36737 +       "unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
36738 +       "unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
36739 +       "unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
36740 +       "unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
36741 +       "unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
36742 +       };
36743 +
36744 +static const char * gr_socktypes[11] = {
36745 +       "unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6",
36746 +       "unknown:7", "unknown:8", "unknown:9", "packet"
36747 +       };
36748 +
36749 +const char *
36750 +gr_proto_to_name(unsigned char proto)
36751 +{
36752 +       return gr_protocols[proto];
36753 +}
36754 +
36755 +const char *
36756 +gr_socktype_to_name(unsigned char type)
36757 +{
36758 +       return gr_socktypes[type];
36759 +}
36760 +
36761 +int
36762 +gr_search_socket(const int domain, const int type, const int protocol)
36763 +{
36764 +       struct acl_subject_label *curr;
36765 +       const struct cred *cred = current_cred();
36766 +
36767 +       if (unlikely(!gr_acl_is_enabled()))
36768 +               goto exit;
36769 +
36770 +       if ((domain < 0) || (type < 0) || (protocol < 0) || (domain != PF_INET)
36771 +           || (domain >= NPROTO) || (type >= SOCK_MAX) || (protocol > 255))
36772 +               goto exit;      // let the kernel handle it
36773 +
36774 +       curr = current->acl;
36775 +
36776 +       if (!curr->ips)
36777 +               goto exit;
36778 +
36779 +       if ((curr->ip_type & (1 << type)) &&
36780 +           (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
36781 +               goto exit;
36782 +
36783 +       if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
36784 +               /* we don't place acls on raw sockets , and sometimes
36785 +                  dgram/ip sockets are opened for ioctl and not
36786 +                  bind/connect, so we'll fake a bind learn log */
36787 +               if (type == SOCK_RAW || type == SOCK_PACKET) {
36788 +                       __u32 fakeip = 0;
36789 +                       security_learn(GR_IP_LEARN_MSG, current->role->rolename,
36790 +                                      current->role->roletype, cred->uid,
36791 +                                      cred->gid, current->exec_file ?
36792 +                                      gr_to_filename(current->exec_file->f_path.dentry,
36793 +                                      current->exec_file->f_path.mnt) :
36794 +                                      curr->filename, curr->filename,
36795 +                                      &fakeip, 0, type,
36796 +                                      protocol, GR_CONNECT, &current->signal->curr_ip);
36797 +               } else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
36798 +                       __u32 fakeip = 0;
36799 +                       security_learn(GR_IP_LEARN_MSG, current->role->rolename,
36800 +                                      current->role->roletype, cred->uid,
36801 +                                      cred->gid, current->exec_file ?
36802 +                                      gr_to_filename(current->exec_file->f_path.dentry,
36803 +                                      current->exec_file->f_path.mnt) :
36804 +                                      curr->filename, curr->filename,
36805 +                                      &fakeip, 0, type,
36806 +                                      protocol, GR_BIND, &current->signal->curr_ip);
36807 +               }
36808 +               /* we'll log when they use connect or bind */
36809 +               goto exit;
36810 +       }
36811 +
36812 +       gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, "inet",
36813 +                   gr_socktype_to_name(type), gr_proto_to_name(protocol));
36814 +
36815 +       return 0;
36816 +      exit:
36817 +       return 1;
36818 +}
36819 +
36820 +int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
36821 +{
36822 +       if ((ip->mode & mode) &&
36823 +           (ip_port >= ip->low) &&
36824 +           (ip_port <= ip->high) &&
36825 +           ((ntohl(ip_addr) & our_netmask) ==
36826 +            (ntohl(our_addr) & our_netmask))
36827 +           && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
36828 +           && (ip->type & (1 << type))) {
36829 +               if (ip->mode & GR_INVERT)
36830 +                       return 2; // specifically denied
36831 +               else
36832 +                       return 1; // allowed
36833 +       }
36834 +
36835 +       return 0; // not specifically allowed, may continue parsing
36836 +}
36837 +
36838 +static int
36839 +gr_search_connectbind(const int full_mode, struct sock *sk,
36840 +                     struct sockaddr_in *addr, const int type)
36841 +{
36842 +       char iface[IFNAMSIZ] = {0};
36843 +       struct acl_subject_label *curr;
36844 +       struct acl_ip_label *ip;
36845 +       struct inet_sock *isk;
36846 +       struct net_device *dev;
36847 +       struct in_device *idev;
36848 +       unsigned long i;
36849 +       int ret;
36850 +       int mode = full_mode & (GR_BIND | GR_CONNECT);
36851 +       __u32 ip_addr = 0;
36852 +       __u32 our_addr;
36853 +       __u32 our_netmask;
36854 +       char *p;
36855 +       __u16 ip_port = 0;
36856 +       const struct cred *cred = current_cred();
36857 +
36858 +       if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
36859 +               return 0;
36860 +
36861 +       curr = current->acl;
36862 +       isk = inet_sk(sk);
36863 +
36864 +       /* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
36865 +       if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
36866 +               addr->sin_addr.s_addr = curr->inaddr_any_override;
36867 +       if ((full_mode & GR_CONNECT) && isk->inet_saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
36868 +               struct sockaddr_in saddr;
36869 +               int err;
36870 +
36871 +               saddr.sin_family = AF_INET;
36872 +               saddr.sin_addr.s_addr = curr->inaddr_any_override;
36873 +               saddr.sin_port = isk->inet_sport;
36874 +
36875 +               err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
36876 +               if (err)
36877 +                       return err;
36878 +
36879 +               err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
36880 +               if (err)
36881 +                       return err;
36882 +       }
36883 +
36884 +       if (!curr->ips)
36885 +               return 0;
36886 +
36887 +       ip_addr = addr->sin_addr.s_addr;
36888 +       ip_port = ntohs(addr->sin_port);
36889 +
36890 +       if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
36891 +               security_learn(GR_IP_LEARN_MSG, current->role->rolename,
36892 +                              current->role->roletype, cred->uid,
36893 +                              cred->gid, current->exec_file ?
36894 +                              gr_to_filename(current->exec_file->f_path.dentry,
36895 +                              current->exec_file->f_path.mnt) :
36896 +                              curr->filename, curr->filename,
36897 +                              &ip_addr, ip_port, type,
36898 +                              sk->sk_protocol, mode, &current->signal->curr_ip);
36899 +               return 0;
36900 +       }
36901 +
36902 +       for (i = 0; i < curr->ip_num; i++) {
36903 +               ip = *(curr->ips + i);
36904 +               if (ip->iface != NULL) {
36905 +                       strncpy(iface, ip->iface, IFNAMSIZ - 1);
36906 +                       p = strchr(iface, ':');
36907 +                       if (p != NULL)
36908 +                               *p = '\0';
36909 +                       dev = dev_get_by_name(sock_net(sk), iface);
36910 +                       if (dev == NULL)
36911 +                               continue;
36912 +                       idev = in_dev_get(dev);
36913 +                       if (idev == NULL) {
36914 +                               dev_put(dev);
36915 +                               continue;
36916 +                       }
36917 +                       rcu_read_lock();
36918 +                       for_ifa(idev) {
36919 +                               if (!strcmp(ip->iface, ifa->ifa_label)) {
36920 +                                       our_addr = ifa->ifa_address;
36921 +                                       our_netmask = 0xffffffff;
36922 +                                       ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
36923 +                                       if (ret == 1) {
36924 +                                               rcu_read_unlock();
36925 +                                               in_dev_put(idev);
36926 +                                               dev_put(dev);
36927 +                                               return 0;
36928 +                                       } else if (ret == 2) {
36929 +                                               rcu_read_unlock();
36930 +                                               in_dev_put(idev);
36931 +                                               dev_put(dev);
36932 +                                               goto denied;
36933 +                                       }
36934 +                               }
36935 +                       } endfor_ifa(idev);
36936 +                       rcu_read_unlock();
36937 +                       in_dev_put(idev);
36938 +                       dev_put(dev);
36939 +               } else {
36940 +                       our_addr = ip->addr;
36941 +                       our_netmask = ip->netmask;
36942 +                       ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
36943 +                       if (ret == 1)
36944 +                               return 0;
36945 +                       else if (ret == 2)
36946 +                               goto denied;
36947 +               }
36948 +       }
36949 +
36950 +denied:
36951 +       if (mode == GR_BIND)
36952 +               gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
36953 +       else if (mode == GR_CONNECT)
36954 +               gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
36955 +
36956 +       return -EACCES;
36957 +}
36958 +
36959 +int
36960 +gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
36961 +{
36962 +       return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
36963 +}
36964 +
36965 +int
36966 +gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
36967 +{
36968 +       return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
36969 +}
36970 +
36971 +int gr_search_listen(struct socket *sock)
36972 +{
36973 +       struct sock *sk = sock->sk;
36974 +       struct sockaddr_in addr;
36975 +
36976 +       addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
36977 +       addr.sin_port = inet_sk(sk)->inet_sport;
36978 +
36979 +       return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
36980 +}
36981 +
36982 +int gr_search_accept(struct socket *sock)
36983 +{
36984 +       struct sock *sk = sock->sk;
36985 +       struct sockaddr_in addr;
36986 +
36987 +       addr.sin_addr.s_addr = inet_sk(sk)->inet_saddr;
36988 +       addr.sin_port = inet_sk(sk)->inet_sport;
36989 +
36990 +       return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
36991 +}
36992 +
36993 +int
36994 +gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
36995 +{
36996 +       if (addr)
36997 +               return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
36998 +       else {
36999 +               struct sockaddr_in sin;
37000 +               const struct inet_sock *inet = inet_sk(sk);
37001 +
37002 +               sin.sin_addr.s_addr = inet->inet_daddr;
37003 +               sin.sin_port = inet->inet_dport;
37004 +
37005 +               return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
37006 +       }
37007 +}
37008 +
37009 +int
37010 +gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
37011 +{
37012 +       struct sockaddr_in sin;
37013 +
37014 +       if (unlikely(skb->len < sizeof (struct udphdr)))
37015 +               return 0;       // skip this packet
37016 +
37017 +       sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
37018 +       sin.sin_port = udp_hdr(skb)->source;
37019 +
37020 +       return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
37021 +}
37022 diff -urNp linux-2.6.33/grsecurity/gracl_learn.c linux-2.6.33/grsecurity/gracl_learn.c
37023 --- linux-2.6.33/grsecurity/gracl_learn.c       1969-12-31 19:00:00.000000000 -0500
37024 +++ linux-2.6.33/grsecurity/gracl_learn.c       2010-03-07 12:23:36.105670657 -0500
37025 @@ -0,0 +1,211 @@
37026 +#include <linux/kernel.h>
37027 +#include <linux/mm.h>
37028 +#include <linux/sched.h>
37029 +#include <linux/poll.h>
37030 +#include <linux/smp_lock.h>
37031 +#include <linux/string.h>
37032 +#include <linux/file.h>
37033 +#include <linux/types.h>
37034 +#include <linux/vmalloc.h>
37035 +#include <linux/grinternal.h>
37036 +
37037 +extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
37038 +                                  size_t count, loff_t *ppos);
37039 +extern int gr_acl_is_enabled(void);
37040 +
37041 +static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
37042 +static int gr_learn_attached;
37043 +
37044 +/* use a 512k buffer */
37045 +#define LEARN_BUFFER_SIZE (512 * 1024)
37046 +
37047 +static DEFINE_SPINLOCK(gr_learn_lock);
37048 +static DECLARE_MUTEX(gr_learn_user_sem);
37049 +
37050 +/* we need to maintain two buffers, so that the kernel context of grlearn
37051 +   uses a semaphore around the userspace copying, and the other kernel contexts
37052 +   use a spinlock when copying into the buffer, since they cannot sleep
37053 +*/
37054 +static char *learn_buffer;
37055 +static char *learn_buffer_user;
37056 +static int learn_buffer_len;
37057 +static int learn_buffer_user_len;
37058 +
37059 +static ssize_t
37060 +read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
37061 +{
37062 +       DECLARE_WAITQUEUE(wait, current);
37063 +       ssize_t retval = 0;
37064 +
37065 +       add_wait_queue(&learn_wait, &wait);
37066 +       set_current_state(TASK_INTERRUPTIBLE);
37067 +       do {
37068 +               down(&gr_learn_user_sem);
37069 +               spin_lock(&gr_learn_lock);
37070 +               if (learn_buffer_len)
37071 +                       break;
37072 +               spin_unlock(&gr_learn_lock);
37073 +               up(&gr_learn_user_sem);
37074 +               if (file->f_flags & O_NONBLOCK) {
37075 +                       retval = -EAGAIN;
37076 +                       goto out;
37077 +               }
37078 +               if (signal_pending(current)) {
37079 +                       retval = -ERESTARTSYS;
37080 +                       goto out;
37081 +               }
37082 +
37083 +               schedule();
37084 +       } while (1);
37085 +
37086 +       memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
37087 +       learn_buffer_user_len = learn_buffer_len;
37088 +       retval = learn_buffer_len;
37089 +       learn_buffer_len = 0;
37090 +
37091 +       spin_unlock(&gr_learn_lock);
37092 +
37093 +       if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
37094 +               retval = -EFAULT;
37095 +
37096 +       up(&gr_learn_user_sem);
37097 +out:
37098 +       set_current_state(TASK_RUNNING);
37099 +       remove_wait_queue(&learn_wait, &wait);
37100 +       return retval;
37101 +}
37102 +
37103 +static unsigned int
37104 +poll_learn(struct file * file, poll_table * wait)
37105 +{
37106 +       poll_wait(file, &learn_wait, wait);
37107 +
37108 +       if (learn_buffer_len)
37109 +               return (POLLIN | POLLRDNORM);
37110 +
37111 +       return 0;
37112 +}
37113 +
37114 +void
37115 +gr_clear_learn_entries(void)
37116 +{
37117 +       char *tmp;
37118 +
37119 +       down(&gr_learn_user_sem);
37120 +       if (learn_buffer != NULL) {
37121 +               spin_lock(&gr_learn_lock);
37122 +               tmp = learn_buffer;
37123 +               learn_buffer = NULL;
37124 +               spin_unlock(&gr_learn_lock);
37125 +               vfree(learn_buffer);
37126 +       }
37127 +       if (learn_buffer_user != NULL) {
37128 +               vfree(learn_buffer_user);
37129 +               learn_buffer_user = NULL;
37130 +       }
37131 +       learn_buffer_len = 0;
37132 +       up(&gr_learn_user_sem);
37133 +
37134 +       return;
37135 +}
37136 +
37137 +void
37138 +gr_add_learn_entry(const char *fmt, ...)
37139 +{
37140 +       va_list args;
37141 +       unsigned int len;
37142 +
37143 +       if (!gr_learn_attached)
37144 +               return;
37145 +
37146 +       spin_lock(&gr_learn_lock);
37147 +
37148 +       /* leave a gap at the end so we know when it's "full" but don't have to
37149 +          compute the exact length of the string we're trying to append
37150 +       */
37151 +       if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
37152 +               spin_unlock(&gr_learn_lock);
37153 +               wake_up_interruptible(&learn_wait);
37154 +               return;
37155 +       }
37156 +       if (learn_buffer == NULL) {
37157 +               spin_unlock(&gr_learn_lock);
37158 +               return;
37159 +       }
37160 +
37161 +       va_start(args, fmt);
37162 +       len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
37163 +       va_end(args);
37164 +
37165 +       learn_buffer_len += len + 1;
37166 +
37167 +       spin_unlock(&gr_learn_lock);
37168 +       wake_up_interruptible(&learn_wait);
37169 +
37170 +       return;
37171 +}
37172 +
37173 +static int
37174 +open_learn(struct inode *inode, struct file *file)
37175 +{
37176 +       if (file->f_mode & FMODE_READ && gr_learn_attached)
37177 +               return -EBUSY;
37178 +       if (file->f_mode & FMODE_READ) {
37179 +               int retval = 0;
37180 +               down(&gr_learn_user_sem);
37181 +               if (learn_buffer == NULL)
37182 +                       learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
37183 +               if (learn_buffer_user == NULL)
37184 +                       learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
37185 +               if (learn_buffer == NULL) {
37186 +                       retval = -ENOMEM;
37187 +                       goto out_error;
37188 +               }
37189 +               if (learn_buffer_user == NULL) {
37190 +                       retval = -ENOMEM;
37191 +                       goto out_error;
37192 +               }
37193 +               learn_buffer_len = 0;
37194 +               learn_buffer_user_len = 0;
37195 +               gr_learn_attached = 1;
37196 +out_error:
37197 +               up(&gr_learn_user_sem);
37198 +               return retval;
37199 +       }
37200 +       return 0;
37201 +}
37202 +
37203 +static int
37204 +close_learn(struct inode *inode, struct file *file)
37205 +{
37206 +       char *tmp;
37207 +
37208 +       if (file->f_mode & FMODE_READ) {
37209 +               down(&gr_learn_user_sem);
37210 +               if (learn_buffer != NULL) {
37211 +                       spin_lock(&gr_learn_lock);
37212 +                       tmp = learn_buffer;
37213 +                       learn_buffer = NULL;
37214 +                       spin_unlock(&gr_learn_lock);
37215 +                       vfree(tmp);
37216 +               }
37217 +               if (learn_buffer_user != NULL) {
37218 +                       vfree(learn_buffer_user);
37219 +                       learn_buffer_user = NULL;
37220 +               }
37221 +               learn_buffer_len = 0;
37222 +               learn_buffer_user_len = 0;
37223 +               gr_learn_attached = 0;
37224 +               up(&gr_learn_user_sem);
37225 +       }
37226 +
37227 +       return 0;
37228 +}
37229 +
37230 +const struct file_operations grsec_fops = {
37231 +       .read           = read_learn,
37232 +       .write          = write_grsec_handler,
37233 +       .open           = open_learn,
37234 +       .release        = close_learn,
37235 +       .poll           = poll_learn,
37236 +};
37237 diff -urNp linux-2.6.33/grsecurity/gracl_res.c linux-2.6.33/grsecurity/gracl_res.c
37238 --- linux-2.6.33/grsecurity/gracl_res.c 1969-12-31 19:00:00.000000000 -0500
37239 +++ linux-2.6.33/grsecurity/gracl_res.c 2010-03-07 12:23:36.109671795 -0500
37240 @@ -0,0 +1,65 @@
37241 +#include <linux/kernel.h>
37242 +#include <linux/sched.h>
37243 +#include <linux/gracl.h>
37244 +#include <linux/grinternal.h>
37245 +
37246 +static const char *restab_log[] = {
37247 +       [RLIMIT_CPU] = "RLIMIT_CPU",
37248 +       [RLIMIT_FSIZE] = "RLIMIT_FSIZE",
37249 +       [RLIMIT_DATA] = "RLIMIT_DATA",
37250 +       [RLIMIT_STACK] = "RLIMIT_STACK",
37251 +       [RLIMIT_CORE] = "RLIMIT_CORE",
37252 +       [RLIMIT_RSS] = "RLIMIT_RSS",
37253 +       [RLIMIT_NPROC] = "RLIMIT_NPROC",
37254 +       [RLIMIT_NOFILE] = "RLIMIT_NOFILE",
37255 +       [RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
37256 +       [RLIMIT_AS] = "RLIMIT_AS",
37257 +       [RLIMIT_LOCKS] = "RLIMIT_LOCKS",
37258 +       [RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
37259 +       [RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
37260 +       [RLIMIT_NICE] = "RLIMIT_NICE",
37261 +       [RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
37262 +       [RLIMIT_RTTIME] = "RLIMIT_RTTIME",
37263 +       [GR_CRASH_RES] = "RLIMIT_CRASH"
37264 +};
37265 +
37266 +void
37267 +gr_log_resource(const struct task_struct *task,
37268 +               const int res, const unsigned long wanted, const int gt)
37269 +{
37270 +       const struct cred *cred;
37271 +
37272 +       if (!gr_acl_is_enabled() && !grsec_resource_logging)
37273 +               return;
37274 +
37275 +       // not yet supported resource
37276 +       if (!restab_log[res])
37277 +               return;
37278 +
37279 +       rcu_read_lock();
37280 +       cred = __task_cred(task);
37281 +
37282 +       if (res == RLIMIT_NPROC &&
37283 +           (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) ||
37284 +            cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
37285 +               goto out_rcu_unlock;
37286 +       else if (res == RLIMIT_MEMLOCK &&
37287 +                cap_raised(cred->cap_effective, CAP_IPC_LOCK))
37288 +               goto out_rcu_unlock;
37289 +       else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
37290 +               goto out_rcu_unlock;
37291 +       rcu_read_unlock();
37292 +
37293 +       preempt_disable();
37294 +
37295 +       if (unlikely(((gt && wanted > task->signal->rlim[res].rlim_cur) ||
37296 +                     (!gt && wanted >= task->signal->rlim[res].rlim_cur)) &&
37297 +                    task->signal->rlim[res].rlim_cur != RLIM_INFINITY))
37298 +               gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], task->signal->rlim[res].rlim_cur);
37299 +       preempt_enable_no_resched();
37300 +
37301 +       return;
37302 +out_rcu_unlock:
37303 +       rcu_read_unlock();
37304 +       return;
37305 +}
37306 diff -urNp linux-2.6.33/grsecurity/gracl_segv.c linux-2.6.33/grsecurity/gracl_segv.c
37307 --- linux-2.6.33/grsecurity/gracl_segv.c        1969-12-31 19:00:00.000000000 -0500
37308 +++ linux-2.6.33/grsecurity/gracl_segv.c        2010-03-07 12:23:36.109671795 -0500
37309 @@ -0,0 +1,310 @@
37310 +#include <linux/kernel.h>
37311 +#include <linux/mm.h>
37312 +#include <asm/uaccess.h>
37313 +#include <asm/errno.h>
37314 +#include <asm/mman.h>
37315 +#include <net/sock.h>
37316 +#include <linux/file.h>
37317 +#include <linux/fs.h>
37318 +#include <linux/net.h>
37319 +#include <linux/in.h>
37320 +#include <linux/smp_lock.h>
37321 +#include <linux/slab.h>
37322 +#include <linux/types.h>
37323 +#include <linux/sched.h>
37324 +#include <linux/timer.h>
37325 +#include <linux/gracl.h>
37326 +#include <linux/grsecurity.h>
37327 +#include <linux/grinternal.h>
37328 +
37329 +static struct crash_uid *uid_set;
37330 +static unsigned short uid_used;
37331 +static DEFINE_SPINLOCK(gr_uid_lock);
37332 +extern rwlock_t gr_inode_lock;
37333 +extern struct acl_subject_label *
37334 +       lookup_acl_subj_label(const ino_t inode, const dev_t dev,
37335 +                             struct acl_role_label *role);
37336 +extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
37337 +
37338 +int
37339 +gr_init_uidset(void)
37340 +{
37341 +       uid_set =
37342 +           kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
37343 +       uid_used = 0;
37344 +
37345 +       return uid_set ? 1 : 0;
37346 +}
37347 +
37348 +void
37349 +gr_free_uidset(void)
37350 +{
37351 +       if (uid_set)
37352 +               kfree(uid_set);
37353 +
37354 +       return;
37355 +}
37356 +
37357 +int
37358 +gr_find_uid(const uid_t uid)
37359 +{
37360 +       struct crash_uid *tmp = uid_set;
37361 +       uid_t buid;
37362 +       int low = 0, high = uid_used - 1, mid;
37363 +
37364 +       while (high >= low) {
37365 +               mid = (low + high) >> 1;
37366 +               buid = tmp[mid].uid;
37367 +               if (buid == uid)
37368 +                       return mid;
37369 +               if (buid > uid)
37370 +                       high = mid - 1;
37371 +               if (buid < uid)
37372 +                       low = mid + 1;
37373 +       }
37374 +
37375 +       return -1;
37376 +}
37377 +
37378 +static __inline__ void
37379 +gr_insertsort(void)
37380 +{
37381 +       unsigned short i, j;
37382 +       struct crash_uid index;
37383 +
37384 +       for (i = 1; i < uid_used; i++) {
37385 +               index = uid_set[i];
37386 +               j = i;
37387 +               while ((j > 0) && uid_set[j - 1].uid > index.uid) {
37388 +                       uid_set[j] = uid_set[j - 1];
37389 +                       j--;
37390 +               }
37391 +               uid_set[j] = index;
37392 +       }
37393 +
37394 +       return;
37395 +}
37396 +
37397 +static __inline__ void
37398 +gr_insert_uid(const uid_t uid, const unsigned long expires)
37399 +{
37400 +       int loc;
37401 +
37402 +       if (uid_used == GR_UIDTABLE_MAX)
37403 +               return;
37404 +
37405 +       loc = gr_find_uid(uid);
37406 +
37407 +       if (loc >= 0) {
37408 +               uid_set[loc].expires = expires;
37409 +               return;
37410 +       }
37411 +
37412 +       uid_set[uid_used].uid = uid;
37413 +       uid_set[uid_used].expires = expires;
37414 +       uid_used++;
37415 +
37416 +       gr_insertsort();
37417 +
37418 +       return;
37419 +}
37420 +
37421 +void
37422 +gr_remove_uid(const unsigned short loc)
37423 +{
37424 +       unsigned short i;
37425 +
37426 +       for (i = loc + 1; i < uid_used; i++)
37427 +               uid_set[i - 1] = uid_set[i];
37428 +
37429 +       uid_used--;
37430 +
37431 +       return;
37432 +}
37433 +
37434 +int
37435 +gr_check_crash_uid(const uid_t uid)
37436 +{
37437 +       int loc;
37438 +       int ret = 0;
37439 +
37440 +       if (unlikely(!gr_acl_is_enabled()))
37441 +               return 0;
37442 +
37443 +       spin_lock(&gr_uid_lock);
37444 +       loc = gr_find_uid(uid);
37445 +
37446 +       if (loc < 0)
37447 +               goto out_unlock;
37448 +
37449 +       if (time_before_eq(uid_set[loc].expires, get_seconds()))
37450 +               gr_remove_uid(loc);
37451 +       else
37452 +               ret = 1;
37453 +
37454 +out_unlock:
37455 +       spin_unlock(&gr_uid_lock);
37456 +       return ret;
37457 +}
37458 +
37459 +static __inline__ int
37460 +proc_is_setxid(const struct cred *cred)
37461 +{
37462 +       if (cred->uid != cred->euid || cred->uid != cred->suid ||
37463 +           cred->uid != cred->fsuid)
37464 +               return 1;
37465 +       if (cred->gid != cred->egid || cred->gid != cred->sgid ||
37466 +           cred->gid != cred->fsgid)
37467 +               return 1;
37468 +
37469 +       return 0;
37470 +}
37471 +static __inline__ int
37472 +gr_fake_force_sig(int sig, struct task_struct *t)
37473 +{
37474 +       unsigned long int flags;
37475 +       int ret, blocked, ignored;
37476 +       struct k_sigaction *action;
37477 +
37478 +       spin_lock_irqsave(&t->sighand->siglock, flags);
37479 +       action = &t->sighand->action[sig-1];
37480 +       ignored = action->sa.sa_handler == SIG_IGN;
37481 +       blocked = sigismember(&t->blocked, sig);
37482 +       if (blocked || ignored) {
37483 +               action->sa.sa_handler = SIG_DFL;
37484 +               if (blocked) {
37485 +                       sigdelset(&t->blocked, sig);
37486 +                       recalc_sigpending_and_wake(t);
37487 +               }
37488 +       }
37489 +       if (action->sa.sa_handler == SIG_DFL)
37490 +               t->signal->flags &= ~SIGNAL_UNKILLABLE;
37491 +       ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
37492 +
37493 +       spin_unlock_irqrestore(&t->sighand->siglock, flags);
37494 +
37495 +       return ret;
37496 +}
37497 +
37498 +void
37499 +gr_handle_crash(struct task_struct *task, const int sig)
37500 +{
37501 +       struct acl_subject_label *curr;
37502 +       struct acl_subject_label *curr2;
37503 +       struct task_struct *tsk, *tsk2;
37504 +       const struct cred *cred;
37505 +       const struct cred *cred2;
37506 +
37507 +       if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
37508 +               return;
37509 +
37510 +       if (unlikely(!gr_acl_is_enabled()))
37511 +               return;
37512 +
37513 +       curr = task->acl;
37514 +
37515 +       if (!(curr->resmask & (1 << GR_CRASH_RES)))
37516 +               return;
37517 +
37518 +       if (time_before_eq(curr->expires, get_seconds())) {
37519 +               curr->expires = 0;
37520 +               curr->crashes = 0;
37521 +       }
37522 +
37523 +       curr->crashes++;
37524 +
37525 +       if (!curr->expires)
37526 +               curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
37527 +
37528 +       if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
37529 +           time_after(curr->expires, get_seconds())) {
37530 +               rcu_read_lock();
37531 +               cred = __task_cred(task);
37532 +               if (cred->uid && proc_is_setxid(cred)) {
37533 +                       gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
37534 +                       spin_lock(&gr_uid_lock);
37535 +                       gr_insert_uid(cred->uid, curr->expires);
37536 +                       spin_unlock(&gr_uid_lock);
37537 +                       curr->expires = 0;
37538 +                       curr->crashes = 0;
37539 +                       read_lock(&tasklist_lock);
37540 +                       do_each_thread(tsk2, tsk) {
37541 +                               cred2 = __task_cred(tsk);
37542 +                               if (tsk != task && cred2->uid == cred->uid)
37543 +                                       gr_fake_force_sig(SIGKILL, tsk);
37544 +                       } while_each_thread(tsk2, tsk);
37545 +                       read_unlock(&tasklist_lock);
37546 +               } else {
37547 +                       gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
37548 +                       read_lock(&tasklist_lock);
37549 +                       do_each_thread(tsk2, tsk) {
37550 +                               if (likely(tsk != task)) {
37551 +                                       curr2 = tsk->acl;
37552 +
37553 +                                       if (curr2->device == curr->device &&
37554 +                                           curr2->inode == curr->inode)
37555 +                                               gr_fake_force_sig(SIGKILL, tsk);
37556 +                               }
37557 +                       } while_each_thread(tsk2, tsk);
37558 +                       read_unlock(&tasklist_lock);
37559 +               }
37560 +               rcu_read_unlock();
37561 +       }
37562 +
37563 +       return;
37564 +}
37565 +
37566 +int
37567 +gr_check_crash_exec(const struct file *filp)
37568 +{
37569 +       struct acl_subject_label *curr;
37570 +
37571 +       if (unlikely(!gr_acl_is_enabled()))
37572 +               return 0;
37573 +
37574 +       read_lock(&gr_inode_lock);
37575 +       curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
37576 +                                    filp->f_path.dentry->d_inode->i_sb->s_dev,
37577 +                                    current->role);
37578 +       read_unlock(&gr_inode_lock);
37579 +
37580 +       if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
37581 +           (!curr->crashes && !curr->expires))
37582 +               return 0;
37583 +
37584 +       if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
37585 +           time_after(curr->expires, get_seconds()))
37586 +               return 1;
37587 +       else if (time_before_eq(curr->expires, get_seconds())) {
37588 +               curr->crashes = 0;
37589 +               curr->expires = 0;
37590 +       }
37591 +
37592 +       return 0;
37593 +}
37594 +
37595 +void
37596 +gr_handle_alertkill(struct task_struct *task)
37597 +{
37598 +       struct acl_subject_label *curracl;
37599 +       __u32 curr_ip;
37600 +       struct task_struct *p, *p2;
37601 +
37602 +       if (unlikely(!gr_acl_is_enabled()))
37603 +               return;
37604 +
37605 +       curracl = task->acl;
37606 +       curr_ip = task->signal->curr_ip;
37607 +
37608 +       if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
37609 +               read_lock(&tasklist_lock);
37610 +               do_each_thread(p2, p) {
37611 +                       if (p->signal->curr_ip == curr_ip)
37612 +                               gr_fake_force_sig(SIGKILL, p);
37613 +               } while_each_thread(p2, p);
37614 +               read_unlock(&tasklist_lock);
37615 +       } else if (curracl->mode & GR_KILLPROC)
37616 +               gr_fake_force_sig(SIGKILL, task);
37617 +
37618 +       return;
37619 +}
37620 diff -urNp linux-2.6.33/grsecurity/gracl_shm.c linux-2.6.33/grsecurity/gracl_shm.c
37621 --- linux-2.6.33/grsecurity/gracl_shm.c 1969-12-31 19:00:00.000000000 -0500
37622 +++ linux-2.6.33/grsecurity/gracl_shm.c 2010-03-07 12:23:36.109671795 -0500
37623 @@ -0,0 +1,37 @@
37624 +#include <linux/kernel.h>
37625 +#include <linux/mm.h>
37626 +#include <linux/sched.h>
37627 +#include <linux/file.h>
37628 +#include <linux/ipc.h>
37629 +#include <linux/gracl.h>
37630 +#include <linux/grsecurity.h>
37631 +#include <linux/grinternal.h>
37632 +
37633 +int
37634 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
37635 +               const time_t shm_createtime, const uid_t cuid, const int shmid)
37636 +{
37637 +       struct task_struct *task;
37638 +
37639 +       if (!gr_acl_is_enabled())
37640 +               return 1;
37641 +
37642 +       read_lock(&tasklist_lock);
37643 +
37644 +       task = find_task_by_vpid(shm_cprid);
37645 +
37646 +       if (unlikely(!task))
37647 +               task = find_task_by_vpid(shm_lapid);
37648 +
37649 +       if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
37650 +                             (task->pid == shm_lapid)) &&
37651 +                    (task->acl->mode & GR_PROTSHM) &&
37652 +                    (task->acl != current->acl))) {
37653 +               read_unlock(&tasklist_lock);
37654 +               gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
37655 +               return 0;
37656 +       }
37657 +       read_unlock(&tasklist_lock);
37658 +
37659 +       return 1;
37660 +}
37661 diff -urNp linux-2.6.33/grsecurity/grsec_chdir.c linux-2.6.33/grsecurity/grsec_chdir.c
37662 --- linux-2.6.33/grsecurity/grsec_chdir.c       1969-12-31 19:00:00.000000000 -0500
37663 +++ linux-2.6.33/grsecurity/grsec_chdir.c       2010-03-07 12:23:36.109671795 -0500
37664 @@ -0,0 +1,19 @@
37665 +#include <linux/kernel.h>
37666 +#include <linux/sched.h>
37667 +#include <linux/fs.h>
37668 +#include <linux/file.h>
37669 +#include <linux/grsecurity.h>
37670 +#include <linux/grinternal.h>
37671 +
37672 +void
37673 +gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
37674 +{
37675 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
37676 +       if ((grsec_enable_chdir && grsec_enable_group &&
37677 +            in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
37678 +                                             !grsec_enable_group)) {
37679 +               gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
37680 +       }
37681 +#endif
37682 +       return;
37683 +}
37684 diff -urNp linux-2.6.33/grsecurity/grsec_chroot.c linux-2.6.33/grsecurity/grsec_chroot.c
37685 --- linux-2.6.33/grsecurity/grsec_chroot.c      1969-12-31 19:00:00.000000000 -0500
37686 +++ linux-2.6.33/grsecurity/grsec_chroot.c      2010-03-07 12:23:36.109671795 -0500
37687 @@ -0,0 +1,348 @@
37688 +#include <linux/kernel.h>
37689 +#include <linux/module.h>
37690 +#include <linux/sched.h>
37691 +#include <linux/file.h>
37692 +#include <linux/fs.h>
37693 +#include <linux/mount.h>
37694 +#include <linux/types.h>
37695 +#include <linux/pid_namespace.h>
37696 +#include <linux/grsecurity.h>
37697 +#include <linux/grinternal.h>
37698 +
37699 +int
37700 +gr_handle_chroot_unix(const pid_t pid)
37701 +{
37702 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
37703 +       struct pid *spid = NULL;
37704 +
37705 +       if (unlikely(!grsec_enable_chroot_unix))
37706 +               return 1;
37707 +
37708 +       if (likely(!proc_is_chrooted(current)))
37709 +               return 1;
37710 +
37711 +       read_lock(&tasklist_lock);
37712 +
37713 +       spid = find_vpid(pid);
37714 +       if (spid) {
37715 +               struct task_struct *p;
37716 +               p = pid_task(spid, PIDTYPE_PID);
37717 +               gr_fs_read_lock(p);
37718 +               if (unlikely(!have_same_root(current, p))) {
37719 +                       gr_fs_read_unlock(p);
37720 +                       read_unlock(&tasklist_lock);
37721 +                       gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
37722 +                       return 0;
37723 +               }
37724 +               gr_fs_read_unlock(p);
37725 +       }
37726 +       read_unlock(&tasklist_lock);
37727 +#endif
37728 +       return 1;
37729 +}
37730 +
37731 +int
37732 +gr_handle_chroot_nice(void)
37733 +{
37734 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
37735 +       if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
37736 +               gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
37737 +               return -EPERM;
37738 +       }
37739 +#endif
37740 +       return 0;
37741 +}
37742 +
37743 +int
37744 +gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
37745 +{
37746 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
37747 +       if (grsec_enable_chroot_nice && (niceval < task_nice(p))
37748 +                       && proc_is_chrooted(current)) {
37749 +               gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
37750 +               return -EACCES;
37751 +       }
37752 +#endif
37753 +       return 0;
37754 +}
37755 +
37756 +int
37757 +gr_handle_chroot_rawio(const struct inode *inode)
37758 +{
37759 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
37760 +       if (grsec_enable_chroot_caps && proc_is_chrooted(current) &&
37761 +           inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
37762 +               return 1;
37763 +#endif
37764 +       return 0;
37765 +}
37766 +
37767 +int
37768 +gr_pid_is_chrooted(struct task_struct *p)
37769 +{
37770 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
37771 +       if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
37772 +               return 0;
37773 +
37774 +       gr_fs_read_lock(p);
37775 +       if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
37776 +           !have_same_root(current, p)) {
37777 +               gr_fs_read_unlock(p);
37778 +               return 1;
37779 +       }
37780 +       gr_fs_read_unlock(p);
37781 +#endif
37782 +       return 0;
37783 +}
37784 +
37785 +EXPORT_SYMBOL(gr_pid_is_chrooted);
37786 +
37787 +#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
37788 +int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
37789 +{
37790 +       struct dentry *dentry = (struct dentry *)u_dentry;
37791 +       struct vfsmount *mnt = (struct vfsmount *)u_mnt;
37792 +       struct dentry *realroot;
37793 +       struct vfsmount *realrootmnt;
37794 +       struct dentry *currentroot;
37795 +       struct vfsmount *currentmnt;
37796 +       struct task_struct *reaper = &init_task;
37797 +       int ret = 1;
37798 +
37799 +       read_lock(&reaper->fs->lock);
37800 +       realrootmnt = mntget(reaper->fs->root.mnt);
37801 +       realroot = dget(reaper->fs->root.dentry);
37802 +       read_unlock(&reaper->fs->lock);
37803 +
37804 +       read_lock(&current->fs->lock);
37805 +       currentmnt = mntget(current->fs->root.mnt);
37806 +       currentroot = dget(current->fs->root.dentry);
37807 +       read_unlock(&current->fs->lock);
37808 +
37809 +       spin_lock(&dcache_lock);
37810 +       for (;;) {
37811 +               if (unlikely((dentry == realroot && mnt == realrootmnt)
37812 +                    || (dentry == currentroot && mnt == currentmnt)))
37813 +                       break;
37814 +               if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
37815 +                       if (mnt->mnt_parent == mnt)
37816 +                               break;
37817 +                       dentry = mnt->mnt_mountpoint;
37818 +                       mnt = mnt->mnt_parent;
37819 +                       continue;
37820 +               }
37821 +               dentry = dentry->d_parent;
37822 +       }
37823 +       spin_unlock(&dcache_lock);
37824 +
37825 +       dput(currentroot);
37826 +       mntput(currentmnt);
37827 +
37828 +       /* access is outside of chroot */
37829 +       if (dentry == realroot && mnt == realrootmnt)
37830 +               ret = 0;
37831 +
37832 +       dput(realroot);
37833 +       mntput(realrootmnt);
37834 +       return ret;
37835 +}
37836 +#endif
37837 +
37838 +int
37839 +gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
37840 +{
37841 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
37842 +       if (!grsec_enable_chroot_fchdir)
37843 +               return 1;
37844 +
37845 +       if (!proc_is_chrooted(current))
37846 +               return 1;
37847 +       else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
37848 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
37849 +               return 0;
37850 +       }
37851 +#endif
37852 +       return 1;
37853 +}
37854 +
37855 +int
37856 +gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
37857 +               const time_t shm_createtime)
37858 +{
37859 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
37860 +       struct pid *pid = NULL;
37861 +       time_t starttime;
37862 +
37863 +       if (unlikely(!grsec_enable_chroot_shmat))
37864 +               return 1;
37865 +
37866 +       if (likely(!proc_is_chrooted(current)))
37867 +               return 1;
37868 +
37869 +       read_lock(&tasklist_lock);
37870 +
37871 +       pid = find_vpid(shm_cprid);
37872 +       if (pid) {
37873 +               struct task_struct *p;
37874 +               p = pid_task(pid, PIDTYPE_PID);
37875 +               gr_fs_read_lock(p);
37876 +               starttime = p->start_time.tv_sec;
37877 +               if (unlikely(!have_same_root(current, p) &&
37878 +                            time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
37879 +                       gr_fs_read_unlock(p);
37880 +                       read_unlock(&tasklist_lock);
37881 +                       gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
37882 +                       return 0;
37883 +               }
37884 +               gr_fs_read_unlock(p);
37885 +       } else {
37886 +               pid = find_vpid(shm_lapid);
37887 +               if (pid) {
37888 +                       struct task_struct *p;
37889 +                       p = pid_task(pid, PIDTYPE_PID);
37890 +                       gr_fs_read_lock(p);
37891 +                       if (unlikely(!have_same_root(current, p))) {
37892 +                               gr_fs_read_unlock(p);
37893 +                               read_unlock(&tasklist_lock);
37894 +                               gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
37895 +                               return 0;
37896 +                       }
37897 +                       gr_fs_read_unlock(p);
37898 +               }
37899 +       }
37900 +
37901 +       read_unlock(&tasklist_lock);
37902 +#endif
37903 +       return 1;
37904 +}
37905 +
37906 +void
37907 +gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
37908 +{
37909 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
37910 +       if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
37911 +               gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
37912 +#endif
37913 +       return;
37914 +}
37915 +
37916 +int
37917 +gr_handle_chroot_mknod(const struct dentry *dentry,
37918 +                      const struct vfsmount *mnt, const int mode)
37919 +{
37920 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
37921 +       if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) &&
37922 +           proc_is_chrooted(current)) {
37923 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
37924 +               return -EPERM;
37925 +       }
37926 +#endif
37927 +       return 0;
37928 +}
37929 +
37930 +int
37931 +gr_handle_chroot_mount(const struct dentry *dentry,
37932 +                      const struct vfsmount *mnt, const char *dev_name)
37933 +{
37934 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
37935 +       if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
37936 +               gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name, dentry, mnt);
37937 +               return -EPERM;
37938 +       }
37939 +#endif
37940 +       return 0;
37941 +}
37942 +
37943 +int
37944 +gr_handle_chroot_pivot(void)
37945 +{
37946 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
37947 +       if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
37948 +               gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
37949 +               return -EPERM;
37950 +       }
37951 +#endif
37952 +       return 0;
37953 +}
37954 +
37955 +int
37956 +gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
37957 +{
37958 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
37959 +       if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
37960 +           !gr_is_outside_chroot(dentry, mnt)) {
37961 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
37962 +               return -EPERM;
37963 +       }
37964 +#endif
37965 +       return 0;
37966 +}
37967 +
37968 +int
37969 +gr_handle_chroot_caps(struct path *path)
37970 +{
37971 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
37972 +       if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
37973 +               (init_task.fs->root.dentry != path->dentry) &&
37974 +               (current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
37975 +
37976 +               kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
37977 +               const struct cred *old = current_cred();
37978 +               struct cred *new = prepare_creds();
37979 +               if (new == NULL)
37980 +                       return 1;
37981 +
37982 +               new->cap_permitted = cap_drop(old->cap_permitted,
37983 +                                             chroot_caps);
37984 +               new->cap_inheritable = cap_drop(old->cap_inheritable,
37985 +                                               chroot_caps);
37986 +               new->cap_effective = cap_drop(old->cap_effective,
37987 +                                             chroot_caps);
37988 +
37989 +               commit_creds(new);
37990 +
37991 +               return 0;
37992 +       }
37993 +#endif
37994 +       return 0;
37995 +}
37996 +
37997 +int
37998 +gr_handle_chroot_sysctl(const int op)
37999 +{
38000 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
38001 +       if (grsec_enable_chroot_sysctl && (op & MAY_WRITE) &&
38002 +           proc_is_chrooted(current))
38003 +               return -EACCES;
38004 +#endif
38005 +       return 0;
38006 +}
38007 +
38008 +void
38009 +gr_handle_chroot_chdir(struct path *path)
38010 +{
38011 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
38012 +       if (grsec_enable_chroot_chdir)
38013 +               set_fs_pwd(current->fs, path);
38014 +#endif
38015 +       return;
38016 +}
38017 +
38018 +int
38019 +gr_handle_chroot_chmod(const struct dentry *dentry,
38020 +                      const struct vfsmount *mnt, const int mode)
38021 +{
38022 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
38023 +       if (grsec_enable_chroot_chmod &&
38024 +           ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
38025 +           proc_is_chrooted(current)) {
38026 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
38027 +               return -EPERM;
38028 +       }
38029 +#endif
38030 +       return 0;
38031 +}
38032 +
38033 +#ifdef CONFIG_SECURITY
38034 +EXPORT_SYMBOL(gr_handle_chroot_caps);
38035 +#endif
38036 diff -urNp linux-2.6.33/grsecurity/grsec_disabled.c linux-2.6.33/grsecurity/grsec_disabled.c
38037 --- linux-2.6.33/grsecurity/grsec_disabled.c    1969-12-31 19:00:00.000000000 -0500
38038 +++ linux-2.6.33/grsecurity/grsec_disabled.c    2010-03-07 12:23:36.109671795 -0500
38039 @@ -0,0 +1,426 @@
38040 +#include <linux/kernel.h>
38041 +#include <linux/module.h>
38042 +#include <linux/sched.h>
38043 +#include <linux/file.h>
38044 +#include <linux/fs.h>
38045 +#include <linux/kdev_t.h>
38046 +#include <linux/net.h>
38047 +#include <linux/in.h>
38048 +#include <linux/ip.h>
38049 +#include <linux/skbuff.h>
38050 +#include <linux/sysctl.h>
38051 +
38052 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
38053 +void
38054 +pax_set_initial_flags(struct linux_binprm *bprm)
38055 +{
38056 +       return;
38057 +}
38058 +#endif
38059 +
38060 +#ifdef CONFIG_SYSCTL
38061 +__u32
38062 +gr_handle_sysctl(const struct ctl_table * table, const int op)
38063 +{
38064 +       return 0;
38065 +}
38066 +#endif
38067 +
38068 +#ifdef CONFIG_TASKSTATS
38069 +int gr_is_taskstats_denied(int pid)
38070 +{
38071 +       return 0;
38072 +}
38073 +#endif
38074 +
38075 +int
38076 +gr_acl_is_enabled(void)
38077 +{
38078 +       return 0;
38079 +}
38080 +
38081 +int
38082 +gr_handle_rawio(const struct inode *inode)
38083 +{
38084 +       return 0;
38085 +}
38086 +
38087 +void
38088 +gr_acl_handle_psacct(struct task_struct *task, const long code)
38089 +{
38090 +       return;
38091 +}
38092 +
38093 +int
38094 +gr_handle_ptrace(struct task_struct *task, const long request)
38095 +{
38096 +       return 0;
38097 +}
38098 +
38099 +int
38100 +gr_handle_proc_ptrace(struct task_struct *task)
38101 +{
38102 +       return 0;
38103 +}
38104 +
38105 +void
38106 +gr_learn_resource(const struct task_struct *task,
38107 +                 const int res, const unsigned long wanted, const int gt)
38108 +{
38109 +       return;
38110 +}
38111 +
38112 +int
38113 +gr_set_acls(const int type)
38114 +{
38115 +       return 0;
38116 +}
38117 +
38118 +int
38119 +gr_check_hidden_task(const struct task_struct *tsk)
38120 +{
38121 +       return 0;
38122 +}
38123 +
38124 +int
38125 +gr_check_protected_task(const struct task_struct *task)
38126 +{
38127 +       return 0;
38128 +}
38129 +
38130 +void
38131 +gr_copy_label(struct task_struct *tsk)
38132 +{
38133 +       return;
38134 +}
38135 +
38136 +void
38137 +gr_set_pax_flags(struct task_struct *task)
38138 +{
38139 +       return;
38140 +}
38141 +
38142 +int
38143 +gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
38144 +                 const int unsafe_share)
38145 +{
38146 +       return 0;
38147 +}
38148 +
38149 +void
38150 +gr_handle_delete(const ino_t ino, const dev_t dev)
38151 +{
38152 +       return;
38153 +}
38154 +
38155 +void
38156 +gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
38157 +{
38158 +       return;
38159 +}
38160 +
38161 +void
38162 +gr_handle_crash(struct task_struct *task, const int sig)
38163 +{
38164 +       return;
38165 +}
38166 +
38167 +int
38168 +gr_check_crash_exec(const struct file *filp)
38169 +{
38170 +       return 0;
38171 +}
38172 +
38173 +int
38174 +gr_check_crash_uid(const uid_t uid)
38175 +{
38176 +       return 0;
38177 +}
38178 +
38179 +void
38180 +gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
38181 +                struct dentry *old_dentry,
38182 +                struct dentry *new_dentry,
38183 +                struct vfsmount *mnt, const __u8 replace)
38184 +{
38185 +       return;
38186 +}
38187 +
38188 +int
38189 +gr_search_socket(const int family, const int type, const int protocol)
38190 +{
38191 +       return 1;
38192 +}
38193 +
38194 +int
38195 +gr_search_connectbind(const int mode, const struct socket *sock,
38196 +                     const struct sockaddr_in *addr)
38197 +{
38198 +       return 0;
38199 +}
38200 +
38201 +int
38202 +gr_is_capable(const int cap)
38203 +{
38204 +       return 1;
38205 +}
38206 +
38207 +int
38208 +gr_is_capable_nolog(const int cap)
38209 +{
38210 +       return 1;
38211 +}
38212 +
38213 +void
38214 +gr_handle_alertkill(struct task_struct *task)
38215 +{
38216 +       return;
38217 +}
38218 +
38219 +__u32
38220 +gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
38221 +{
38222 +       return 1;
38223 +}
38224 +
38225 +__u32
38226 +gr_acl_handle_hidden_file(const struct dentry * dentry,
38227 +                         const struct vfsmount * mnt)
38228 +{
38229 +       return 1;
38230 +}
38231 +
38232 +__u32
38233 +gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
38234 +                  const int fmode)
38235 +{
38236 +       return 1;
38237 +}
38238 +
38239 +__u32
38240 +gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
38241 +{
38242 +       return 1;
38243 +}
38244 +
38245 +__u32
38246 +gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
38247 +{
38248 +       return 1;
38249 +}
38250 +
38251 +int
38252 +gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
38253 +                  unsigned int *vm_flags)
38254 +{
38255 +       return 1;
38256 +}
38257 +
38258 +__u32
38259 +gr_acl_handle_truncate(const struct dentry * dentry,
38260 +                      const struct vfsmount * mnt)
38261 +{
38262 +       return 1;
38263 +}
38264 +
38265 +__u32
38266 +gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
38267 +{
38268 +       return 1;
38269 +}
38270 +
38271 +__u32
38272 +gr_acl_handle_access(const struct dentry * dentry,
38273 +                    const struct vfsmount * mnt, const int fmode)
38274 +{
38275 +       return 1;
38276 +}
38277 +
38278 +__u32
38279 +gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
38280 +                    mode_t mode)
38281 +{
38282 +       return 1;
38283 +}
38284 +
38285 +__u32
38286 +gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
38287 +                   mode_t mode)
38288 +{
38289 +       return 1;
38290 +}
38291 +
38292 +__u32
38293 +gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
38294 +{
38295 +       return 1;
38296 +}
38297 +
38298 +void
38299 +grsecurity_init(void)
38300 +{
38301 +       return;
38302 +}
38303 +
38304 +__u32
38305 +gr_acl_handle_mknod(const struct dentry * new_dentry,
38306 +                   const struct dentry * parent_dentry,
38307 +                   const struct vfsmount * parent_mnt,
38308 +                   const int mode)
38309 +{
38310 +       return 1;
38311 +}
38312 +
38313 +__u32
38314 +gr_acl_handle_mkdir(const struct dentry * new_dentry,
38315 +                   const struct dentry * parent_dentry,
38316 +                   const struct vfsmount * parent_mnt)
38317 +{
38318 +       return 1;
38319 +}
38320 +
38321 +__u32
38322 +gr_acl_handle_symlink(const struct dentry * new_dentry,
38323 +                     const struct dentry * parent_dentry,
38324 +                     const struct vfsmount * parent_mnt, const char *from)
38325 +{
38326 +       return 1;
38327 +}
38328 +
38329 +__u32
38330 +gr_acl_handle_link(const struct dentry * new_dentry,
38331 +                  const struct dentry * parent_dentry,
38332 +                  const struct vfsmount * parent_mnt,
38333 +                  const struct dentry * old_dentry,
38334 +                  const struct vfsmount * old_mnt, const char *to)
38335 +{
38336 +       return 1;
38337 +}
38338 +
38339 +int
38340 +gr_acl_handle_rename(const struct dentry *new_dentry,
38341 +                    const struct dentry *parent_dentry,
38342 +                    const struct vfsmount *parent_mnt,
38343 +                    const struct dentry *old_dentry,
38344 +                    const struct inode *old_parent_inode,
38345 +                    const struct vfsmount *old_mnt, const char *newname)
38346 +{
38347 +       return 0;
38348 +}
38349 +
38350 +int
38351 +gr_acl_handle_filldir(const struct file *file, const char *name,
38352 +                     const int namelen, const ino_t ino)
38353 +{
38354 +       return 1;
38355 +}
38356 +
38357 +int
38358 +gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
38359 +               const time_t shm_createtime, const uid_t cuid, const int shmid)
38360 +{
38361 +       return 1;
38362 +}
38363 +
38364 +int
38365 +gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
38366 +{
38367 +       return 0;
38368 +}
38369 +
38370 +int
38371 +gr_search_accept(const struct socket *sock)
38372 +{
38373 +       return 0;
38374 +}
38375 +
38376 +int
38377 +gr_search_listen(const struct socket *sock)
38378 +{
38379 +       return 0;
38380 +}
38381 +
38382 +int
38383 +gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
38384 +{
38385 +       return 0;
38386 +}
38387 +
38388 +__u32
38389 +gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
38390 +{
38391 +       return 1;
38392 +}
38393 +
38394 +__u32
38395 +gr_acl_handle_creat(const struct dentry * dentry,
38396 +                   const struct dentry * p_dentry,
38397 +                   const struct vfsmount * p_mnt, const int fmode,
38398 +                   const int imode)
38399 +{
38400 +       return 1;
38401 +}
38402 +
38403 +void
38404 +gr_acl_handle_exit(void)
38405 +{
38406 +       return;
38407 +}
38408 +
38409 +int
38410 +gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
38411 +{
38412 +       return 1;
38413 +}
38414 +
38415 +void
38416 +gr_set_role_label(const uid_t uid, const gid_t gid)
38417 +{
38418 +       return;
38419 +}
38420 +
38421 +int
38422 +gr_acl_handle_procpidmem(const struct task_struct *task)
38423 +{
38424 +       return 0;
38425 +}
38426 +
38427 +int
38428 +gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
38429 +{
38430 +       return 0;
38431 +}
38432 +
38433 +int
38434 +gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
38435 +{
38436 +       return 0;
38437 +}
38438 +
38439 +void
38440 +gr_set_kernel_label(struct task_struct *task)
38441 +{
38442 +       return;
38443 +}
38444 +
38445 +int
38446 +gr_check_user_change(int real, int effective, int fs)
38447 +{
38448 +       return 0;
38449 +}
38450 +
38451 +int
38452 +gr_check_group_change(int real, int effective, int fs)
38453 +{
38454 +       return 0;
38455 +}
38456 +
38457 +
38458 +EXPORT_SYMBOL(gr_is_capable);
38459 +EXPORT_SYMBOL(gr_is_capable_nolog);
38460 +EXPORT_SYMBOL(gr_learn_resource);
38461 +EXPORT_SYMBOL(gr_set_kernel_label);
38462 +#ifdef CONFIG_SECURITY
38463 +EXPORT_SYMBOL(gr_check_user_change);
38464 +EXPORT_SYMBOL(gr_check_group_change);
38465 +#endif
38466 diff -urNp linux-2.6.33/grsecurity/grsec_exec.c linux-2.6.33/grsecurity/grsec_exec.c
38467 --- linux-2.6.33/grsecurity/grsec_exec.c        1969-12-31 19:00:00.000000000 -0500
38468 +++ linux-2.6.33/grsecurity/grsec_exec.c        2010-03-07 12:23:36.109671795 -0500
38469 @@ -0,0 +1,89 @@
38470 +#include <linux/kernel.h>
38471 +#include <linux/sched.h>
38472 +#include <linux/file.h>
38473 +#include <linux/binfmts.h>
38474 +#include <linux/smp_lock.h>
38475 +#include <linux/fs.h>
38476 +#include <linux/types.h>
38477 +#include <linux/grdefs.h>
38478 +#include <linux/grinternal.h>
38479 +#include <linux/capability.h>
38480 +
38481 +#include <asm/uaccess.h>
38482 +
38483 +#ifdef CONFIG_GRKERNSEC_EXECLOG
38484 +static char gr_exec_arg_buf[132];
38485 +static DECLARE_MUTEX(gr_exec_arg_sem);
38486 +#endif
38487 +
38488 +int
38489 +gr_handle_nproc(void)
38490 +{
38491 +#ifdef CONFIG_GRKERNSEC_EXECVE
38492 +       const struct cred *cred = current_cred();
38493 +       if (grsec_enable_execve && cred->user &&
38494 +           (atomic_read(&cred->user->processes) >
38495 +            current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
38496 +           !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
38497 +               gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
38498 +               return -EAGAIN;
38499 +       }
38500 +#endif
38501 +       return 0;
38502 +}
38503 +
38504 +void
38505 +gr_handle_exec_args(struct linux_binprm *bprm, const char __user *__user *argv)
38506 +{
38507 +#ifdef CONFIG_GRKERNSEC_EXECLOG
38508 +       char *grarg = gr_exec_arg_buf;
38509 +       unsigned int i, x, execlen = 0;
38510 +       char c;
38511 +
38512 +       if (!((grsec_enable_execlog && grsec_enable_group &&
38513 +              in_group_p(grsec_audit_gid))
38514 +             || (grsec_enable_execlog && !grsec_enable_group)))
38515 +               return;
38516 +
38517 +       down(&gr_exec_arg_sem);
38518 +       memset(grarg, 0, sizeof(gr_exec_arg_buf));
38519 +
38520 +       if (unlikely(argv == NULL))
38521 +               goto log;
38522 +
38523 +       for (i = 0; i < bprm->argc && execlen < 128; i++) {
38524 +               const char __user *p;
38525 +               unsigned int len;
38526 +
38527 +               if (copy_from_user(&p, argv + i, sizeof(p)))
38528 +                       goto log;
38529 +               if (!p)
38530 +                       goto log;
38531 +               len = strnlen_user(p, 128 - execlen);
38532 +               if (len > 128 - execlen)
38533 +                       len = 128 - execlen;
38534 +               else if (len > 0)
38535 +                       len--;
38536 +               if (copy_from_user(grarg + execlen, p, len))
38537 +                       goto log;
38538 +
38539 +               /* rewrite unprintable characters */
38540 +               for (x = 0; x < len; x++) {
38541 +                       c = *(grarg + execlen + x);
38542 +                       if (c < 32 || c > 126)
38543 +                               *(grarg + execlen + x) = ' ';
38544 +               }
38545 +
38546 +               execlen += len;
38547 +               *(grarg + execlen) = ' ';
38548 +               *(grarg + execlen + 1) = '\0';
38549 +               execlen++;
38550 +       }
38551 +
38552 +      log:
38553 +       gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
38554 +                       bprm->file->f_path.mnt, grarg);
38555 +       up(&gr_exec_arg_sem);
38556 +#endif
38557 +       return;
38558 +}
38559 diff -urNp linux-2.6.33/grsecurity/grsec_fifo.c linux-2.6.33/grsecurity/grsec_fifo.c
38560 --- linux-2.6.33/grsecurity/grsec_fifo.c        1969-12-31 19:00:00.000000000 -0500
38561 +++ linux-2.6.33/grsecurity/grsec_fifo.c        2010-03-07 12:23:36.109671795 -0500
38562 @@ -0,0 +1,24 @@
38563 +#include <linux/kernel.h>
38564 +#include <linux/sched.h>
38565 +#include <linux/fs.h>
38566 +#include <linux/file.h>
38567 +#include <linux/grinternal.h>
38568 +
38569 +int
38570 +gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
38571 +              const struct dentry *dir, const int flag, const int acc_mode)
38572 +{
38573 +#ifdef CONFIG_GRKERNSEC_FIFO
38574 +       const struct cred *cred = current_cred();
38575 +
38576 +       if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
38577 +           !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
38578 +           (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
38579 +           (cred->fsuid != dentry->d_inode->i_uid)) {
38580 +               if (!generic_permission(dentry->d_inode, acc_mode, NULL))
38581 +                       gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
38582 +               return -EACCES;
38583 +       }
38584 +#endif
38585 +       return 0;
38586 +}
38587 diff -urNp linux-2.6.33/grsecurity/grsec_fork.c linux-2.6.33/grsecurity/grsec_fork.c
38588 --- linux-2.6.33/grsecurity/grsec_fork.c        1969-12-31 19:00:00.000000000 -0500
38589 +++ linux-2.6.33/grsecurity/grsec_fork.c        2010-03-07 12:23:36.109671795 -0500
38590 @@ -0,0 +1,15 @@
38591 +#include <linux/kernel.h>
38592 +#include <linux/sched.h>
38593 +#include <linux/grsecurity.h>
38594 +#include <linux/grinternal.h>
38595 +#include <linux/errno.h>
38596 +
38597 +void
38598 +gr_log_forkfail(const int retval)
38599 +{
38600 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
38601 +       if (grsec_enable_forkfail && retval != -ERESTARTNOINTR)
38602 +               gr_log_int(GR_DONT_AUDIT, GR_FAILFORK_MSG, retval);
38603 +#endif
38604 +       return;
38605 +}
38606 diff -urNp linux-2.6.33/grsecurity/grsec_init.c linux-2.6.33/grsecurity/grsec_init.c
38607 --- linux-2.6.33/grsecurity/grsec_init.c        1969-12-31 19:00:00.000000000 -0500
38608 +++ linux-2.6.33/grsecurity/grsec_init.c        2010-03-07 12:23:36.109671795 -0500
38609 @@ -0,0 +1,235 @@
38610 +#include <linux/kernel.h>
38611 +#include <linux/sched.h>
38612 +#include <linux/mm.h>
38613 +#include <linux/smp_lock.h>
38614 +#include <linux/gracl.h>
38615 +#include <linux/slab.h>
38616 +#include <linux/vmalloc.h>
38617 +#include <linux/percpu.h>
38618 +
38619 +int grsec_enable_link;
38620 +int grsec_enable_dmesg;
38621 +int grsec_enable_harden_ptrace;
38622 +int grsec_enable_fifo;
38623 +int grsec_enable_execve;
38624 +int grsec_enable_execlog;
38625 +int grsec_enable_signal;
38626 +int grsec_enable_forkfail;
38627 +int grsec_enable_audit_ptrace;
38628 +int grsec_enable_time;
38629 +int grsec_enable_audit_textrel;
38630 +int grsec_enable_group;
38631 +int grsec_audit_gid;
38632 +int grsec_enable_chdir;
38633 +int grsec_enable_mount;
38634 +int grsec_enable_rofs;
38635 +int grsec_enable_chroot_findtask;
38636 +int grsec_enable_chroot_mount;
38637 +int grsec_enable_chroot_shmat;
38638 +int grsec_enable_chroot_fchdir;
38639 +int grsec_enable_chroot_double;
38640 +int grsec_enable_chroot_pivot;
38641 +int grsec_enable_chroot_chdir;
38642 +int grsec_enable_chroot_chmod;
38643 +int grsec_enable_chroot_mknod;
38644 +int grsec_enable_chroot_nice;
38645 +int grsec_enable_chroot_execlog;
38646 +int grsec_enable_chroot_caps;
38647 +int grsec_enable_chroot_sysctl;
38648 +int grsec_enable_chroot_unix;
38649 +int grsec_enable_tpe;
38650 +int grsec_tpe_gid;
38651 +int grsec_enable_tpe_all;
38652 +int grsec_enable_socket_all;
38653 +int grsec_socket_all_gid;
38654 +int grsec_enable_socket_client;
38655 +int grsec_socket_client_gid;
38656 +int grsec_enable_socket_server;
38657 +int grsec_socket_server_gid;
38658 +int grsec_resource_logging;
38659 +int grsec_lock;
38660 +
38661 +DEFINE_SPINLOCK(grsec_alert_lock);
38662 +unsigned long grsec_alert_wtime = 0;
38663 +unsigned long grsec_alert_fyet = 0;
38664 +
38665 +DEFINE_SPINLOCK(grsec_audit_lock);
38666 +
38667 +DEFINE_RWLOCK(grsec_exec_file_lock);
38668 +
38669 +char *gr_shared_page[4];
38670 +
38671 +char *gr_alert_log_fmt;
38672 +char *gr_audit_log_fmt;
38673 +char *gr_alert_log_buf;
38674 +char *gr_audit_log_buf;
38675 +
38676 +extern struct gr_arg *gr_usermode;
38677 +extern unsigned char *gr_system_salt;
38678 +extern unsigned char *gr_system_sum;
38679 +
38680 +void __init
38681 +grsecurity_init(void)
38682 +{
38683 +       int j;
38684 +       /* create the per-cpu shared pages */
38685 +
38686 +#ifdef CONFIG_X86
38687 +       memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
38688 +#endif
38689 +
38690 +       for (j = 0; j < 4; j++) {
38691 +               gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
38692 +               if (gr_shared_page[j] == NULL) {
38693 +                       panic("Unable to allocate grsecurity shared page");
38694 +                       return;
38695 +               }
38696 +       }
38697 +
38698 +       /* allocate log buffers */
38699 +       gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
38700 +       if (!gr_alert_log_fmt) {
38701 +               panic("Unable to allocate grsecurity alert log format buffer");
38702 +               return;
38703 +       }
38704 +       gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
38705 +       if (!gr_audit_log_fmt) {
38706 +               panic("Unable to allocate grsecurity audit log format buffer");
38707 +               return;
38708 +       }
38709 +       gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
38710 +       if (!gr_alert_log_buf) {
38711 +               panic("Unable to allocate grsecurity alert log buffer");
38712 +               return;
38713 +       }
38714 +       gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
38715 +       if (!gr_audit_log_buf) {
38716 +               panic("Unable to allocate grsecurity audit log buffer");
38717 +               return;
38718 +       }
38719 +
38720 +       /* allocate memory for authentication structure */
38721 +       gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
38722 +       gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
38723 +       gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
38724 +
38725 +       if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
38726 +               panic("Unable to allocate grsecurity authentication structure");
38727 +               return;
38728 +       }
38729 +
38730 +#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
38731 +#ifndef CONFIG_GRKERNSEC_SYSCTL
38732 +       grsec_lock = 1;
38733 +#endif
38734 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
38735 +       grsec_enable_audit_textrel = 1;
38736 +#endif
38737 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
38738 +       grsec_enable_group = 1;
38739 +       grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
38740 +#endif
38741 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
38742 +       grsec_enable_chdir = 1;
38743 +#endif
38744 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
38745 +       grsec_enable_harden_ptrace = 1;
38746 +#endif
38747 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
38748 +       grsec_enable_mount = 1;
38749 +#endif
38750 +#ifdef CONFIG_GRKERNSEC_LINK
38751 +       grsec_enable_link = 1;
38752 +#endif
38753 +#ifdef CONFIG_GRKERNSEC_DMESG
38754 +       grsec_enable_dmesg = 1;
38755 +#endif
38756 +#ifdef CONFIG_GRKERNSEC_FIFO
38757 +       grsec_enable_fifo = 1;
38758 +#endif
38759 +#ifdef CONFIG_GRKERNSEC_EXECVE
38760 +       grsec_enable_execve = 1;
38761 +#endif
38762 +#ifdef CONFIG_GRKERNSEC_EXECLOG
38763 +       grsec_enable_execlog = 1;
38764 +#endif
38765 +#ifdef CONFIG_GRKERNSEC_SIGNAL
38766 +       grsec_enable_signal = 1;
38767 +#endif
38768 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
38769 +       grsec_enable_forkfail = 1;
38770 +#endif
38771 +#ifdef CONFIG_GRKERNSEC_TIME
38772 +       grsec_enable_time = 1;
38773 +#endif
38774 +#ifdef CONFIG_GRKERNSEC_RESLOG
38775 +       grsec_resource_logging = 1;
38776 +#endif
38777 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
38778 +       grsec_enable_chroot_findtask = 1;
38779 +#endif
38780 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
38781 +       grsec_enable_chroot_unix = 1;
38782 +#endif
38783 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
38784 +       grsec_enable_chroot_mount = 1;
38785 +#endif
38786 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
38787 +       grsec_enable_chroot_fchdir = 1;
38788 +#endif
38789 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
38790 +       grsec_enable_chroot_shmat = 1;
38791 +#endif
38792 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
38793 +       grsec_enable_audit_ptrace = 1;
38794 +#endif
38795 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
38796 +       grsec_enable_chroot_double = 1;
38797 +#endif
38798 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
38799 +       grsec_enable_chroot_pivot = 1;
38800 +#endif
38801 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
38802 +       grsec_enable_chroot_chdir = 1;
38803 +#endif
38804 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
38805 +       grsec_enable_chroot_chmod = 1;
38806 +#endif
38807 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
38808 +       grsec_enable_chroot_mknod = 1;
38809 +#endif
38810 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
38811 +       grsec_enable_chroot_nice = 1;
38812 +#endif
38813 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
38814 +       grsec_enable_chroot_execlog = 1;
38815 +#endif
38816 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
38817 +       grsec_enable_chroot_caps = 1;
38818 +#endif
38819 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
38820 +       grsec_enable_chroot_sysctl = 1;
38821 +#endif
38822 +#ifdef CONFIG_GRKERNSEC_TPE
38823 +       grsec_enable_tpe = 1;
38824 +       grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
38825 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
38826 +       grsec_enable_tpe_all = 1;
38827 +#endif
38828 +#endif
38829 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
38830 +       grsec_enable_socket_all = 1;
38831 +       grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
38832 +#endif
38833 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
38834 +       grsec_enable_socket_client = 1;
38835 +       grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
38836 +#endif
38837 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
38838 +       grsec_enable_socket_server = 1;
38839 +       grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
38840 +#endif
38841 +#endif
38842 +
38843 +       return;
38844 +}
38845 diff -urNp linux-2.6.33/grsecurity/grsec_link.c linux-2.6.33/grsecurity/grsec_link.c
38846 --- linux-2.6.33/grsecurity/grsec_link.c        1969-12-31 19:00:00.000000000 -0500
38847 +++ linux-2.6.33/grsecurity/grsec_link.c        2010-03-07 12:23:36.109671795 -0500
38848 @@ -0,0 +1,43 @@
38849 +#include <linux/kernel.h>
38850 +#include <linux/sched.h>
38851 +#include <linux/fs.h>
38852 +#include <linux/file.h>
38853 +#include <linux/grinternal.h>
38854 +
38855 +int
38856 +gr_handle_follow_link(const struct inode *parent,
38857 +                     const struct inode *inode,
38858 +                     const struct dentry *dentry, const struct vfsmount *mnt)
38859 +{
38860 +#ifdef CONFIG_GRKERNSEC_LINK
38861 +       const struct cred *cred = current_cred();
38862 +
38863 +       if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
38864 +           (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
38865 +           (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
38866 +               gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
38867 +               return -EACCES;
38868 +       }
38869 +#endif
38870 +       return 0;
38871 +}
38872 +
38873 +int
38874 +gr_handle_hardlink(const struct dentry *dentry,
38875 +                  const struct vfsmount *mnt,
38876 +                  struct inode *inode, const int mode, const char *to)
38877 +{
38878 +#ifdef CONFIG_GRKERNSEC_LINK
38879 +       const struct cred *cred = current_cred();
38880 +
38881 +       if (grsec_enable_link && cred->fsuid != inode->i_uid &&
38882 +           (!S_ISREG(mode) || (mode & S_ISUID) ||
38883 +            ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
38884 +            (generic_permission(inode, MAY_READ | MAY_WRITE, NULL))) &&
38885 +           !capable(CAP_FOWNER) && cred->uid) {
38886 +               gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
38887 +               return -EPERM;
38888 +       }
38889 +#endif
38890 +       return 0;
38891 +}
38892 diff -urNp linux-2.6.33/grsecurity/grsec_log.c linux-2.6.33/grsecurity/grsec_log.c
38893 --- linux-2.6.33/grsecurity/grsec_log.c 1969-12-31 19:00:00.000000000 -0500
38894 +++ linux-2.6.33/grsecurity/grsec_log.c 2010-03-07 12:23:36.109671795 -0500
38895 @@ -0,0 +1,296 @@
38896 +#include <linux/kernel.h>
38897 +#include <linux/sched.h>
38898 +#include <linux/file.h>
38899 +#include <linux/tty.h>
38900 +#include <linux/fs.h>
38901 +#include <linux/grinternal.h>
38902 +
38903 +#define BEGIN_LOCKS(x) \
38904 +       rcu_read_lock(); \
38905 +       read_lock(&tasklist_lock); \
38906 +       read_lock(&grsec_exec_file_lock); \
38907 +       if (x != GR_DO_AUDIT) \
38908 +               spin_lock(&grsec_alert_lock); \
38909 +       else \
38910 +               spin_lock(&grsec_audit_lock)
38911 +
38912 +#define END_LOCKS(x) \
38913 +       if (x != GR_DO_AUDIT) \
38914 +               spin_unlock(&grsec_alert_lock); \
38915 +       else \
38916 +               spin_unlock(&grsec_audit_lock); \
38917 +       read_unlock(&grsec_exec_file_lock); \
38918 +       read_unlock(&tasklist_lock); \
38919 +       rcu_read_unlock(); \
38920 +       if (x == GR_DONT_AUDIT) \
38921 +               gr_handle_alertkill(current)
38922 +
38923 +enum {
38924 +       FLOODING,
38925 +       NO_FLOODING
38926 +};
38927 +
38928 +extern char *gr_alert_log_fmt;
38929 +extern char *gr_audit_log_fmt;
38930 +extern char *gr_alert_log_buf;
38931 +extern char *gr_audit_log_buf;
38932 +
38933 +static int gr_log_start(int audit)
38934 +{
38935 +       char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
38936 +       char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
38937 +       char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
38938 +
38939 +       if (audit == GR_DO_AUDIT)
38940 +               goto set_fmt;
38941 +
38942 +       if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
38943 +               grsec_alert_wtime = jiffies;
38944 +               grsec_alert_fyet = 0;
38945 +       } else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
38946 +               grsec_alert_fyet++;
38947 +       } else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
38948 +               grsec_alert_wtime = jiffies;
38949 +               grsec_alert_fyet++;
38950 +               printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
38951 +               return FLOODING;
38952 +       } else return FLOODING;
38953 +
38954 +set_fmt:
38955 +       memset(buf, 0, PAGE_SIZE);
38956 +       if (current->signal->curr_ip && gr_acl_is_enabled()) {
38957 +               sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
38958 +               snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
38959 +       } else if (current->signal->curr_ip) {
38960 +               sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
38961 +               snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
38962 +       } else if (gr_acl_is_enabled()) {
38963 +               sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
38964 +               snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
38965 +       } else {
38966 +               sprintf(fmt, "%s%s", loglevel, "grsec: ");
38967 +               strcpy(buf, fmt);
38968 +       }
38969 +
38970 +       return NO_FLOODING;
38971 +}
38972 +
38973 +static void gr_log_middle(int audit, const char *msg, va_list ap)
38974 +       __attribute__ ((format (printf, 2, 0)));
38975 +
38976 +static void gr_log_middle(int audit, const char *msg, va_list ap)
38977 +{
38978 +       char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
38979 +       unsigned int len = strlen(buf);
38980 +
38981 +       vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
38982 +
38983 +       return;
38984 +}
38985 +
38986 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
38987 +       __attribute__ ((format (printf, 2, 3)));
38988 +
38989 +static void gr_log_middle_varargs(int audit, const char *msg, ...)
38990 +{
38991 +       char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
38992 +       unsigned int len = strlen(buf);
38993 +       va_list ap;
38994 +
38995 +       va_start(ap, msg);
38996 +       vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
38997 +       va_end(ap);
38998 +
38999 +       return;
39000 +}
39001 +
39002 +static void gr_log_end(int audit)
39003 +{
39004 +       char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
39005 +       unsigned int len = strlen(buf);
39006 +
39007 +       snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->parent)));
39008 +       printk("%s\n", buf);
39009 +
39010 +       return;
39011 +}
39012 +
39013 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
39014 +{
39015 +       int logtype;
39016 +       char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
39017 +       char *str1, *str2, *str3;
39018 +       void *voidptr;
39019 +       int num1, num2;
39020 +       unsigned long ulong1, ulong2;
39021 +       struct dentry *dentry;
39022 +       struct vfsmount *mnt;
39023 +       struct file *file;
39024 +       struct task_struct *task;
39025 +       const struct cred *cred, *pcred;
39026 +       va_list ap;
39027 +
39028 +       BEGIN_LOCKS(audit);
39029 +       logtype = gr_log_start(audit);
39030 +       if (logtype == FLOODING) {
39031 +               END_LOCKS(audit);
39032 +               return;
39033 +       }
39034 +       va_start(ap, argtypes);
39035 +       switch (argtypes) {
39036 +       case GR_TTYSNIFF:
39037 +               task = va_arg(ap, struct task_struct *);
39038 +               gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid);
39039 +               break;
39040 +       case GR_SYSCTL_HIDDEN:
39041 +               str1 = va_arg(ap, char *);
39042 +               gr_log_middle_varargs(audit, msg, result, str1);
39043 +               break;
39044 +       case GR_RBAC:
39045 +               dentry = va_arg(ap, struct dentry *);
39046 +               mnt = va_arg(ap, struct vfsmount *);
39047 +               gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
39048 +               break;
39049 +       case GR_RBAC_STR:
39050 +               dentry = va_arg(ap, struct dentry *);
39051 +               mnt = va_arg(ap, struct vfsmount *);
39052 +               str1 = va_arg(ap, char *);
39053 +               gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
39054 +               break;
39055 +       case GR_STR_RBAC:
39056 +               str1 = va_arg(ap, char *);
39057 +               dentry = va_arg(ap, struct dentry *);
39058 +               mnt = va_arg(ap, struct vfsmount *);
39059 +               gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
39060 +               break;
39061 +       case GR_RBAC_MODE2:
39062 +               dentry = va_arg(ap, struct dentry *);
39063 +               mnt = va_arg(ap, struct vfsmount *);
39064 +               str1 = va_arg(ap, char *);
39065 +               str2 = va_arg(ap, char *);
39066 +               gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
39067 +               break;
39068 +       case GR_RBAC_MODE3:
39069 +               dentry = va_arg(ap, struct dentry *);
39070 +               mnt = va_arg(ap, struct vfsmount *);
39071 +               str1 = va_arg(ap, char *);
39072 +               str2 = va_arg(ap, char *);
39073 +               str3 = va_arg(ap, char *);
39074 +               gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
39075 +               break;
39076 +       case GR_FILENAME:
39077 +               dentry = va_arg(ap, struct dentry *);
39078 +               mnt = va_arg(ap, struct vfsmount *);
39079 +               gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
39080 +               break;
39081 +       case GR_STR_FILENAME:
39082 +               str1 = va_arg(ap, char *);
39083 +               dentry = va_arg(ap, struct dentry *);
39084 +               mnt = va_arg(ap, struct vfsmount *);
39085 +               gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
39086 +               break;
39087 +       case GR_FILENAME_STR:
39088 +               dentry = va_arg(ap, struct dentry *);
39089 +               mnt = va_arg(ap, struct vfsmount *);
39090 +               str1 = va_arg(ap, char *);
39091 +               gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
39092 +               break;
39093 +       case GR_FILENAME_TWO_INT:
39094 +               dentry = va_arg(ap, struct dentry *);
39095 +               mnt = va_arg(ap, struct vfsmount *);
39096 +               num1 = va_arg(ap, int);
39097 +               num2 = va_arg(ap, int);
39098 +               gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
39099 +               break;
39100 +       case GR_FILENAME_TWO_INT_STR:
39101 +               dentry = va_arg(ap, struct dentry *);
39102 +               mnt = va_arg(ap, struct vfsmount *);
39103 +               num1 = va_arg(ap, int);
39104 +               num2 = va_arg(ap, int);
39105 +               str1 = va_arg(ap, char *);
39106 +               gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
39107 +               break;
39108 +       case GR_TEXTREL:
39109 +               file = va_arg(ap, struct file *);
39110 +               ulong1 = va_arg(ap, unsigned long);
39111 +               ulong2 = va_arg(ap, unsigned long);
39112 +               gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
39113 +               break;
39114 +       case GR_PTRACE:
39115 +               task = va_arg(ap, struct task_struct *);
39116 +               gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
39117 +               break;
39118 +       case GR_RESOURCE:
39119 +               task = va_arg(ap, struct task_struct *);
39120 +               cred = __task_cred(task);
39121 +               pcred = __task_cred(task->parent);
39122 +               ulong1 = va_arg(ap, unsigned long);
39123 +               str1 = va_arg(ap, char *);
39124 +               ulong2 = va_arg(ap, unsigned long);
39125 +               gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
39126 +               break;
39127 +       case GR_CAP:
39128 +               task = va_arg(ap, struct task_struct *);
39129 +               cred = __task_cred(task);
39130 +               pcred = __task_cred(task->parent);
39131 +               str1 = va_arg(ap, char *);
39132 +               gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
39133 +               break;
39134 +       case GR_SIG:
39135 +               str1 = va_arg(ap, char *);
39136 +               voidptr = va_arg(ap, void *);
39137 +               gr_log_middle_varargs(audit, msg, str1, voidptr);
39138 +               break;
39139 +       case GR_SIG2:
39140 +               task = va_arg(ap, struct task_struct *);
39141 +               cred = __task_cred(task);
39142 +               pcred = __task_cred(task->parent);
39143 +               num1 = va_arg(ap, int);
39144 +               gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
39145 +               break;
39146 +       case GR_CRASH1:
39147 +               task = va_arg(ap, struct task_struct *);
39148 +               cred = __task_cred(task);
39149 +               pcred = __task_cred(task->parent);
39150 +               ulong1 = va_arg(ap, unsigned long);
39151 +               gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
39152 +               break;
39153 +       case GR_CRASH2:
39154 +               task = va_arg(ap, struct task_struct *);
39155 +               cred = __task_cred(task);
39156 +               pcred = __task_cred(task->parent);
39157 +               ulong1 = va_arg(ap, unsigned long);
39158 +               gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
39159 +               break;
39160 +       case GR_PSACCT:
39161 +               {
39162 +                       unsigned int wday, cday;
39163 +                       __u8 whr, chr;
39164 +                       __u8 wmin, cmin;
39165 +                       __u8 wsec, csec;
39166 +                       char cur_tty[64] = { 0 };
39167 +                       char parent_tty[64] = { 0 };
39168 +
39169 +                       task = va_arg(ap, struct task_struct *);
39170 +                       wday = va_arg(ap, unsigned int);
39171 +                       cday = va_arg(ap, unsigned int);
39172 +                       whr = va_arg(ap, int);
39173 +                       chr = va_arg(ap, int);
39174 +                       wmin = va_arg(ap, int);
39175 +                       cmin = va_arg(ap, int);
39176 +                       wsec = va_arg(ap, int);
39177 +                       csec = va_arg(ap, int);
39178 +                       ulong1 = va_arg(ap, unsigned long);
39179 +                       cred = __task_cred(task);
39180 +                       pcred = __task_cred(task->parent);
39181 +
39182 +                       gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->parent->comm, task->parent->pid, &task->parent->signal->curr_ip, tty_name(task->parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
39183 +               }
39184 +               break;
39185 +       default:
39186 +               gr_log_middle(audit, msg, ap);
39187 +       }
39188 +       va_end(ap);
39189 +       gr_log_end(audit);
39190 +       END_LOCKS(audit);
39191 +}
39192 diff -urNp linux-2.6.33/grsecurity/grsec_mem.c linux-2.6.33/grsecurity/grsec_mem.c
39193 --- linux-2.6.33/grsecurity/grsec_mem.c 1969-12-31 19:00:00.000000000 -0500
39194 +++ linux-2.6.33/grsecurity/grsec_mem.c 2010-03-07 12:23:36.109671795 -0500
39195 @@ -0,0 +1,85 @@
39196 +#include <linux/kernel.h>
39197 +#include <linux/sched.h>
39198 +#include <linux/mm.h>
39199 +#include <linux/mman.h>
39200 +#include <linux/grinternal.h>
39201 +
39202 +void
39203 +gr_handle_ioperm(void)
39204 +{
39205 +       gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
39206 +       return;
39207 +}
39208 +
39209 +void
39210 +gr_handle_iopl(void)
39211 +{
39212 +       gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
39213 +       return;
39214 +}
39215 +
39216 +void
39217 +gr_handle_mem_write(void)
39218 +{
39219 +       gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
39220 +       return;
39221 +}
39222 +
39223 +void
39224 +gr_handle_kmem_write(void)
39225 +{
39226 +       gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
39227 +       return;
39228 +}
39229 +
39230 +void
39231 +gr_handle_open_port(void)
39232 +{
39233 +       gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
39234 +       return;
39235 +}
39236 +
39237 +int
39238 +gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
39239 +{
39240 +       unsigned long start, end;
39241 +
39242 +       start = offset;
39243 +       end = start + vma->vm_end - vma->vm_start;
39244 +
39245 +       if (start > end) {
39246 +               gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
39247 +               return -EPERM;
39248 +       }
39249 +
39250 +       /* allowed ranges : ISA I/O BIOS */
39251 +       if ((start >= __pa(high_memory))
39252 +#if defined(CONFIG_X86) || defined(CONFIG_PPC)
39253 +           || (start >= 0x000a0000 && end <= 0x00100000)
39254 +           || (start >= 0x00000000 && end <= 0x00001000)
39255 +#endif
39256 +       )
39257 +               return 0;
39258 +
39259 +       if (vma->vm_flags & VM_WRITE) {
39260 +               gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
39261 +               return -EPERM;
39262 +       } else
39263 +               vma->vm_flags &= ~VM_MAYWRITE;
39264 +
39265 +       return 0;
39266 +}
39267 +
39268 +void
39269 +gr_log_nonroot_mod_load(const char *modname)
39270 +{
39271 +        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
39272 +        return;
39273 +}
39274 +
39275 +void
39276 +gr_handle_vm86(void)
39277 +{
39278 +       gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
39279 +       return;
39280 +}
39281 diff -urNp linux-2.6.33/grsecurity/grsec_mount.c linux-2.6.33/grsecurity/grsec_mount.c
39282 --- linux-2.6.33/grsecurity/grsec_mount.c       1969-12-31 19:00:00.000000000 -0500
39283 +++ linux-2.6.33/grsecurity/grsec_mount.c       2010-03-07 12:23:36.109671795 -0500
39284 @@ -0,0 +1,62 @@
39285 +#include <linux/kernel.h>
39286 +#include <linux/sched.h>
39287 +#include <linux/mount.h>
39288 +#include <linux/grsecurity.h>
39289 +#include <linux/grinternal.h>
39290 +
39291 +void
39292 +gr_log_remount(const char *devname, const int retval)
39293 +{
39294 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
39295 +       if (grsec_enable_mount && (retval >= 0))
39296 +               gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
39297 +#endif
39298 +       return;
39299 +}
39300 +
39301 +void
39302 +gr_log_unmount(const char *devname, const int retval)
39303 +{
39304 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
39305 +       if (grsec_enable_mount && (retval >= 0))
39306 +               gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
39307 +#endif
39308 +       return;
39309 +}
39310 +
39311 +void
39312 +gr_log_mount(const char *from, const char *to, const int retval)
39313 +{
39314 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
39315 +       if (grsec_enable_mount && (retval >= 0))
39316 +               gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from, to);
39317 +#endif
39318 +       return;
39319 +}
39320 +
39321 +int
39322 +gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
39323 +{
39324 +#ifdef CONFIG_GRKERNSEC_ROFS
39325 +       if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
39326 +               gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
39327 +               return -EPERM;
39328 +       } else
39329 +               return 0;
39330 +#endif
39331 +       return 0;
39332 +}
39333 +
39334 +int
39335 +gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
39336 +{
39337 +#ifdef CONFIG_GRKERNSEC_ROFS
39338 +       if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
39339 +           dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
39340 +               gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
39341 +               return -EPERM;
39342 +       } else
39343 +               return 0;
39344 +#endif
39345 +       return 0;
39346 +}
39347 diff -urNp linux-2.6.33/grsecurity/grsec_ptrace.c linux-2.6.33/grsecurity/grsec_ptrace.c
39348 --- linux-2.6.33/grsecurity/grsec_ptrace.c      1969-12-31 19:00:00.000000000 -0500
39349 +++ linux-2.6.33/grsecurity/grsec_ptrace.c      2010-03-07 12:23:36.109671795 -0500
39350 @@ -0,0 +1,14 @@
39351 +#include <linux/kernel.h>
39352 +#include <linux/sched.h>
39353 +#include <linux/grinternal.h>
39354 +#include <linux/grsecurity.h>
39355 +
39356 +void
39357 +gr_audit_ptrace(struct task_struct *task)
39358 +{
39359 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
39360 +       if (grsec_enable_audit_ptrace)
39361 +               gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
39362 +#endif
39363 +       return;
39364 +}
39365 diff -urNp linux-2.6.33/grsecurity/grsec_sig.c linux-2.6.33/grsecurity/grsec_sig.c
39366 --- linux-2.6.33/grsecurity/grsec_sig.c 1969-12-31 19:00:00.000000000 -0500
39367 +++ linux-2.6.33/grsecurity/grsec_sig.c 2010-03-07 12:23:36.109671795 -0500
39368 @@ -0,0 +1,65 @@
39369 +#include <linux/kernel.h>
39370 +#include <linux/sched.h>
39371 +#include <linux/delay.h>
39372 +#include <linux/grsecurity.h>
39373 +#include <linux/grinternal.h>
39374 +
39375 +char *signames[] = {
39376 +       [SIGSEGV] = "Segmentation fault",
39377 +       [SIGILL] = "Illegal instruction",
39378 +       [SIGABRT] = "Abort",
39379 +       [SIGBUS] = "Invalid alignment/Bus error"
39380 +};
39381 +
39382 +void
39383 +gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
39384 +{
39385 +#ifdef CONFIG_GRKERNSEC_SIGNAL
39386 +       if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
39387 +                                   (sig == SIGABRT) || (sig == SIGBUS))) {
39388 +               if (t->pid == current->pid) {
39389 +                       gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
39390 +               } else {
39391 +                       gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
39392 +               }
39393 +       }
39394 +#endif
39395 +       return;
39396 +}
39397 +
39398 +int
39399 +gr_handle_signal(const struct task_struct *p, const int sig)
39400 +{
39401 +#ifdef CONFIG_GRKERNSEC
39402 +       if (current->pid > 1 && gr_check_protected_task(p)) {
39403 +               gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
39404 +               return -EPERM;
39405 +       } else if (gr_pid_is_chrooted((struct task_struct *)p)) {
39406 +               return -EPERM;
39407 +       }
39408 +#endif
39409 +       return 0;
39410 +}
39411 +
39412 +void gr_handle_brute_attach(struct task_struct *p)
39413 +{
39414 +#ifdef CONFIG_GRKERNSEC_BRUTE
39415 +       read_lock(&tasklist_lock);
39416 +       read_lock(&grsec_exec_file_lock);
39417 +       if (p->parent && p->parent->exec_file == p->exec_file)
39418 +               p->parent->brute = 1;
39419 +       read_unlock(&grsec_exec_file_lock);
39420 +       read_unlock(&tasklist_lock);
39421 +#endif
39422 +       return;
39423 +}
39424 +
39425 +void gr_handle_brute_check(void)
39426 +{
39427 +#ifdef CONFIG_GRKERNSEC_BRUTE
39428 +       if (current->brute)
39429 +               msleep(30 * 1000);
39430 +#endif
39431 +       return;
39432 +}
39433 +
39434 diff -urNp linux-2.6.33/grsecurity/grsec_sock.c linux-2.6.33/grsecurity/grsec_sock.c
39435 --- linux-2.6.33/grsecurity/grsec_sock.c        1969-12-31 19:00:00.000000000 -0500
39436 +++ linux-2.6.33/grsecurity/grsec_sock.c        2010-03-07 12:23:36.109671795 -0500
39437 @@ -0,0 +1,271 @@
39438 +#include <linux/kernel.h>
39439 +#include <linux/module.h>
39440 +#include <linux/sched.h>
39441 +#include <linux/file.h>
39442 +#include <linux/net.h>
39443 +#include <linux/in.h>
39444 +#include <linux/ip.h>
39445 +#include <net/sock.h>
39446 +#include <net/inet_sock.h>
39447 +#include <linux/grsecurity.h>
39448 +#include <linux/grinternal.h>
39449 +#include <linux/gracl.h>
39450 +
39451 +kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
39452 +EXPORT_SYMBOL(gr_cap_rtnetlink);
39453 +
39454 +extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
39455 +extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
39456 +
39457 +EXPORT_SYMBOL(gr_search_udp_recvmsg);
39458 +EXPORT_SYMBOL(gr_search_udp_sendmsg);
39459 +
39460 +#ifdef CONFIG_UNIX_MODULE
39461 +EXPORT_SYMBOL(gr_acl_handle_unix);
39462 +EXPORT_SYMBOL(gr_acl_handle_mknod);
39463 +EXPORT_SYMBOL(gr_handle_chroot_unix);
39464 +EXPORT_SYMBOL(gr_handle_create);
39465 +#endif
39466 +
39467 +#ifdef CONFIG_GRKERNSEC
39468 +#define gr_conn_table_size 32749
39469 +struct conn_table_entry {
39470 +       struct conn_table_entry *next;
39471 +       struct signal_struct *sig;
39472 +};
39473 +
39474 +struct conn_table_entry *gr_conn_table[gr_conn_table_size];
39475 +DEFINE_SPINLOCK(gr_conn_table_lock);
39476 +
39477 +extern const char * gr_socktype_to_name(unsigned char type);
39478 +extern const char * gr_proto_to_name(unsigned char proto);
39479 +
39480 +static __inline__ int
39481 +conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
39482 +{
39483 +       return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
39484 +}
39485 +
39486 +static __inline__ int
39487 +conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr,
39488 +          __u16 sport, __u16 dport)
39489 +{
39490 +       if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
39491 +                    sig->gr_sport == sport && sig->gr_dport == dport))
39492 +               return 1;
39493 +       else
39494 +               return 0;
39495 +}
39496 +
39497 +static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
39498 +{
39499 +       struct conn_table_entry **match;
39500 +       unsigned int index;
39501 +
39502 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
39503 +                         sig->gr_sport, sig->gr_dport,
39504 +                         gr_conn_table_size);
39505 +
39506 +       newent->sig = sig;
39507 +
39508 +       match = &gr_conn_table[index];
39509 +       newent->next = *match;
39510 +       *match = newent;
39511 +
39512 +       return;
39513 +}
39514 +
39515 +static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
39516 +{
39517 +       struct conn_table_entry *match, *last = NULL;
39518 +       unsigned int index;
39519 +
39520 +       index = conn_hash(sig->gr_saddr, sig->gr_daddr,
39521 +                         sig->gr_sport, sig->gr_dport,
39522 +                         gr_conn_table_size);
39523 +
39524 +       match = gr_conn_table[index];
39525 +       while (match && !conn_match(match->sig,
39526 +               sig->gr_saddr, sig->gr_daddr, sig->gr_sport,
39527 +               sig->gr_dport)) {
39528 +               last = match;
39529 +               match = match->next;
39530 +       }
39531 +
39532 +       if (match) {
39533 +               if (last)
39534 +                       last->next = match->next;
39535 +               else
39536 +                       gr_conn_table[index] = NULL;
39537 +               kfree(match);
39538 +       }
39539 +
39540 +       return;
39541 +}
39542 +
39543 +static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
39544 +                                            __u16 sport, __u16 dport)
39545 +{
39546 +       struct conn_table_entry *match;
39547 +       unsigned int index;
39548 +
39549 +       index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
39550 +
39551 +       match = gr_conn_table[index];
39552 +       while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
39553 +               match = match->next;
39554 +
39555 +       if (match)
39556 +               return match->sig;
39557 +       else
39558 +               return NULL;
39559 +}
39560 +
39561 +#endif
39562 +
39563 +void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
39564 +{
39565 +#ifdef CONFIG_GRKERNSEC
39566 +       struct signal_struct *sig = task->signal;
39567 +       struct conn_table_entry *newent;
39568 +
39569 +       newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
39570 +       if (newent == NULL)
39571 +               return;
39572 +       /* no bh lock needed since we are called with bh disabled */
39573 +       spin_lock(&gr_conn_table_lock);
39574 +       gr_del_task_from_ip_table_nolock(sig);
39575 +       sig->gr_saddr = inet->inet_rcv_saddr;
39576 +       sig->gr_daddr = inet->inet_daddr;
39577 +       sig->gr_sport = inet->inet_sport;
39578 +       sig->gr_dport = inet->inet_dport;
39579 +       gr_add_to_task_ip_table_nolock(sig, newent);
39580 +       spin_unlock(&gr_conn_table_lock);
39581 +#endif
39582 +       return;
39583 +}
39584 +
39585 +void gr_del_task_from_ip_table(struct task_struct *task)
39586 +{
39587 +#ifdef CONFIG_GRKERNSEC
39588 +       spin_lock_bh(&gr_conn_table_lock);
39589 +       gr_del_task_from_ip_table_nolock(task->signal);
39590 +       spin_unlock_bh(&gr_conn_table_lock);
39591 +#endif
39592 +       return;
39593 +}
39594 +
39595 +void
39596 +gr_attach_curr_ip(const struct sock *sk)
39597 +{
39598 +#ifdef CONFIG_GRKERNSEC
39599 +       struct signal_struct *p, *set;
39600 +       const struct inet_sock *inet = inet_sk(sk);
39601 +
39602 +       if (unlikely(sk->sk_protocol != IPPROTO_TCP))
39603 +               return;
39604 +
39605 +       set = current->signal;
39606 +
39607 +       spin_lock_bh(&gr_conn_table_lock);
39608 +       p = gr_lookup_task_ip_table(inet->inet_daddr, inet->inet_rcv_saddr,
39609 +                                   inet->inet_dport, inet->inet_sport);
39610 +       if (unlikely(p != NULL)) {
39611 +               set->curr_ip = p->curr_ip;
39612 +               set->used_accept = 1;
39613 +               gr_del_task_from_ip_table_nolock(p);
39614 +               spin_unlock_bh(&gr_conn_table_lock);
39615 +               return;
39616 +       }
39617 +       spin_unlock_bh(&gr_conn_table_lock);
39618 +
39619 +       set->curr_ip = inet->inet_daddr;
39620 +       set->used_accept = 1;
39621 +#endif
39622 +       return;
39623 +}
39624 +
39625 +int
39626 +gr_handle_sock_all(const int family, const int type, const int protocol)
39627 +{
39628 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
39629 +       if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
39630 +           (family != AF_UNIX) && (family != AF_LOCAL)) {
39631 +               gr_log_int_str2(GR_DONT_AUDIT, GR_SOCK2_MSG, family, gr_socktype_to_name(type), gr_proto_to_name(protocol));
39632 +               return -EACCES;
39633 +       }
39634 +#endif
39635 +       return 0;
39636 +}
39637 +
39638 +int
39639 +gr_handle_sock_server(const struct sockaddr *sck)
39640 +{
39641 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
39642 +       if (grsec_enable_socket_server &&
39643 +           in_group_p(grsec_socket_server_gid) &&
39644 +           sck && (sck->sa_family != AF_UNIX) &&
39645 +           (sck->sa_family != AF_LOCAL)) {
39646 +               gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
39647 +               return -EACCES;
39648 +       }
39649 +#endif
39650 +       return 0;
39651 +}
39652 +
39653 +int
39654 +gr_handle_sock_server_other(const struct sock *sck)
39655 +{
39656 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
39657 +       if (grsec_enable_socket_server &&
39658 +           in_group_p(grsec_socket_server_gid) &&
39659 +           sck && (sck->sk_family != AF_UNIX) &&
39660 +           (sck->sk_family != AF_LOCAL)) {
39661 +               gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
39662 +               return -EACCES;
39663 +       }
39664 +#endif
39665 +       return 0;
39666 +}
39667 +
39668 +int
39669 +gr_handle_sock_client(const struct sockaddr *sck)
39670 +{
39671 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
39672 +       if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
39673 +           sck && (sck->sa_family != AF_UNIX) &&
39674 +           (sck->sa_family != AF_LOCAL)) {
39675 +               gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
39676 +               return -EACCES;
39677 +       }
39678 +#endif
39679 +       return 0;
39680 +}
39681 +
39682 +kernel_cap_t
39683 +gr_cap_rtnetlink(struct sock *sock)
39684 +{
39685 +#ifdef CONFIG_GRKERNSEC
39686 +       if (!gr_acl_is_enabled())
39687 +               return current_cap();
39688 +       else if (sock->sk_protocol == NETLINK_ISCSI &&
39689 +                cap_raised(current_cap(), CAP_SYS_ADMIN) &&
39690 +                gr_is_capable(CAP_SYS_ADMIN))
39691 +               return current_cap();
39692 +       else if (sock->sk_protocol == NETLINK_AUDIT &&
39693 +                cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
39694 +                gr_is_capable(CAP_AUDIT_WRITE) &&
39695 +                cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
39696 +                gr_is_capable(CAP_AUDIT_CONTROL))
39697 +               return current_cap();
39698 +       else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
39699 +                ((sock->sk_protocol == NETLINK_ROUTE) ?
39700 +                 gr_is_capable_nolog(CAP_NET_ADMIN) :
39701 +                 gr_is_capable(CAP_NET_ADMIN)))
39702 +               return current_cap();
39703 +       else
39704 +               return __cap_empty_set;
39705 +#else
39706 +       return current_cap();
39707 +#endif
39708 +}
39709 diff -urNp linux-2.6.33/grsecurity/grsec_sysctl.c linux-2.6.33/grsecurity/grsec_sysctl.c
39710 --- linux-2.6.33/grsecurity/grsec_sysctl.c      1969-12-31 19:00:00.000000000 -0500
39711 +++ linux-2.6.33/grsecurity/grsec_sysctl.c      2010-03-07 12:23:36.109671795 -0500
39712 @@ -0,0 +1,388 @@
39713 +#include <linux/kernel.h>
39714 +#include <linux/sched.h>
39715 +#include <linux/sysctl.h>
39716 +#include <linux/grsecurity.h>
39717 +#include <linux/grinternal.h>
39718 +
39719 +int
39720 +gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
39721 +{
39722 +#ifdef CONFIG_GRKERNSEC_SYSCTL
39723 +       if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
39724 +               gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
39725 +               return -EACCES;
39726 +       }
39727 +#endif
39728 +       return 0;
39729 +}
39730 +
39731 +#ifdef CONFIG_GRKERNSEC_ROFS
39732 +static int __maybe_unused one = 1;
39733 +#endif
39734 +
39735 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
39736 +ctl_table grsecurity_table[] = {
39737 +#ifdef CONFIG_GRKERNSEC_SYSCTL
39738 +#ifdef CONFIG_GRKERNSEC_LINK
39739 +       {
39740 +               .procname       = "linking_restrictions",
39741 +               .data           = &grsec_enable_link,
39742 +               .maxlen         = sizeof(int),
39743 +               .mode           = 0600,
39744 +               .proc_handler   = &proc_dointvec,
39745 +       },
39746 +#endif
39747 +#ifdef CONFIG_GRKERNSEC_FIFO
39748 +       {
39749 +               .procname       = "fifo_restrictions",
39750 +               .data           = &grsec_enable_fifo,
39751 +               .maxlen         = sizeof(int),
39752 +               .mode           = 0600,
39753 +               .proc_handler   = &proc_dointvec,
39754 +       },
39755 +#endif
39756 +#ifdef CONFIG_GRKERNSEC_EXECVE
39757 +       {
39758 +               .procname       = "execve_limiting",
39759 +               .data           = &grsec_enable_execve,
39760 +               .maxlen         = sizeof(int),
39761 +               .mode           = 0600,
39762 +               .proc_handler   = &proc_dointvec,
39763 +       },
39764 +#endif
39765 +#ifdef CONFIG_GRKERNSEC_EXECLOG
39766 +       {
39767 +               .procname       = "exec_logging",
39768 +               .data           = &grsec_enable_execlog,
39769 +               .maxlen         = sizeof(int),
39770 +               .mode           = 0600,
39771 +               .proc_handler   = &proc_dointvec,
39772 +       },
39773 +#endif
39774 +#ifdef CONFIG_GRKERNSEC_SIGNAL
39775 +       {
39776 +               .procname       = "signal_logging",
39777 +               .data           = &grsec_enable_signal,
39778 +               .maxlen         = sizeof(int),
39779 +               .mode           = 0600,
39780 +               .proc_handler   = &proc_dointvec,
39781 +       },
39782 +#endif
39783 +#ifdef CONFIG_GRKERNSEC_FORKFAIL
39784 +       {
39785 +               .procname       = "forkfail_logging",
39786 +               .data           = &grsec_enable_forkfail,
39787 +               .maxlen         = sizeof(int),
39788 +               .mode           = 0600,
39789 +               .proc_handler   = &proc_dointvec,
39790 +       },
39791 +#endif
39792 +#ifdef CONFIG_GRKERNSEC_TIME
39793 +       {
39794 +               .procname       = "timechange_logging",
39795 +               .data           = &grsec_enable_time,
39796 +               .maxlen         = sizeof(int),
39797 +               .mode           = 0600,
39798 +               .proc_handler   = &proc_dointvec,
39799 +       },
39800 +#endif
39801 +#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
39802 +       {
39803 +               .procname       = "chroot_deny_shmat",
39804 +               .data           = &grsec_enable_chroot_shmat,
39805 +               .maxlen         = sizeof(int),
39806 +               .mode           = 0600,
39807 +               .proc_handler   = &proc_dointvec,
39808 +       },
39809 +#endif
39810 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
39811 +       {
39812 +               .procname       = "chroot_deny_unix",
39813 +               .data           = &grsec_enable_chroot_unix,
39814 +               .maxlen         = sizeof(int),
39815 +               .mode           = 0600,
39816 +               .proc_handler   = &proc_dointvec,
39817 +       },
39818 +#endif
39819 +#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
39820 +       {
39821 +               .procname       = "chroot_deny_mount",
39822 +               .data           = &grsec_enable_chroot_mount,
39823 +               .maxlen         = sizeof(int),
39824 +               .mode           = 0600,
39825 +               .proc_handler   = &proc_dointvec,
39826 +       },
39827 +#endif
39828 +#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
39829 +       {
39830 +               .procname       = "chroot_deny_fchdir",
39831 +               .data           = &grsec_enable_chroot_fchdir,
39832 +               .maxlen         = sizeof(int),
39833 +               .mode           = 0600,
39834 +               .proc_handler   = &proc_dointvec,
39835 +       },
39836 +#endif
39837 +#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
39838 +       {
39839 +               .procname       = "chroot_deny_chroot",
39840 +               .data           = &grsec_enable_chroot_double,
39841 +               .maxlen         = sizeof(int),
39842 +               .mode           = 0600,
39843 +               .proc_handler   = &proc_dointvec,
39844 +       },
39845 +#endif
39846 +#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
39847 +       {
39848 +               .procname       = "chroot_deny_pivot",
39849 +               .data           = &grsec_enable_chroot_pivot,
39850 +               .maxlen         = sizeof(int),
39851 +               .mode           = 0600,
39852 +               .proc_handler   = &proc_dointvec,
39853 +       },
39854 +#endif
39855 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
39856 +       {
39857 +               .procname       = "chroot_enforce_chdir",
39858 +               .data           = &grsec_enable_chroot_chdir,
39859 +               .maxlen         = sizeof(int),
39860 +               .mode           = 0600,
39861 +               .proc_handler   = &proc_dointvec,
39862 +       },
39863 +#endif
39864 +#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
39865 +       {
39866 +               .procname       = "chroot_deny_chmod",
39867 +               .data           = &grsec_enable_chroot_chmod,
39868 +               .maxlen         = sizeof(int),
39869 +               .mode           = 0600,
39870 +               .proc_handler   = &proc_dointvec,
39871 +       },
39872 +#endif
39873 +#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
39874 +       {
39875 +               .procname       = "chroot_deny_mknod",
39876 +               .data           = &grsec_enable_chroot_mknod,
39877 +               .maxlen         = sizeof(int),
39878 +               .mode           = 0600,
39879 +               .proc_handler   = &proc_dointvec,
39880 +       },
39881 +#endif
39882 +#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
39883 +       {
39884 +               .procname       = "chroot_restrict_nice",
39885 +               .data           = &grsec_enable_chroot_nice,
39886 +               .maxlen         = sizeof(int),
39887 +               .mode           = 0600,
39888 +               .proc_handler   = &proc_dointvec,
39889 +       },
39890 +#endif
39891 +#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
39892 +       {
39893 +               .procname       = "chroot_execlog",
39894 +               .data           = &grsec_enable_chroot_execlog,
39895 +               .maxlen         = sizeof(int),
39896 +               .mode           = 0600,
39897 +               .proc_handler   = &proc_dointvec,
39898 +       },
39899 +#endif
39900 +#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
39901 +       {
39902 +               .procname       = "chroot_caps",
39903 +               .data           = &grsec_enable_chroot_caps,
39904 +               .maxlen         = sizeof(int),
39905 +               .mode           = 0600,
39906 +               .proc_handler   = &proc_dointvec,
39907 +       },
39908 +#endif
39909 +#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
39910 +       {
39911 +               .procname       = "chroot_deny_sysctl",
39912 +               .data           = &grsec_enable_chroot_sysctl,
39913 +               .maxlen         = sizeof(int),
39914 +               .mode           = 0600,
39915 +               .proc_handler   = &proc_dointvec,
39916 +       },
39917 +#endif
39918 +#ifdef CONFIG_GRKERNSEC_TPE
39919 +       {
39920 +               .procname       = "tpe",
39921 +               .data           = &grsec_enable_tpe,
39922 +               .maxlen         = sizeof(int),
39923 +               .mode           = 0600,
39924 +               .proc_handler   = &proc_dointvec,
39925 +       },
39926 +       {
39927 +               .procname       = "tpe_gid",
39928 +               .data           = &grsec_tpe_gid,
39929 +               .maxlen         = sizeof(int),
39930 +               .mode           = 0600,
39931 +               .proc_handler   = &proc_dointvec,
39932 +       },
39933 +#endif
39934 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
39935 +       {
39936 +               .procname       = "tpe_restrict_all",
39937 +               .data           = &grsec_enable_tpe_all,
39938 +               .maxlen         = sizeof(int),
39939 +               .mode           = 0600,
39940 +               .proc_handler   = &proc_dointvec,
39941 +       },
39942 +#endif
39943 +#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
39944 +       {
39945 +               .procname       = "socket_all",
39946 +               .data           = &grsec_enable_socket_all,
39947 +               .maxlen         = sizeof(int),
39948 +               .mode           = 0600,
39949 +               .proc_handler   = &proc_dointvec,
39950 +       },
39951 +       {
39952 +               .procname       = "socket_all_gid",
39953 +               .data           = &grsec_socket_all_gid,
39954 +               .maxlen         = sizeof(int),
39955 +               .mode           = 0600,
39956 +               .proc_handler   = &proc_dointvec,
39957 +       },
39958 +#endif
39959 +#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
39960 +       {
39961 +               .procname       = "socket_client",
39962 +               .data           = &grsec_enable_socket_client,
39963 +               .maxlen         = sizeof(int),
39964 +               .mode           = 0600,
39965 +               .proc_handler   = &proc_dointvec,
39966 +       },
39967 +       {
39968 +               .procname       = "socket_client_gid",
39969 +               .data           = &grsec_socket_client_gid,
39970 +               .maxlen         = sizeof(int),
39971 +               .mode           = 0600,
39972 +               .proc_handler   = &proc_dointvec,
39973 +       },
39974 +#endif
39975 +#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
39976 +       {
39977 +               .procname       = "socket_server",
39978 +               .data           = &grsec_enable_socket_server,
39979 +               .maxlen         = sizeof(int),
39980 +               .mode           = 0600,
39981 +               .proc_handler   = &proc_dointvec,
39982 +       },
39983 +       {
39984 +               .procname       = "socket_server_gid",
39985 +               .data           = &grsec_socket_server_gid,
39986 +               .maxlen         = sizeof(int),
39987 +               .mode           = 0600,
39988 +               .proc_handler   = &proc_dointvec,
39989 +       },
39990 +#endif
39991 +#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
39992 +       {
39993 +               .procname       = "audit_group",
39994 +               .data           = &grsec_enable_group,
39995 +               .maxlen         = sizeof(int),
39996 +               .mode           = 0600,
39997 +               .proc_handler   = &proc_dointvec,
39998 +       },
39999 +       {
40000 +               .procname       = "audit_gid",
40001 +               .data           = &grsec_audit_gid,
40002 +               .maxlen         = sizeof(int),
40003 +               .mode           = 0600,
40004 +               .proc_handler   = &proc_dointvec,
40005 +       },
40006 +#endif
40007 +#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
40008 +       {
40009 +               .procname       = "audit_chdir",
40010 +               .data           = &grsec_enable_chdir,
40011 +               .maxlen         = sizeof(int),
40012 +               .mode           = 0600,
40013 +               .proc_handler   = &proc_dointvec,
40014 +       },
40015 +#endif
40016 +#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
40017 +       {
40018 +               .procname       = "audit_mount",
40019 +               .data           = &grsec_enable_mount,
40020 +               .maxlen         = sizeof(int),
40021 +               .mode           = 0600,
40022 +               .proc_handler   = &proc_dointvec,
40023 +       },
40024 +#endif
40025 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
40026 +       {
40027 +               .procname       = "audit_textrel",
40028 +               .data           = &grsec_enable_audit_textrel,
40029 +               .maxlen         = sizeof(int),
40030 +               .mode           = 0600,
40031 +               .proc_handler   = &proc_dointvec,
40032 +       },
40033 +#endif
40034 +#ifdef CONFIG_GRKERNSEC_DMESG
40035 +       {
40036 +               .procname       = "dmesg",
40037 +               .data           = &grsec_enable_dmesg,
40038 +               .maxlen         = sizeof(int),
40039 +               .mode           = 0600,
40040 +               .proc_handler   = &proc_dointvec,
40041 +       },
40042 +#endif
40043 +#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
40044 +       {
40045 +               .procname       = "chroot_findtask",
40046 +               .data           = &grsec_enable_chroot_findtask,
40047 +               .maxlen         = sizeof(int),
40048 +               .mode           = 0600,
40049 +               .proc_handler   = &proc_dointvec,
40050 +       },
40051 +#endif
40052 +#ifdef CONFIG_GRKERNSEC_RESLOG
40053 +       {
40054 +               .procname       = "resource_logging",
40055 +               .data           = &grsec_resource_logging,
40056 +               .maxlen         = sizeof(int),
40057 +               .mode           = 0600,
40058 +               .proc_handler   = &proc_dointvec,
40059 +       },
40060 +#endif
40061 +#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
40062 +       {
40063 +               .procname       = "audit_ptrace",
40064 +               .data           = &grsec_enable_audit_ptrace,
40065 +               .maxlen         = sizeof(int),
40066 +               .mode           = 0600,
40067 +               .proc_handler   = &proc_dointvec,
40068 +       },
40069 +#endif
40070 +#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
40071 +       {
40072 +               .procname       = "harden_ptrace",
40073 +               .data           = &grsec_enable_harden_ptrace,
40074 +               .maxlen         = sizeof(int),
40075 +               .mode           = 0600,
40076 +               .proc_handler   = &proc_dointvec,
40077 +       },
40078 +#endif
40079 +       {
40080 +               .procname       = "grsec_lock",
40081 +               .data           = &grsec_lock,
40082 +               .maxlen         = sizeof(int),
40083 +               .mode           = 0600,
40084 +               .proc_handler   = &proc_dointvec,
40085 +       },
40086 +#endif
40087 +#ifdef CONFIG_GRKERNSEC_ROFS
40088 +       {
40089 +               .procname       = "romount_protect",
40090 +               .data           = &grsec_enable_rofs,
40091 +               .maxlen         = sizeof(int),
40092 +               .mode           = 0600,
40093 +               .proc_handler   = &proc_dointvec_minmax,
40094 +               .extra1         = &one,
40095 +               .extra2         = &one,
40096 +       },
40097 +#endif
40098 +       { }
40099 +};
40100 +#endif
40101 diff -urNp linux-2.6.33/grsecurity/grsec_textrel.c linux-2.6.33/grsecurity/grsec_textrel.c
40102 --- linux-2.6.33/grsecurity/grsec_textrel.c     1969-12-31 19:00:00.000000000 -0500
40103 +++ linux-2.6.33/grsecurity/grsec_textrel.c     2010-03-07 12:23:36.109671795 -0500
40104 @@ -0,0 +1,16 @@
40105 +#include <linux/kernel.h>
40106 +#include <linux/sched.h>
40107 +#include <linux/mm.h>
40108 +#include <linux/file.h>
40109 +#include <linux/grinternal.h>
40110 +#include <linux/grsecurity.h>
40111 +
40112 +void
40113 +gr_log_textrel(struct vm_area_struct * vma)
40114 +{
40115 +#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
40116 +       if (grsec_enable_audit_textrel)
40117 +               gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
40118 +#endif
40119 +       return;
40120 +}
40121 diff -urNp linux-2.6.33/grsecurity/grsec_time.c linux-2.6.33/grsecurity/grsec_time.c
40122 --- linux-2.6.33/grsecurity/grsec_time.c        1969-12-31 19:00:00.000000000 -0500
40123 +++ linux-2.6.33/grsecurity/grsec_time.c        2010-03-07 12:23:36.109671795 -0500
40124 @@ -0,0 +1,13 @@
40125 +#include <linux/kernel.h>
40126 +#include <linux/sched.h>
40127 +#include <linux/grinternal.h>
40128 +
40129 +void
40130 +gr_log_timechange(void)
40131 +{
40132 +#ifdef CONFIG_GRKERNSEC_TIME
40133 +       if (grsec_enable_time)
40134 +               gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
40135 +#endif
40136 +       return;
40137 +}
40138 diff -urNp linux-2.6.33/grsecurity/grsec_tpe.c linux-2.6.33/grsecurity/grsec_tpe.c
40139 --- linux-2.6.33/grsecurity/grsec_tpe.c 1969-12-31 19:00:00.000000000 -0500
40140 +++ linux-2.6.33/grsecurity/grsec_tpe.c 2010-03-07 12:23:36.109671795 -0500
40141 @@ -0,0 +1,38 @@
40142 +#include <linux/kernel.h>
40143 +#include <linux/sched.h>
40144 +#include <linux/file.h>
40145 +#include <linux/fs.h>
40146 +#include <linux/grinternal.h>
40147 +
40148 +extern int gr_acl_tpe_check(void);
40149 +
40150 +int
40151 +gr_tpe_allow(const struct file *file)
40152 +{
40153 +#ifdef CONFIG_GRKERNSEC
40154 +       struct inode *inode = file->f_path.dentry->d_parent->d_inode;
40155 +       const struct cred *cred = current_cred();
40156 +
40157 +       if (cred->uid && ((grsec_enable_tpe &&
40158 +#ifdef CONFIG_GRKERNSEC_TPE_INVERT
40159 +           !in_group_p(grsec_tpe_gid)
40160 +#else
40161 +           in_group_p(grsec_tpe_gid)
40162 +#endif
40163 +           ) || gr_acl_tpe_check()) &&
40164 +           (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
40165 +                                               (inode->i_mode & S_IWOTH))))) {
40166 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
40167 +               return 0;
40168 +       }
40169 +#ifdef CONFIG_GRKERNSEC_TPE_ALL
40170 +       if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
40171 +           ((inode->i_uid && (inode->i_uid != cred->uid)) ||
40172 +            (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
40173 +               gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
40174 +               return 0;
40175 +       }
40176 +#endif
40177 +#endif
40178 +       return 1;
40179 +}
40180 diff -urNp linux-2.6.33/grsecurity/grsum.c linux-2.6.33/grsecurity/grsum.c
40181 --- linux-2.6.33/grsecurity/grsum.c     1969-12-31 19:00:00.000000000 -0500
40182 +++ linux-2.6.33/grsecurity/grsum.c     2010-03-07 12:23:36.109671795 -0500
40183 @@ -0,0 +1,59 @@
40184 +#include <linux/err.h>
40185 +#include <linux/kernel.h>
40186 +#include <linux/sched.h>
40187 +#include <linux/mm.h>
40188 +#include <linux/scatterlist.h>
40189 +#include <linux/crypto.h>
40190 +#include <linux/gracl.h>
40191 +
40192 +
40193 +#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
40194 +#error "crypto and sha256 must be built into the kernel"
40195 +#endif
40196 +
40197 +int
40198 +chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
40199 +{
40200 +       char *p;
40201 +       struct crypto_hash *tfm;
40202 +       struct hash_desc desc;
40203 +       struct scatterlist sg;
40204 +       unsigned char temp_sum[GR_SHA_LEN];
40205 +       volatile int retval = 0;
40206 +       volatile int dummy = 0;
40207 +       unsigned int i;
40208 +
40209 +       tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
40210 +       if (IS_ERR(tfm)) {
40211 +               /* should never happen, since sha256 should be built in */
40212 +               return 1;
40213 +       }
40214 +
40215 +       desc.tfm = tfm;
40216 +       desc.flags = 0;
40217 +
40218 +       crypto_hash_init(&desc);
40219 +
40220 +       p = salt;
40221 +       sg_set_buf(&sg, p, GR_SALT_LEN);
40222 +       crypto_hash_update(&desc, &sg, sg.length);
40223 +
40224 +       p = entry->pw;
40225 +       sg_set_buf(&sg, p, strlen(p));
40226 +
40227 +       crypto_hash_update(&desc, &sg, sg.length);
40228 +
40229 +       crypto_hash_final(&desc, temp_sum);
40230 +
40231 +       memset(entry->pw, 0, GR_PW_LEN);
40232 +
40233 +       for (i = 0; i < GR_SHA_LEN; i++)
40234 +               if (sum[i] != temp_sum[i])
40235 +                       retval = 1;
40236 +               else
40237 +                       dummy = 1;      // waste a cycle
40238 +
40239 +       crypto_free_hash(tfm);
40240 +
40241 +       return retval;
40242 +}
40243 diff -urNp linux-2.6.33/grsecurity/Kconfig linux-2.6.33/grsecurity/Kconfig
40244 --- linux-2.6.33/grsecurity/Kconfig     1969-12-31 19:00:00.000000000 -0500
40245 +++ linux-2.6.33/grsecurity/Kconfig     2010-03-07 12:23:36.109671795 -0500
40246 @@ -0,0 +1,944 @@
40247 +#
40248 +# grecurity configuration
40249 +#
40250 +
40251 +menu "Grsecurity"
40252 +
40253 +config GRKERNSEC
40254 +       bool "Grsecurity"
40255 +       select CRYPTO
40256 +       select CRYPTO_SHA256
40257 +       help
40258 +         If you say Y here, you will be able to configure many features
40259 +         that will enhance the security of your system.  It is highly
40260 +         recommended that you say Y here and read through the help
40261 +         for each option so that you fully understand the features and
40262 +         can evaluate their usefulness for your machine.
40263 +
40264 +choice
40265 +       prompt "Security Level"
40266 +       depends on GRKERNSEC
40267 +       default GRKERNSEC_CUSTOM
40268 +
40269 +config GRKERNSEC_LOW
40270 +       bool "Low"
40271 +       select GRKERNSEC_LINK
40272 +       select GRKERNSEC_FIFO
40273 +       select GRKERNSEC_EXECVE
40274 +       select GRKERNSEC_RANDNET
40275 +       select GRKERNSEC_DMESG
40276 +       select GRKERNSEC_CHROOT
40277 +       select GRKERNSEC_CHROOT_CHDIR
40278 +
40279 +       help
40280 +         If you choose this option, several of the grsecurity options will
40281 +         be enabled that will give you greater protection against a number
40282 +         of attacks, while assuring that none of your software will have any
40283 +         conflicts with the additional security measures.  If you run a lot
40284 +         of unusual software, or you are having problems with the higher
40285 +         security levels, you should say Y here.  With this option, the
40286 +         following features are enabled:
40287 +
40288 +         - Linking restrictions
40289 +         - FIFO restrictions
40290 +         - Enforcing RLIMIT_NPROC on execve
40291 +         - Restricted dmesg
40292 +         - Enforced chdir("/") on chroot
40293 +         - Runtime module disabling
40294 +
40295 +config GRKERNSEC_MEDIUM
40296 +       bool "Medium"
40297 +       select PAX
40298 +       select PAX_EI_PAX
40299 +       select PAX_PT_PAX_FLAGS
40300 +       select PAX_HAVE_ACL_FLAGS
40301 +       select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
40302 +       select GRKERNSEC_CHROOT
40303 +       select GRKERNSEC_CHROOT_SYSCTL
40304 +       select GRKERNSEC_LINK
40305 +       select GRKERNSEC_FIFO
40306 +       select GRKERNSEC_EXECVE
40307 +       select GRKERNSEC_DMESG
40308 +       select GRKERNSEC_RANDNET
40309 +       select GRKERNSEC_FORKFAIL
40310 +       select GRKERNSEC_TIME
40311 +       select GRKERNSEC_SIGNAL
40312 +       select GRKERNSEC_CHROOT
40313 +       select GRKERNSEC_CHROOT_UNIX
40314 +       select GRKERNSEC_CHROOT_MOUNT
40315 +       select GRKERNSEC_CHROOT_PIVOT
40316 +       select GRKERNSEC_CHROOT_DOUBLE
40317 +       select GRKERNSEC_CHROOT_CHDIR
40318 +       select GRKERNSEC_CHROOT_MKNOD
40319 +       select GRKERNSEC_PROC
40320 +       select GRKERNSEC_PROC_USERGROUP
40321 +       select PAX_RANDUSTACK
40322 +       select PAX_ASLR
40323 +       select PAX_RANDMMAP
40324 +       select PAX_REFCOUNT if (X86 || SPARC64)
40325 +       select PAX_USERCOPY if ((X86 || SPARC32 || SPARC64 || PPC32 || PPC64) && (SLAB || SLUB || SLOB))
40326 +
40327 +       help
40328 +         If you say Y here, several features in addition to those included
40329 +         in the low additional security level will be enabled.  These
40330 +         features provide even more security to your system, though in rare
40331 +         cases they may be incompatible with very old or poorly written
40332 +         software.  If you enable this option, make sure that your auth
40333 +         service (identd) is running as gid 1001.  With this option,
40334 +         the following features (in addition to those provided in the
40335 +         low additional security level) will be enabled:
40336 +
40337 +         - Failed fork logging
40338 +         - Time change logging
40339 +         - Signal logging
40340 +         - Deny mounts in chroot
40341 +         - Deny double chrooting
40342 +         - Deny sysctl writes in chroot
40343 +         - Deny mknod in chroot
40344 +         - Deny access to abstract AF_UNIX sockets out of chroot
40345 +         - Deny pivot_root in chroot
40346 +         - Denied writes of /dev/kmem, /dev/mem, and /dev/port
40347 +         - /proc restrictions with special GID set to 10 (usually wheel)
40348 +         - Address Space Layout Randomization (ASLR)
40349 +         - Prevent exploitation of most refcount overflows
40350 +         - Bounds checking of copying between the kernel and userland
40351 +
40352 +config GRKERNSEC_HIGH
40353 +       bool "High"
40354 +       select GRKERNSEC_LINK
40355 +       select GRKERNSEC_FIFO
40356 +       select GRKERNSEC_EXECVE
40357 +       select GRKERNSEC_DMESG
40358 +       select GRKERNSEC_FORKFAIL
40359 +       select GRKERNSEC_TIME
40360 +       select GRKERNSEC_SIGNAL
40361 +       select GRKERNSEC_CHROOT
40362 +       select GRKERNSEC_CHROOT_SHMAT
40363 +       select GRKERNSEC_CHROOT_UNIX
40364 +       select GRKERNSEC_CHROOT_MOUNT
40365 +       select GRKERNSEC_CHROOT_FCHDIR
40366 +       select GRKERNSEC_CHROOT_PIVOT
40367 +       select GRKERNSEC_CHROOT_DOUBLE
40368 +       select GRKERNSEC_CHROOT_CHDIR
40369 +       select GRKERNSEC_CHROOT_MKNOD
40370 +       select GRKERNSEC_CHROOT_CAPS
40371 +       select GRKERNSEC_CHROOT_SYSCTL
40372 +       select GRKERNSEC_CHROOT_FINDTASK
40373 +       select GRKERNSEC_PROC
40374 +       select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
40375 +       select GRKERNSEC_HIDESYM
40376 +       select GRKERNSEC_BRUTE
40377 +       select GRKERNSEC_PROC_USERGROUP
40378 +       select GRKERNSEC_KMEM
40379 +       select GRKERNSEC_RESLOG
40380 +       select GRKERNSEC_RANDNET
40381 +       select GRKERNSEC_PROC_ADD
40382 +       select GRKERNSEC_CHROOT_CHMOD
40383 +       select GRKERNSEC_CHROOT_NICE
40384 +       select GRKERNSEC_AUDIT_MOUNT
40385 +       select GRKERNSEC_MODHARDEN if (MODULES)
40386 +       select GRKERNSEC_HARDEN_PTRACE
40387 +       select GRKERNSEC_VM86 if (X86_32)
40388 +       select PAX
40389 +       select PAX_RANDUSTACK
40390 +       select PAX_ASLR
40391 +       select PAX_RANDMMAP
40392 +       select PAX_NOEXEC
40393 +       select PAX_MPROTECT
40394 +       select PAX_EI_PAX
40395 +       select PAX_PT_PAX_FLAGS
40396 +       select PAX_HAVE_ACL_FLAGS
40397 +       select PAX_KERNEXEC if ((PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
40398 +       select PAX_MEMORY_UDEREF if (X86_32 && !XEN)
40399 +       select PAX_RANDKSTACK if (X86_TSC && !X86_64)
40400 +       select PAX_SEGMEXEC if (X86_32)
40401 +       select PAX_PAGEEXEC
40402 +       select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
40403 +       select PAX_EMUTRAMP if (PARISC)
40404 +       select PAX_EMUSIGRT if (PARISC)
40405 +       select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
40406 +       select PAX_REFCOUNT if (X86 || SPARC64)
40407 +       select PAX_USERCOPY if ((X86 || PPC32 || PPC64 || SPARC32 || SPARC64) && (SLAB || SLUB || SLOB))
40408 +       help
40409 +         If you say Y here, many of the features of grsecurity will be
40410 +         enabled, which will protect you against many kinds of attacks
40411 +         against your system.  The heightened security comes at a cost
40412 +         of an increased chance of incompatibilities with rare software
40413 +         on your machine.  Since this security level enables PaX, you should
40414 +         view <http://pax.grsecurity.net> and read about the PaX
40415 +         project.  While you are there, download chpax and run it on
40416 +         binaries that cause problems with PaX.  Also remember that
40417 +         since the /proc restrictions are enabled, you must run your
40418 +         identd as gid 1001.  This security level enables the following
40419 +         features in addition to those listed in the low and medium
40420 +         security levels:
40421 +
40422 +         - Additional /proc restrictions
40423 +         - Chmod restrictions in chroot
40424 +         - No signals, ptrace, or viewing of processes outside of chroot
40425 +         - Capability restrictions in chroot
40426 +         - Deny fchdir out of chroot
40427 +         - Priority restrictions in chroot
40428 +         - Segmentation-based implementation of PaX
40429 +         - Mprotect restrictions
40430 +         - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
40431 +         - Kernel stack randomization
40432 +         - Mount/unmount/remount logging
40433 +         - Kernel symbol hiding
40434 +         - Prevention of memory exhaustion-based exploits
40435 +         - Hardening of module auto-loading
40436 +         - Ptrace restrictions
40437 +         - Restricted vm86 mode
40438 +
40439 +config GRKERNSEC_CUSTOM
40440 +       bool "Custom"
40441 +       help
40442 +         If you say Y here, you will be able to configure every grsecurity
40443 +         option, which allows you to enable many more features that aren't
40444 +         covered in the basic security levels.  These additional features
40445 +         include TPE, socket restrictions, and the sysctl system for
40446 +         grsecurity.  It is advised that you read through the help for
40447 +         each option to determine its usefulness in your situation.
40448 +
40449 +endchoice
40450 +
40451 +menu "Address Space Protection"
40452 +depends on GRKERNSEC
40453 +
40454 +config GRKERNSEC_KMEM
40455 +       bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
40456 +       help
40457 +         If you say Y here, /dev/kmem and /dev/mem won't be allowed to
40458 +         be written to via mmap or otherwise to modify the running kernel.
40459 +         /dev/port will also not be allowed to be opened. If you have module
40460 +         support disabled, enabling this will close up four ways that are
40461 +         currently used  to insert malicious code into the running kernel.
40462 +         Even with all these features enabled, we still highly recommend that
40463 +         you use the RBAC system, as it is still possible for an attacker to
40464 +         modify the running kernel through privileged I/O granted by ioperm/iopl.
40465 +         If you are not using XFree86, you may be able to stop this additional
40466 +         case by enabling the 'Disable privileged I/O' option. Though nothing
40467 +         legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
40468 +         but only to video memory, which is the only writing we allow in this
40469 +         case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
40470 +         not be allowed to mprotect it with PROT_WRITE later.
40471 +         It is highly recommended that you say Y here if you meet all the
40472 +         conditions above.
40473 +
40474 +config GRKERNSEC_VM86
40475 +       bool "Restrict VM86 mode"
40476 +       depends on X86_32
40477 +
40478 +       help
40479 +         If you say Y here, only processes with CAP_SYS_RAWIO will be able to
40480 +         make use of a special execution mode on 32bit x86 processors called
40481 +         Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
40482 +         video cards and will still work with this option enabled.  The purpose
40483 +         of the option is to prevent exploitation of emulation errors in
40484 +         virtualization of vm86 mode like the one discovered in VMWare in 2009.
40485 +         Nearly all users should be able to enable this option.
40486 +
40487 +config GRKERNSEC_IO
40488 +       bool "Disable privileged I/O"
40489 +       depends on X86
40490 +       select RTC_CLASS
40491 +       select RTC_INTF_DEV
40492 +       select RTC_DRV_CMOS
40493 +
40494 +       help
40495 +         If you say Y here, all ioperm and iopl calls will return an error.
40496 +         Ioperm and iopl can be used to modify the running kernel.
40497 +         Unfortunately, some programs need this access to operate properly,
40498 +         the most notable of which are XFree86 and hwclock.  hwclock can be
40499 +         remedied by having RTC support in the kernel, so real-time
40500 +         clock support is enabled if this option is enabled, to ensure
40501 +         that hwclock operates correctly.  XFree86 still will not
40502 +         operate correctly with this option enabled, so DO NOT CHOOSE Y
40503 +         IF YOU USE XFree86.  If you use XFree86 and you still want to
40504 +         protect your kernel against modification, use the RBAC system.
40505 +
40506 +config GRKERNSEC_PROC_MEMMAP
40507 +       bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
40508 +       default y if (PAX_NOEXEC || PAX_ASLR)
40509 +       depends on PAX_NOEXEC || PAX_ASLR
40510 +       help
40511 +         If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
40512 +         give no information about the addresses of its mappings if
40513 +         PaX features that rely on random addresses are enabled on the task.
40514 +         If you use PaX it is greatly recommended that you say Y here as it
40515 +         closes up a hole that makes the full ASLR useless for suid
40516 +         binaries.
40517 +
40518 +config GRKERNSEC_BRUTE
40519 +       bool "Deter exploit bruteforcing"
40520 +       help
40521 +         If you say Y here, attempts to bruteforce exploits against forking
40522 +         daemons such as apache or sshd will be deterred.  When a child of a
40523 +         forking daemon is killed by PaX or crashes due to an illegal
40524 +         instruction, the parent process will be delayed 30 seconds upon every
40525 +         subsequent fork until the administrator is able to assess the
40526 +         situation and restart the daemon.  It is recommended that you also
40527 +         enable signal logging in the auditing section so that logs are
40528 +         generated when a process performs an illegal instruction.
40529 +
40530 +config GRKERNSEC_MODHARDEN
40531 +       bool "Harden module auto-loading"
40532 +       depends on MODULES
40533 +       help
40534 +         If you say Y here, module auto-loading in response to use of some
40535 +         feature implemented by an unloaded module will be restricted to
40536 +         root users.  Enabling this option helps defend against attacks
40537 +         by unprivileged users who abuse the auto-loading behavior to
40538 +         cause a vulnerable module to load that is then exploited.
40539 +
40540 +         If this option prevents a legitimate use of auto-loading for a
40541 +         non-root user, the administrator can execute modprobe manually
40542 +         with the exact name of the module mentioned in the alert log.
40543 +         Alternatively, the administrator can add the module to the list
40544 +         of modules loaded at boot by modifying init scripts.
40545 +
40546 +         Modification of init scripts will most likely be needed on
40547 +         Ubuntu servers with encrypted home directory support enabled,
40548 +         as the first non-root user logging in will cause the ecb(aes),
40549 +         ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
40550 +
40551 +config GRKERNSEC_HIDESYM
40552 +       bool "Hide kernel symbols"
40553 +       help
40554 +         If you say Y here, getting information on loaded modules, and
40555 +         displaying all kernel symbols through a syscall will be restricted
40556 +         to users with CAP_SYS_MODULE.  For software compatibility reasons,
40557 +         /proc/kallsyms will be restricted to the root user.  The RBAC
40558 +         system can hide that entry even from root.  Note that this option
40559 +         is only effective provided the following conditions are met:
40560 +         1) The kernel using grsecurity is not precompiled by some distribution
40561 +         2) You are using the RBAC system and hiding other files such as your
40562 +            kernel image and System.map.  Alternatively, enabling this option
40563 +            causes the permissions on /boot, /lib/modules, and the kernel
40564 +            source directory to change at compile time to prevent
40565 +            reading by non-root users.
40566 +         If the above conditions are met, this option will aid in providing a
40567 +         useful protection against local kernel exploitation of overflows
40568 +         and arbitrary read/write vulnerabilities.
40569 +
40570 +endmenu
40571 +menu "Role Based Access Control Options"
40572 +depends on GRKERNSEC
40573 +
40574 +config GRKERNSEC_NO_RBAC
40575 +       bool "Disable RBAC system"
40576 +       help
40577 +         If you say Y here, the /dev/grsec device will be removed from the kernel,
40578 +         preventing the RBAC system from being enabled.  You should only say Y
40579 +         here if you have no intention of using the RBAC system, so as to prevent
40580 +         an attacker with root access from misusing the RBAC system to hide files
40581 +         and processes when loadable module support and /dev/[k]mem have been
40582 +         locked down.
40583 +
40584 +config GRKERNSEC_ACL_HIDEKERN
40585 +       bool "Hide kernel processes"
40586 +       help
40587 +         If you say Y here, all kernel threads will be hidden to all
40588 +         processes but those whose subject has the "view hidden processes"
40589 +         flag.
40590 +
40591 +config GRKERNSEC_ACL_MAXTRIES
40592 +       int "Maximum tries before password lockout"
40593 +       default 3
40594 +       help
40595 +         This option enforces the maximum number of times a user can attempt
40596 +         to authorize themselves with the grsecurity RBAC system before being
40597 +         denied the ability to attempt authorization again for a specified time.
40598 +         The lower the number, the harder it will be to brute-force a password.
40599 +
40600 +config GRKERNSEC_ACL_TIMEOUT
40601 +       int "Time to wait after max password tries, in seconds"
40602 +       default 30
40603 +       help
40604 +         This option specifies the time the user must wait after attempting to
40605 +         authorize to the RBAC system with the maximum number of invalid
40606 +         passwords.  The higher the number, the harder it will be to brute-force
40607 +         a password.
40608 +
40609 +endmenu
40610 +menu "Filesystem Protections"
40611 +depends on GRKERNSEC
40612 +
40613 +config GRKERNSEC_PROC
40614 +       bool "Proc restrictions"
40615 +       help
40616 +         If you say Y here, the permissions of the /proc filesystem
40617 +         will be altered to enhance system security and privacy.  You MUST
40618 +         choose either a user only restriction or a user and group restriction.
40619 +         Depending upon the option you choose, you can either restrict users to
40620 +         see only the processes they themselves run, or choose a group that can
40621 +         view all processes and files normally restricted to root if you choose
40622 +         the "restrict to user only" option.  NOTE: If you're running identd as
40623 +         a non-root user, you will have to run it as the group you specify here.
40624 +
40625 +config GRKERNSEC_PROC_USER
40626 +       bool "Restrict /proc to user only"
40627 +       depends on GRKERNSEC_PROC
40628 +       help
40629 +         If you say Y here, non-root users will only be able to view their own
40630 +         processes, and restricts them from viewing network-related information,
40631 +         and viewing kernel symbol and module information.
40632 +
40633 +config GRKERNSEC_PROC_USERGROUP
40634 +       bool "Allow special group"
40635 +       depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
40636 +       help
40637 +         If you say Y here, you will be able to select a group that will be
40638 +         able to view all processes, network-related information, and
40639 +         kernel and symbol information.  This option is useful if you want
40640 +         to run identd as a non-root user.
40641 +
40642 +config GRKERNSEC_PROC_GID
40643 +       int "GID for special group"
40644 +       depends on GRKERNSEC_PROC_USERGROUP
40645 +       default 1001
40646 +
40647 +config GRKERNSEC_PROC_ADD
40648 +       bool "Additional restrictions"
40649 +       depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
40650 +       help
40651 +         If you say Y here, additional restrictions will be placed on
40652 +         /proc that keep normal users from viewing device information and
40653 +         slabinfo information that could be useful for exploits.
40654 +
40655 +config GRKERNSEC_LINK
40656 +       bool "Linking restrictions"
40657 +       help
40658 +         If you say Y here, /tmp race exploits will be prevented, since users
40659 +         will no longer be able to follow symlinks owned by other users in
40660 +         world-writable +t directories (i.e. /tmp), unless the owner of the
40661 +         symlink is the owner of the directory. users will also not be
40662 +         able to hardlink to files they do not own.  If the sysctl option is
40663 +         enabled, a sysctl option with name "linking_restrictions" is created.
40664 +
40665 +config GRKERNSEC_FIFO
40666 +       bool "FIFO restrictions"
40667 +       help
40668 +         If you say Y here, users will not be able to write to FIFOs they don't
40669 +         own in world-writable +t directories (i.e. /tmp), unless the owner of
40670 +         the FIFO is the same owner of the directory it's held in.  If the sysctl
40671 +         option is enabled, a sysctl option with name "fifo_restrictions" is
40672 +         created.
40673 +
40674 +config GRKERNSEC_ROFS
40675 +       bool "Runtime read-only mount protection"
40676 +       help
40677 +         If you say Y here, a sysctl option with name "romount_protect" will
40678 +         be created.  By setting this option to 1 at runtime, filesystems
40679 +         will be protected in the following ways:
40680 +         * No new writable mounts will be allowed
40681 +         * Existing read-only mounts won't be able to be remounted read/write
40682 +         * Write operations will be denied on all block devices
40683 +         This option acts independently of grsec_lock: once it is set to 1,
40684 +         it cannot be turned off.  Therefore, please be mindful of the resulting
40685 +         behavior if this option is enabled in an init script on a read-only
40686 +         filesystem.  This feature is mainly intended for secure embedded systems.
40687 +
40688 +config GRKERNSEC_CHROOT
40689 +       bool "Chroot jail restrictions"
40690 +       help
40691 +         If you say Y here, you will be able to choose several options that will
40692 +         make breaking out of a chrooted jail much more difficult.  If you
40693 +         encounter no software incompatibilities with the following options, it
40694 +         is recommended that you enable each one.
40695 +
40696 +config GRKERNSEC_CHROOT_MOUNT
40697 +       bool "Deny mounts"
40698 +       depends on GRKERNSEC_CHROOT
40699 +       help
40700 +         If you say Y here, processes inside a chroot will not be able to
40701 +         mount or remount filesystems.  If the sysctl option is enabled, a
40702 +         sysctl option with name "chroot_deny_mount" is created.
40703 +
40704 +config GRKERNSEC_CHROOT_DOUBLE
40705 +       bool "Deny double-chroots"
40706 +       depends on GRKERNSEC_CHROOT
40707 +       help
40708 +         If you say Y here, processes inside a chroot will not be able to chroot
40709 +         again outside the chroot.  This is a widely used method of breaking
40710 +         out of a chroot jail and should not be allowed.  If the sysctl
40711 +         option is enabled, a sysctl option with name
40712 +         "chroot_deny_chroot" is created.
40713 +
40714 +config GRKERNSEC_CHROOT_PIVOT
40715 +       bool "Deny pivot_root in chroot"
40716 +       depends on GRKERNSEC_CHROOT
40717 +       help
40718 +         If you say Y here, processes inside a chroot will not be able to use
40719 +         a function called pivot_root() that was introduced in Linux 2.3.41.  It
40720 +         works similar to chroot in that it changes the root filesystem.  This
40721 +         function could be misused in a chrooted process to attempt to break out
40722 +         of the chroot, and therefore should not be allowed.  If the sysctl
40723 +         option is enabled, a sysctl option with name "chroot_deny_pivot" is
40724 +         created.
40725 +
40726 +config GRKERNSEC_CHROOT_CHDIR
40727 +       bool "Enforce chdir(\"/\") on all chroots"
40728 +       depends on GRKERNSEC_CHROOT
40729 +       help
40730 +         If you say Y here, the current working directory of all newly-chrooted
40731 +         applications will be set to the the root directory of the chroot.
40732 +         The man page on chroot(2) states:
40733 +         Note that this call does not change  the  current  working
40734 +         directory,  so  that `.' can be outside the tree rooted at
40735 +         `/'.  In particular, the  super-user  can  escape  from  a
40736 +         `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
40737 +
40738 +         It is recommended that you say Y here, since it's not known to break
40739 +         any software.  If the sysctl option is enabled, a sysctl option with
40740 +         name "chroot_enforce_chdir" is created.
40741 +
40742 +config GRKERNSEC_CHROOT_CHMOD
40743 +       bool "Deny (f)chmod +s"
40744 +       depends on GRKERNSEC_CHROOT
40745 +       help
40746 +         If you say Y here, processes inside a chroot will not be able to chmod
40747 +         or fchmod files to make them have suid or sgid bits.  This protects
40748 +         against another published method of breaking a chroot.  If the sysctl
40749 +         option is enabled, a sysctl option with name "chroot_deny_chmod" is
40750 +         created.
40751 +
40752 +config GRKERNSEC_CHROOT_FCHDIR
40753 +       bool "Deny fchdir out of chroot"
40754 +       depends on GRKERNSEC_CHROOT
40755 +       help
40756 +         If you say Y here, a well-known method of breaking chroots by fchdir'ing
40757 +         to a file descriptor of the chrooting process that points to a directory
40758 +         outside the filesystem will be stopped.  If the sysctl option
40759 +         is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
40760 +
40761 +config GRKERNSEC_CHROOT_MKNOD
40762 +       bool "Deny mknod"
40763 +       depends on GRKERNSEC_CHROOT
40764 +       help
40765 +         If you say Y here, processes inside a chroot will not be allowed to
40766 +         mknod.  The problem with using mknod inside a chroot is that it
40767 +         would allow an attacker to create a device entry that is the same
40768 +         as one on the physical root of your system, which could range from
40769 +         anything from the console device to a device for your harddrive (which
40770 +         they could then use to wipe the drive or steal data).  It is recommended
40771 +         that you say Y here, unless you run into software incompatibilities.
40772 +         If the sysctl option is enabled, a sysctl option with name
40773 +         "chroot_deny_mknod" is created.
40774 +
40775 +config GRKERNSEC_CHROOT_SHMAT
40776 +       bool "Deny shmat() out of chroot"
40777 +       depends on GRKERNSEC_CHROOT
40778 +       help
40779 +         If you say Y here, processes inside a chroot will not be able to attach
40780 +         to shared memory segments that were created outside of the chroot jail.
40781 +         It is recommended that you say Y here.  If the sysctl option is enabled,
40782 +         a sysctl option with name "chroot_deny_shmat" is created.
40783 +
40784 +config GRKERNSEC_CHROOT_UNIX
40785 +       bool "Deny access to abstract AF_UNIX sockets out of chroot"
40786 +       depends on GRKERNSEC_CHROOT
40787 +       help
40788 +         If you say Y here, processes inside a chroot will not be able to
40789 +         connect to abstract (meaning not belonging to a filesystem) Unix
40790 +         domain sockets that were bound outside of a chroot.  It is recommended
40791 +         that you say Y here.  If the sysctl option is enabled, a sysctl option
40792 +         with name "chroot_deny_unix" is created.
40793 +
40794 +config GRKERNSEC_CHROOT_FINDTASK
40795 +       bool "Protect outside processes"
40796 +       depends on GRKERNSEC_CHROOT
40797 +       help
40798 +         If you say Y here, processes inside a chroot will not be able to
40799 +         kill, send signals with fcntl, ptrace, capget, getpgid, setpgid,
40800 +         getsid, or view any process outside of the chroot.  If the sysctl
40801 +         option is enabled, a sysctl option with name "chroot_findtask" is
40802 +         created.
40803 +
40804 +config GRKERNSEC_CHROOT_NICE
40805 +       bool "Restrict priority changes"
40806 +       depends on GRKERNSEC_CHROOT
40807 +       help
40808 +         If you say Y here, processes inside a chroot will not be able to raise
40809 +         the priority of processes in the chroot, or alter the priority of
40810 +         processes outside the chroot.  This provides more security than simply
40811 +         removing CAP_SYS_NICE from the process' capability set.  If the
40812 +         sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
40813 +         is created.
40814 +
40815 +config GRKERNSEC_CHROOT_SYSCTL
40816 +       bool "Deny sysctl writes"
40817 +       depends on GRKERNSEC_CHROOT
40818 +       help
40819 +         If you say Y here, an attacker in a chroot will not be able to
40820 +         write to sysctl entries, either by sysctl(2) or through a /proc
40821 +         interface.  It is strongly recommended that you say Y here. If the
40822 +         sysctl option is enabled, a sysctl option with name
40823 +         "chroot_deny_sysctl" is created.
40824 +
40825 +config GRKERNSEC_CHROOT_CAPS
40826 +       bool "Capability restrictions"
40827 +       depends on GRKERNSEC_CHROOT
40828 +       help
40829 +         If you say Y here, the capabilities on all root processes within a
40830 +         chroot jail will be lowered to stop module insertion, raw i/o,
40831 +         system and net admin tasks, rebooting the system, modifying immutable
40832 +         files, modifying IPC owned by another, and changing the system time.
40833 +         This is left an option because it can break some apps.  Disable this
40834 +         if your chrooted apps are having problems performing those kinds of
40835 +         tasks.  If the sysctl option is enabled, a sysctl option with
40836 +         name "chroot_caps" is created.
40837 +
40838 +endmenu
40839 +menu "Kernel Auditing"
40840 +depends on GRKERNSEC
40841 +
40842 +config GRKERNSEC_AUDIT_GROUP
40843 +       bool "Single group for auditing"
40844 +       help
40845 +         If you say Y here, the exec, chdir, and (un)mount logging features
40846 +         will only operate on a group you specify.  This option is recommended
40847 +         if you only want to watch certain users instead of having a large
40848 +         amount of logs from the entire system.  If the sysctl option is enabled,
40849 +         a sysctl option with name "audit_group" is created.
40850 +
40851 +config GRKERNSEC_AUDIT_GID
40852 +       int "GID for auditing"
40853 +       depends on GRKERNSEC_AUDIT_GROUP
40854 +       default 1007
40855 +
40856 +config GRKERNSEC_EXECLOG
40857 +       bool "Exec logging"
40858 +       help
40859 +         If you say Y here, all execve() calls will be logged (since the
40860 +         other exec*() calls are frontends to execve(), all execution
40861 +         will be logged).  Useful for shell-servers that like to keep track
40862 +         of their users.  If the sysctl option is enabled, a sysctl option with
40863 +         name "exec_logging" is created.
40864 +         WARNING: This option when enabled will produce a LOT of logs, especially
40865 +         on an active system.
40866 +
40867 +config GRKERNSEC_RESLOG
40868 +       bool "Resource logging"
40869 +       help
40870 +         If you say Y here, all attempts to overstep resource limits will
40871 +         be logged with the resource name, the requested size, and the current
40872 +         limit.  It is highly recommended that you say Y here.  If the sysctl
40873 +         option is enabled, a sysctl option with name "resource_logging" is
40874 +         created.  If the RBAC system is enabled, the sysctl value is ignored.
40875 +
40876 +config GRKERNSEC_CHROOT_EXECLOG
40877 +       bool "Log execs within chroot"
40878 +       help
40879 +         If you say Y here, all executions inside a chroot jail will be logged
40880 +         to syslog.  This can cause a large amount of logs if certain
40881 +         applications (eg. djb's daemontools) are installed on the system, and
40882 +         is therefore left as an option.  If the sysctl option is enabled, a
40883 +         sysctl option with name "chroot_execlog" is created.
40884 +
40885 +config GRKERNSEC_AUDIT_PTRACE
40886 +       bool "Ptrace logging"
40887 +       help
40888 +         If you say Y here, all attempts to attach to a process via ptrace
40889 +         will be logged.  If the sysctl option is enabled, a sysctl option
40890 +         with name "audit_ptrace" is created.
40891 +
40892 +config GRKERNSEC_AUDIT_CHDIR
40893 +       bool "Chdir logging"
40894 +       help
40895 +         If you say Y here, all chdir() calls will be logged.  If the sysctl
40896 +         option is enabled, a sysctl option with name "audit_chdir" is created.
40897 +
40898 +config GRKERNSEC_AUDIT_MOUNT
40899 +       bool "(Un)Mount logging"
40900 +       help
40901 +         If you say Y here, all mounts and unmounts will be logged.  If the
40902 +         sysctl option is enabled, a sysctl option with name "audit_mount" is
40903 +         created.
40904 +
40905 +config GRKERNSEC_SIGNAL
40906 +       bool "Signal logging"
40907 +       help
40908 +         If you say Y here, certain important signals will be logged, such as
40909 +         SIGSEGV, which will as a result inform you of when a error in a program
40910 +         occurred, which in some cases could mean a possible exploit attempt.
40911 +         If the sysctl option is enabled, a sysctl option with name
40912 +         "signal_logging" is created.
40913 +
40914 +config GRKERNSEC_FORKFAIL
40915 +       bool "Fork failure logging"
40916 +       help
40917 +         If you say Y here, all failed fork() attempts will be logged.
40918 +         This could suggest a fork bomb, or someone attempting to overstep
40919 +         their process limit.  If the sysctl option is enabled, a sysctl option
40920 +         with name "forkfail_logging" is created.
40921 +
40922 +config GRKERNSEC_TIME
40923 +       bool "Time change logging"
40924 +       help
40925 +         If you say Y here, any changes of the system clock will be logged.
40926 +         If the sysctl option is enabled, a sysctl option with name
40927 +         "timechange_logging" is created.
40928 +
40929 +config GRKERNSEC_PROC_IPADDR
40930 +       bool "/proc/<pid>/ipaddr support"
40931 +       help
40932 +         If you say Y here, a new entry will be added to each /proc/<pid>
40933 +         directory that contains the IP address of the person using the task.
40934 +         The IP is carried across local TCP and AF_UNIX stream sockets.
40935 +         This information can be useful for IDS/IPSes to perform remote response
40936 +         to a local attack.  The entry is readable by only the owner of the
40937 +         process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
40938 +         the RBAC system), and thus does not create privacy concerns.
40939 +
40940 +config GRKERNSEC_AUDIT_TEXTREL
40941 +       bool 'ELF text relocations logging (READ HELP)'
40942 +       depends on PAX_MPROTECT
40943 +       help
40944 +         If you say Y here, text relocations will be logged with the filename
40945 +         of the offending library or binary.  The purpose of the feature is
40946 +         to help Linux distribution developers get rid of libraries and
40947 +         binaries that need text relocations which hinder the future progress
40948 +         of PaX.  Only Linux distribution developers should say Y here, and
40949 +         never on a production machine, as this option creates an information
40950 +         leak that could aid an attacker in defeating the randomization of
40951 +         a single memory region.  If the sysctl option is enabled, a sysctl
40952 +         option with name "audit_textrel" is created.
40953 +
40954 +endmenu
40955 +
40956 +menu "Executable Protections"
40957 +depends on GRKERNSEC
40958 +
40959 +config GRKERNSEC_EXECVE
40960 +       bool "Enforce RLIMIT_NPROC on execs"
40961 +       help
40962 +         If you say Y here, users with a resource limit on processes will
40963 +         have the value checked during execve() calls.  The current system
40964 +         only checks the system limit during fork() calls.  If the sysctl option
40965 +         is enabled, a sysctl option with name "execve_limiting" is created.
40966 +
40967 +config GRKERNSEC_DMESG
40968 +       bool "Dmesg(8) restriction"
40969 +       help
40970 +         If you say Y here, non-root users will not be able to use dmesg(8)
40971 +         to view up to the last 4kb of messages in the kernel's log buffer.
40972 +         If the sysctl option is enabled, a sysctl option with name "dmesg" is
40973 +         created.
40974 +
40975 +config GRKERNSEC_HARDEN_PTRACE
40976 +       bool "Deter ptrace-based process snooping"
40977 +       help
40978 +         If you say Y here, TTY sniffers and other malicious monitoring
40979 +         programs implemented through ptrace will be defeated.  If you
40980 +         have been using the RBAC system, this option has already been
40981 +         enabled for several years for all users, with the ability to make
40982 +         fine-grained exceptions.
40983 +
40984 +         This option only affects the ability of non-root users to ptrace
40985 +         processes that are not a descendent of the ptracing process.
40986 +         This means that strace ./binary and gdb ./binary will still work,
40987 +         but attaching to arbitrary processes will not.  If the sysctl
40988 +         option is enabled, a sysctl option with name "harden_ptrace" is
40989 +         created.
40990 +
40991 +config GRKERNSEC_TPE
40992 +       bool "Trusted Path Execution (TPE)"
40993 +       help
40994 +         If you say Y here, you will be able to choose a gid to add to the
40995 +         supplementary groups of users you want to mark as "untrusted."
40996 +         These users will not be able to execute any files that are not in
40997 +         root-owned directories writable only by root.  If the sysctl option
40998 +         is enabled, a sysctl option with name "tpe" is created.
40999 +
41000 +config GRKERNSEC_TPE_ALL
41001 +       bool "Partially restrict non-root users"
41002 +       depends on GRKERNSEC_TPE
41003 +       help
41004 +         If you say Y here, All non-root users other than the ones in the
41005 +         group specified in the main TPE option will only be allowed to
41006 +         execute files in directories they own that are not group or
41007 +         world-writable, or in directories owned by root and writable only by
41008 +         root.  If the sysctl option is enabled, a sysctl option with name
41009 +         "tpe_restrict_all" is created.
41010 +
41011 +config GRKERNSEC_TPE_INVERT
41012 +       bool "Invert GID option"
41013 +       depends on GRKERNSEC_TPE
41014 +       help
41015 +         If you say Y here, the group you specify in the TPE configuration will
41016 +         decide what group TPE restrictions will be *disabled* for.  This
41017 +         option is useful if you want TPE restrictions to be applied to most
41018 +         users on the system.
41019 +
41020 +config GRKERNSEC_TPE_GID
41021 +       int "GID for untrusted users"
41022 +       depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
41023 +       default 1005
41024 +       help
41025 +         If you have selected the "Invert GID option" above, setting this
41026 +         GID determines what group TPE restrictions will be *disabled* for.
41027 +         If you have not selected the "Invert GID option" above, setting this
41028 +         GID determines what group TPE restrictions will be *enabled* for.
41029 +         If the sysctl option is enabled, a sysctl option with name "tpe_gid"
41030 +         is created.
41031 +
41032 +config GRKERNSEC_TPE_GID
41033 +       int "GID for trusted users"
41034 +       depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
41035 +       default 1005
41036 +       help
41037 +         If you have selected the "Invert GID option" above, setting this
41038 +         GID determines what group TPE restrictions will be *disabled* for.
41039 +         If you have not selected the "Invert GID option" above, setting this
41040 +         GID determines what group TPE restrictions will be *enabled* for.
41041 +         If the sysctl option is enabled, a sysctl option with name "tpe_gid"
41042 +         is created.
41043 +
41044 +endmenu
41045 +menu "Network Protections"
41046 +depends on GRKERNSEC
41047 +
41048 +config GRKERNSEC_RANDNET
41049 +       bool "Larger entropy pools"
41050 +       help
41051 +         If you say Y here, the entropy pools used for many features of Linux
41052 +         and grsecurity will be doubled in size.  Since several grsecurity
41053 +         features use additional randomness, it is recommended that you say Y
41054 +         here.  Saying Y here has a similar effect as modifying
41055 +         /proc/sys/kernel/random/poolsize.
41056 +
41057 +config GRKERNSEC_BLACKHOLE
41058 +       bool "TCP/UDP blackhole"
41059 +       help
41060 +         If you say Y here, neither TCP resets nor ICMP
41061 +         destination-unreachable packets will be sent in response to packets
41062 +         send to ports for which no associated listening process exists.
41063 +         This feature supports both IPV4 and IPV6 and exempts the
41064 +         loopback interface from blackholing.  Enabling this feature
41065 +         makes a host more resilient to DoS attacks and reduces network
41066 +         visibility against scanners.
41067 +
41068 +config GRKERNSEC_SOCKET
41069 +       bool "Socket restrictions"
41070 +       help
41071 +         If you say Y here, you will be able to choose from several options.
41072 +         If you assign a GID on your system and add it to the supplementary
41073 +         groups of users you want to restrict socket access to, this patch
41074 +         will perform up to three things, based on the option(s) you choose.
41075 +
41076 +config GRKERNSEC_SOCKET_ALL
41077 +       bool "Deny any sockets to group"
41078 +       depends on GRKERNSEC_SOCKET
41079 +       help
41080 +         If you say Y here, you will be able to choose a GID of whose users will
41081 +         be unable to connect to other hosts from your machine or run server
41082 +         applications from your machine.  If the sysctl option is enabled, a
41083 +         sysctl option with name "socket_all" is created.
41084 +
41085 +config GRKERNSEC_SOCKET_ALL_GID
41086 +       int "GID to deny all sockets for"
41087 +       depends on GRKERNSEC_SOCKET_ALL
41088 +       default 1004
41089 +       help
41090 +         Here you can choose the GID to disable socket access for. Remember to
41091 +         add the users you want socket access disabled for to the GID
41092 +         specified here.  If the sysctl option is enabled, a sysctl option
41093 +         with name "socket_all_gid" is created.
41094 +
41095 +config GRKERNSEC_SOCKET_CLIENT
41096 +       bool "Deny client sockets to group"
41097 +       depends on GRKERNSEC_SOCKET
41098 +       help
41099 +         If you say Y here, you will be able to choose a GID of whose users will
41100 +         be unable to connect to other hosts from your machine, but will be
41101 +         able to run servers.  If this option is enabled, all users in the group
41102 +         you specify will have to use passive mode when initiating ftp transfers
41103 +         from the shell on your machine.  If the sysctl option is enabled, a
41104 +         sysctl option with name "socket_client" is created.
41105 +
41106 +config GRKERNSEC_SOCKET_CLIENT_GID
41107 +       int "GID to deny client sockets for"
41108 +       depends on GRKERNSEC_SOCKET_CLIENT
41109 +       default 1003
41110 +       help
41111 +         Here you can choose the GID to disable client socket access for.
41112 +         Remember to add the users you want client socket access disabled for to
41113 +         the GID specified here.  If the sysctl option is enabled, a sysctl
41114 +         option with name "socket_client_gid" is created.
41115 +
41116 +config GRKERNSEC_SOCKET_SERVER
41117 +       bool "Deny server sockets to group"
41118 +       depends on GRKERNSEC_SOCKET
41119 +       help
41120 +         If you say Y here, you will be able to choose a GID of whose users will
41121 +         be unable to run server applications from your machine.  If the sysctl
41122 +         option is enabled, a sysctl option with name "socket_server" is created.
41123 +
41124 +config GRKERNSEC_SOCKET_SERVER_GID
41125 +       int "GID to deny server sockets for"
41126 +       depends on GRKERNSEC_SOCKET_SERVER
41127 +       default 1002
41128 +       help
41129 +         Here you can choose the GID to disable server socket access for.
41130 +         Remember to add the users you want server socket access disabled for to
41131 +         the GID specified here.  If the sysctl option is enabled, a sysctl
41132 +         option with name "socket_server_gid" is created.
41133 +
41134 +endmenu
41135 +menu "Sysctl support"
41136 +depends on GRKERNSEC && SYSCTL
41137 +
41138 +config GRKERNSEC_SYSCTL
41139 +       bool "Sysctl support"
41140 +       help
41141 +         If you say Y here, you will be able to change the options that
41142 +         grsecurity runs with at bootup, without having to recompile your
41143 +         kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
41144 +         to enable (1) or disable (0) various features.  All the sysctl entries
41145 +         are mutable until the "grsec_lock" entry is set to a non-zero value.
41146 +         All features enabled in the kernel configuration are disabled at boot
41147 +         if you do not say Y to the "Turn on features by default" option.
41148 +         All options should be set at startup, and the grsec_lock entry should
41149 +         be set to a non-zero value after all the options are set.
41150 +         *THIS IS EXTREMELY IMPORTANT*
41151 +
41152 +config GRKERNSEC_SYSCTL_ON
41153 +       bool "Turn on features by default"
41154 +       depends on GRKERNSEC_SYSCTL
41155 +       help
41156 +         If you say Y here, instead of having all features enabled in the
41157 +         kernel configuration disabled at boot time, the features will be
41158 +         enabled at boot time.  It is recommended you say Y here unless
41159 +         there is some reason you would want all sysctl-tunable features to
41160 +         be disabled by default.  As mentioned elsewhere, it is important
41161 +         to enable the grsec_lock entry once you have finished modifying
41162 +         the sysctl entries.
41163 +
41164 +endmenu
41165 +menu "Logging Options"
41166 +depends on GRKERNSEC
41167 +
41168 +config GRKERNSEC_FLOODTIME
41169 +       int "Seconds in between log messages (minimum)"
41170 +       default 10
41171 +       help
41172 +         This option allows you to enforce the number of seconds between
41173 +         grsecurity log messages.  The default should be suitable for most
41174 +         people, however, if you choose to change it, choose a value small enough
41175 +         to allow informative logs to be produced, but large enough to
41176 +         prevent flooding.
41177 +
41178 +config GRKERNSEC_FLOODBURST
41179 +       int "Number of messages in a burst (maximum)"
41180 +       default 4
41181 +       help
41182 +         This option allows you to choose the maximum number of messages allowed
41183 +         within the flood time interval you chose in a separate option.  The
41184 +         default should be suitable for most people, however if you find that
41185 +         many of your logs are being interpreted as flooding, you may want to
41186 +         raise this value.
41187 +
41188 +endmenu
41189 +
41190 +endmenu
41191 diff -urNp linux-2.6.33/grsecurity/Makefile linux-2.6.33/grsecurity/Makefile
41192 --- linux-2.6.33/grsecurity/Makefile    1969-12-31 19:00:00.000000000 -0500
41193 +++ linux-2.6.33/grsecurity/Makefile    2010-03-07 12:23:36.109671795 -0500
41194 @@ -0,0 +1,29 @@
41195 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
41196 +# during 2001-2009 it has been completely redesigned by Brad Spengler
41197 +# into an RBAC system
41198 +#
41199 +# All code in this directory and various hooks inserted throughout the kernel
41200 +# are copyright Brad Spengler - Open Source Security, Inc., and released
41201 +# under the GPL v2 or higher
41202 +
41203 +obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
41204 +       grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
41205 +       grsec_time.o grsec_tpe.o grsec_link.o grsec_textrel.o grsec_ptrace.o
41206 +
41207 +obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_ip.o gracl_segv.o \
41208 +       gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
41209 +       gracl_learn.o grsec_log.o
41210 +obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
41211 +
41212 +ifndef CONFIG_GRKERNSEC
41213 +obj-y += grsec_disabled.o
41214 +endif
41215 +
41216 +ifdef CONFIG_GRKERNSEC_HIDESYM
41217 +extra-y := grsec_hidesym.o
41218 +$(obj)/grsec_hidesym.o:
41219 +       @-chmod -f 500 /boot
41220 +       @-chmod -f 500 /lib/modules
41221 +       @-chmod -f 700 .
41222 +       @echo '  grsec: protected kernel image paths'
41223 +endif
41224 diff -urNp linux-2.6.33/include/acpi/acpi_drivers.h linux-2.6.33/include/acpi/acpi_drivers.h
41225 --- linux-2.6.33/include/acpi/acpi_drivers.h    2010-02-24 13:52:17.000000000 -0500
41226 +++ linux-2.6.33/include/acpi/acpi_drivers.h    2010-03-07 12:23:36.109671795 -0500
41227 @@ -119,8 +119,8 @@ int acpi_processor_set_thermal_limit(acp
41228                                    Dock Station
41229    -------------------------------------------------------------------------- */
41230  struct acpi_dock_ops {
41231 -       acpi_notify_handler handler;
41232 -       acpi_notify_handler uevent;
41233 +       const acpi_notify_handler handler;
41234 +       const acpi_notify_handler uevent;
41235  };
41236
41237  #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
41238 @@ -128,7 +128,7 @@ extern int is_dock_device(acpi_handle ha
41239  extern int register_dock_notifier(struct notifier_block *nb);
41240  extern void unregister_dock_notifier(struct notifier_block *nb);
41241  extern int register_hotplug_dock_device(acpi_handle handle,
41242 -                                       struct acpi_dock_ops *ops,
41243 +                                       const struct acpi_dock_ops *ops,
41244                                         void *context);
41245  extern void unregister_hotplug_dock_device(acpi_handle handle);
41246  #else
41247 @@ -144,7 +144,7 @@ static inline void unregister_dock_notif
41248  {
41249  }
41250  static inline int register_hotplug_dock_device(acpi_handle handle,
41251 -                                              struct acpi_dock_ops *ops,
41252 +                                              const struct acpi_dock_ops *ops,
41253                                                void *context)
41254  {
41255         return -ENODEV;
41256 diff -urNp linux-2.6.33/include/asm-generic/atomic-long.h linux-2.6.33/include/asm-generic/atomic-long.h
41257 --- linux-2.6.33/include/asm-generic/atomic-long.h      2010-02-24 13:52:17.000000000 -0500
41258 +++ linux-2.6.33/include/asm-generic/atomic-long.h      2010-03-07 12:23:36.113714966 -0500
41259 @@ -22,6 +22,12 @@
41260
41261  typedef atomic64_t atomic_long_t;
41262
41263 +#ifdef CONFIG_PAX_REFCOUNT
41264 +typedef atomic64_unchecked_t atomic_long_unchecked_t;
41265 +#else
41266 +typedef atomic64_t atomic_long_unchecked_t;
41267 +#endif
41268 +
41269  #define ATOMIC_LONG_INIT(i)    ATOMIC64_INIT(i)
41270
41271  static inline long atomic_long_read(atomic_long_t *l)
41272 @@ -31,6 +37,15 @@ static inline long atomic_long_read(atom
41273         return (long)atomic64_read(v);
41274  }
41275
41276 +#ifdef CONFIG_PAX_REFCOUNT
41277 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
41278 +{
41279 +       atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
41280 +
41281 +       return (long)atomic64_read_unchecked(v);
41282 +}
41283 +#endif
41284 +
41285  static inline void atomic_long_set(atomic_long_t *l, long i)
41286  {
41287         atomic64_t *v = (atomic64_t *)l;
41288 @@ -38,6 +53,15 @@ static inline void atomic_long_set(atomi
41289         atomic64_set(v, i);
41290  }
41291
41292 +#ifdef CONFIG_PAX_REFCOUNT
41293 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
41294 +{
41295 +       atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
41296 +
41297 +       atomic64_set_unchecked(v, i);
41298 +}
41299 +#endif
41300 +
41301  static inline void atomic_long_inc(atomic_long_t *l)
41302  {
41303         atomic64_t *v = (atomic64_t *)l;
41304 @@ -45,6 +69,15 @@ static inline void atomic_long_inc(atomi
41305         atomic64_inc(v);
41306  }
41307
41308 +#ifdef CONFIG_PAX_REFCOUNT
41309 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
41310 +{
41311 +       atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
41312 +
41313 +       atomic64_inc_unchecked(v);
41314 +}
41315 +#endif
41316 +
41317  static inline void atomic_long_dec(atomic_long_t *l)
41318  {
41319         atomic64_t *v = (atomic64_t *)l;
41320 @@ -59,6 +92,15 @@ static inline void atomic_long_add(long
41321         atomic64_add(i, v);
41322  }
41323
41324 +#ifdef CONFIG_PAX_REFCOUNT
41325 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
41326 +{
41327 +       atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
41328 +
41329 +       atomic64_add_unchecked(i, v);
41330 +}
41331 +#endif
41332 +
41333  static inline void atomic_long_sub(long i, atomic_long_t *l)
41334  {
41335         atomic64_t *v = (atomic64_t *)l;
41336 @@ -115,6 +157,15 @@ static inline long atomic_long_inc_retur
41337         return (long)atomic64_inc_return(v);
41338  }
41339
41340 +#ifdef CONFIG_PAX_REFCOUNT
41341 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
41342 +{
41343 +       atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
41344 +
41345 +       return (long)atomic64_inc_return_unchecked(v);
41346 +}
41347 +#endif
41348 +
41349  static inline long atomic_long_dec_return(atomic_long_t *l)
41350  {
41351         atomic64_t *v = (atomic64_t *)l;
41352 @@ -140,6 +191,12 @@ static inline long atomic_long_add_unles
41353
41354  typedef atomic_t atomic_long_t;
41355
41356 +#ifdef CONFIG_PAX_REFCOUNT
41357 +typedef atomic_unchecked_t atomic_long_unchecked_t;
41358 +#else
41359 +typedef atomic_t atomic_long_unchecked_t;
41360 +#endif
41361 +
41362  #define ATOMIC_LONG_INIT(i)    ATOMIC_INIT(i)
41363  static inline long atomic_long_read(atomic_long_t *l)
41364  {
41365 @@ -148,6 +205,15 @@ static inline long atomic_long_read(atom
41366         return (long)atomic_read(v);
41367  }
41368
41369 +#ifdef CONFIG_PAX_REFCOUNT
41370 +static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
41371 +{
41372 +       atomic_unchecked_t *v = (atomic_unchecked_t *)l;
41373 +
41374 +       return (long)atomic_read_unchecked(v);
41375 +}
41376 +#endif
41377 +
41378  static inline void atomic_long_set(atomic_long_t *l, long i)
41379  {
41380         atomic_t *v = (atomic_t *)l;
41381 @@ -155,6 +221,15 @@ static inline void atomic_long_set(atomi
41382         atomic_set(v, i);
41383  }
41384
41385 +#ifdef CONFIG_PAX_REFCOUNT
41386 +static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
41387 +{
41388 +       atomic_unchecked_t *v = (atomic_unchecked_t *)l;
41389 +
41390 +       atomic_set_unchecked(v, i);
41391 +}
41392 +#endif
41393 +
41394  static inline void atomic_long_inc(atomic_long_t *l)
41395  {
41396         atomic_t *v = (atomic_t *)l;
41397 @@ -162,6 +237,15 @@ static inline void atomic_long_inc(atomi
41398         atomic_inc(v);
41399  }
41400
41401 +#ifdef CONFIG_PAX_REFCOUNT
41402 +static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
41403 +{
41404 +       atomic_unchecked_t *v = (atomic_unchecked_t *)l;
41405 +
41406 +       atomic_inc_unchecked(v);
41407 +}
41408 +#endif
41409 +
41410  static inline void atomic_long_dec(atomic_long_t *l)
41411  {
41412         atomic_t *v = (atomic_t *)l;
41413 @@ -176,6 +260,15 @@ static inline void atomic_long_add(long
41414         atomic_add(i, v);
41415  }
41416
41417 +#ifdef CONFIG_PAX_REFCOUNT
41418 +static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
41419 +{
41420 +       atomic_unchecked_t *v = (atomic_unchecked_t *)l;
41421 +
41422 +       atomic_add_unchecked(i, v);
41423 +}
41424 +#endif
41425 +
41426  static inline void atomic_long_sub(long i, atomic_long_t *l)
41427  {
41428         atomic_t *v = (atomic_t *)l;
41429 @@ -232,6 +325,15 @@ static inline long atomic_long_inc_retur
41430         return (long)atomic_inc_return(v);
41431  }
41432
41433 +#ifdef CONFIG_PAX_REFCOUNT
41434 +static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
41435 +{
41436 +       atomic_unchecked_t *v = (atomic_unchecked_t *)l;
41437 +
41438 +       return (long)atomic_inc_return_unchecked(v);
41439 +}
41440 +#endif
41441 +
41442  static inline long atomic_long_dec_return(atomic_long_t *l)
41443  {
41444         atomic_t *v = (atomic_t *)l;
41445 @@ -255,4 +357,33 @@ static inline long atomic_long_add_unles
41446
41447  #endif  /*  BITS_PER_LONG == 64  */
41448
41449 +#ifdef CONFIG_PAX_REFCOUNT
41450 +static inline void pax_refcount_needs_these_functions(void)
41451 +{
41452 +       atomic_read_unchecked((atomic_unchecked_t *)NULL);
41453 +       atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
41454 +       atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
41455 +       atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
41456 +       atomic_inc_unchecked((atomic_unchecked_t *)NULL);
41457 +
41458 +       atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
41459 +       atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
41460 +       atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
41461 +       atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
41462 +       atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
41463 +}
41464 +#else
41465 +#define atomic_read_unchecked(v) atomic_read(v)
41466 +#define atomic_set_unchecked(v, i) atomic_set((v), (i))
41467 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
41468 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
41469 +#define atomic_inc_unchecked(v) atomic_inc(v)
41470 +
41471 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
41472 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
41473 +#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
41474 +#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
41475 +#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
41476 +#endif
41477 +
41478  #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
41479 diff -urNp linux-2.6.33/include/asm-generic/dma-mapping-common.h linux-2.6.33/include/asm-generic/dma-mapping-common.h
41480 --- linux-2.6.33/include/asm-generic/dma-mapping-common.h       2010-02-24 13:52:17.000000000 -0500
41481 +++ linux-2.6.33/include/asm-generic/dma-mapping-common.h       2010-03-07 12:23:36.113714966 -0500
41482 @@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
41483                                               enum dma_data_direction dir,
41484                                               struct dma_attrs *attrs)
41485  {
41486 -       struct dma_map_ops *ops = get_dma_ops(dev);
41487 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41488         dma_addr_t addr;
41489
41490         kmemcheck_mark_initialized(ptr, size);
41491 @@ -30,7 +30,7 @@ static inline void dma_unmap_single_attr
41492                                           enum dma_data_direction dir,
41493                                           struct dma_attrs *attrs)
41494  {
41495 -       struct dma_map_ops *ops = get_dma_ops(dev);
41496 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41497
41498         BUG_ON(!valid_dma_direction(dir));
41499         if (ops->unmap_page)
41500 @@ -42,7 +42,7 @@ static inline int dma_map_sg_attrs(struc
41501                                    int nents, enum dma_data_direction dir,
41502                                    struct dma_attrs *attrs)
41503  {
41504 -       struct dma_map_ops *ops = get_dma_ops(dev);
41505 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41506         int i, ents;
41507         struct scatterlist *s;
41508
41509 @@ -59,7 +59,7 @@ static inline void dma_unmap_sg_attrs(st
41510                                       int nents, enum dma_data_direction dir,
41511                                       struct dma_attrs *attrs)
41512  {
41513 -       struct dma_map_ops *ops = get_dma_ops(dev);
41514 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41515
41516         BUG_ON(!valid_dma_direction(dir));
41517         debug_dma_unmap_sg(dev, sg, nents, dir);
41518 @@ -71,7 +71,7 @@ static inline dma_addr_t dma_map_page(st
41519                                       size_t offset, size_t size,
41520                                       enum dma_data_direction dir)
41521  {
41522 -       struct dma_map_ops *ops = get_dma_ops(dev);
41523 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41524         dma_addr_t addr;
41525
41526         kmemcheck_mark_initialized(page_address(page) + offset, size);
41527 @@ -85,7 +85,7 @@ static inline dma_addr_t dma_map_page(st
41528  static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
41529                                   size_t size, enum dma_data_direction dir)
41530  {
41531 -       struct dma_map_ops *ops = get_dma_ops(dev);
41532 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41533
41534         BUG_ON(!valid_dma_direction(dir));
41535         if (ops->unmap_page)
41536 @@ -97,7 +97,7 @@ static inline void dma_sync_single_for_c
41537                                            size_t size,
41538                                            enum dma_data_direction dir)
41539  {
41540 -       struct dma_map_ops *ops = get_dma_ops(dev);
41541 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41542
41543         BUG_ON(!valid_dma_direction(dir));
41544         if (ops->sync_single_for_cpu)
41545 @@ -109,7 +109,7 @@ static inline void dma_sync_single_for_d
41546                                               dma_addr_t addr, size_t size,
41547                                               enum dma_data_direction dir)
41548  {
41549 -       struct dma_map_ops *ops = get_dma_ops(dev);
41550 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41551
41552         BUG_ON(!valid_dma_direction(dir));
41553         if (ops->sync_single_for_device)
41554 @@ -123,7 +123,7 @@ static inline void dma_sync_single_range
41555                                                  size_t size,
41556                                                  enum dma_data_direction dir)
41557  {
41558 -       struct dma_map_ops *ops = get_dma_ops(dev);
41559 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41560
41561         BUG_ON(!valid_dma_direction(dir));
41562         if (ops->sync_single_range_for_cpu) {
41563 @@ -140,7 +140,7 @@ static inline void dma_sync_single_range
41564                                                     size_t size,
41565                                                     enum dma_data_direction dir)
41566  {
41567 -       struct dma_map_ops *ops = get_dma_ops(dev);
41568 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41569
41570         BUG_ON(!valid_dma_direction(dir));
41571         if (ops->sync_single_range_for_device) {
41572 @@ -155,7 +155,7 @@ static inline void
41573  dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
41574                     int nelems, enum dma_data_direction dir)
41575  {
41576 -       struct dma_map_ops *ops = get_dma_ops(dev);
41577 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41578
41579         BUG_ON(!valid_dma_direction(dir));
41580         if (ops->sync_sg_for_cpu)
41581 @@ -167,7 +167,7 @@ static inline void
41582  dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
41583                        int nelems, enum dma_data_direction dir)
41584  {
41585 -       struct dma_map_ops *ops = get_dma_ops(dev);
41586 +       const struct dma_map_ops *ops = get_dma_ops(dev);
41587
41588         BUG_ON(!valid_dma_direction(dir));
41589         if (ops->sync_sg_for_device)
41590 diff -urNp linux-2.6.33/include/asm-generic/futex.h linux-2.6.33/include/asm-generic/futex.h
41591 --- linux-2.6.33/include/asm-generic/futex.h    2010-02-24 13:52:17.000000000 -0500
41592 +++ linux-2.6.33/include/asm-generic/futex.h    2010-03-07 12:23:36.113714966 -0500
41593 @@ -6,7 +6,7 @@
41594  #include <asm/errno.h>
41595
41596  static inline int
41597 -futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
41598 +futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
41599  {
41600         int op = (encoded_op >> 28) & 7;
41601         int cmp = (encoded_op >> 24) & 15;
41602 @@ -48,7 +48,7 @@ futex_atomic_op_inuser (int encoded_op,
41603  }
41604
41605  static inline int
41606 -futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
41607 +futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
41608  {
41609         return -ENOSYS;
41610  }
41611 diff -urNp linux-2.6.33/include/asm-generic/int-l64.h linux-2.6.33/include/asm-generic/int-l64.h
41612 --- linux-2.6.33/include/asm-generic/int-l64.h  2010-02-24 13:52:17.000000000 -0500
41613 +++ linux-2.6.33/include/asm-generic/int-l64.h  2010-03-07 12:23:36.113714966 -0500
41614 @@ -46,6 +46,8 @@ typedef unsigned int u32;
41615  typedef signed long s64;
41616  typedef unsigned long u64;
41617
41618 +typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
41619 +
41620  #define S8_C(x)  x
41621  #define U8_C(x)  x ## U
41622  #define S16_C(x) x
41623 diff -urNp linux-2.6.33/include/asm-generic/int-ll64.h linux-2.6.33/include/asm-generic/int-ll64.h
41624 --- linux-2.6.33/include/asm-generic/int-ll64.h 2010-02-24 13:52:17.000000000 -0500
41625 +++ linux-2.6.33/include/asm-generic/int-ll64.h 2010-03-07 12:23:36.113714966 -0500
41626 @@ -51,6 +51,8 @@ typedef unsigned int u32;
41627  typedef signed long long s64;
41628  typedef unsigned long long u64;
41629
41630 +typedef unsigned long long intoverflow_t;
41631 +
41632  #define S8_C(x)  x
41633  #define U8_C(x)  x ## U
41634  #define S16_C(x) x
41635 diff -urNp linux-2.6.33/include/asm-generic/kmap_types.h linux-2.6.33/include/asm-generic/kmap_types.h
41636 --- linux-2.6.33/include/asm-generic/kmap_types.h       2010-02-24 13:52:17.000000000 -0500
41637 +++ linux-2.6.33/include/asm-generic/kmap_types.h       2010-03-07 12:23:36.113714966 -0500
41638 @@ -28,7 +28,8 @@ KMAP_D(15)    KM_UML_USERCOPY,
41639  KMAP_D(16)     KM_IRQ_PTE,
41640  KMAP_D(17)     KM_NMI,
41641  KMAP_D(18)     KM_NMI_PTE,
41642 -KMAP_D(19)     KM_TYPE_NR
41643 +KMAP_D(19)     KM_CLEARPAGE,
41644 +KMAP_D(20)     KM_TYPE_NR
41645  };
41646
41647  #undef KMAP_D
41648 diff -urNp linux-2.6.33/include/asm-generic/pgtable.h linux-2.6.33/include/asm-generic/pgtable.h
41649 --- linux-2.6.33/include/asm-generic/pgtable.h  2010-02-24 13:52:17.000000000 -0500
41650 +++ linux-2.6.33/include/asm-generic/pgtable.h  2010-03-07 12:23:36.113714966 -0500
41651 @@ -344,6 +344,14 @@ extern void untrack_pfn_vma(struct vm_ar
41652                                 unsigned long size);
41653  #endif
41654
41655 +#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
41656 +static inline unsigned long pax_open_kernel(void) { return 0; }
41657 +#endif
41658 +
41659 +#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
41660 +static inline unsigned long pax_close_kernel(void) { return 0; }
41661 +#endif
41662 +
41663  #endif /* !__ASSEMBLY__ */
41664
41665  #endif /* _ASM_GENERIC_PGTABLE_H */
41666 diff -urNp linux-2.6.33/include/asm-generic/vmlinux.lds.h linux-2.6.33/include/asm-generic/vmlinux.lds.h
41667 --- linux-2.6.33/include/asm-generic/vmlinux.lds.h      2010-02-24 13:52:17.000000000 -0500
41668 +++ linux-2.6.33/include/asm-generic/vmlinux.lds.h      2010-03-07 12:23:36.113714966 -0500
41669 @@ -203,6 +203,7 @@
41670         .rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {           \
41671                 VMLINUX_SYMBOL(__start_rodata) = .;                     \
41672                 *(.rodata) *(.rodata.*)                                 \
41673 +               *(.data.read_only)                                      \
41674                 *(__vermagic)           /* Kernel version magic */      \
41675                 *(__markers_strings)    /* Markers: strings */          \
41676                 *(__tracepoints_strings)/* Tracepoints: strings */      \
41677 @@ -660,22 +661,24 @@
41678   * section in the linker script will go there too.  @phdr should have
41679   * a leading colon.
41680   *
41681 - * Note that this macros defines __per_cpu_load as an absolute symbol.
41682 + * Note that this macros defines per_cpu_load as an absolute symbol.
41683   * If there is no need to put the percpu section at a predetermined
41684   * address, use PERCPU().
41685   */
41686  #define PERCPU_VADDR(vaddr, phdr)                                      \
41687 -       VMLINUX_SYMBOL(__per_cpu_load) = .;                             \
41688 -       .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)          \
41689 +       per_cpu_load = .;                                               \
41690 +       .data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)            \
41691                                 - LOAD_OFFSET) {                        \
41692 +               VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;      \
41693                 VMLINUX_SYMBOL(__per_cpu_start) = .;                    \
41694                 *(.data.percpu.first)                                   \
41695 -               *(.data.percpu.page_aligned)                            \
41696                 *(.data.percpu)                                         \
41697 +               . = ALIGN(PAGE_SIZE);                                   \
41698 +               *(.data.percpu.page_aligned)                            \
41699                 *(.data.percpu.shared_aligned)                          \
41700                 VMLINUX_SYMBOL(__per_cpu_end) = .;                      \
41701         } phdr                                                          \
41702 -       . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
41703 +       . = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
41704
41705  /**
41706   * PERCPU - define output section for percpu area, simple version
41707 diff -urNp linux-2.6.33/include/drm/drm_pciids.h linux-2.6.33/include/drm/drm_pciids.h
41708 --- linux-2.6.33/include/drm/drm_pciids.h       2010-02-24 13:52:17.000000000 -0500
41709 +++ linux-2.6.33/include/drm/drm_pciids.h       2010-03-07 12:23:36.113714966 -0500
41710 @@ -375,7 +375,7 @@
41711         {0x1002, 0x9712, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
41712         {0x1002, 0x9713, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
41713         {0x1002, 0x9714, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_RS880|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
41714 -       {0, 0, 0}
41715 +       {0, 0, 0, 0, 0, 0}
41716
41717  #define r128_PCI_IDS \
41718         {0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41719 @@ -415,14 +415,14 @@
41720         {0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41721         {0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41722         {0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41723 -       {0, 0, 0}
41724 +       {0, 0, 0, 0, 0, 0}
41725
41726  #define mga_PCI_IDS \
41727         {0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
41728         {0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
41729         {0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
41730         {0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
41731 -       {0, 0, 0}
41732 +       {0, 0, 0, 0, 0, 0}
41733
41734  #define mach64_PCI_IDS \
41735         {0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41736 @@ -445,7 +445,7 @@
41737         {0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41738         {0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41739         {0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41740 -       {0, 0, 0}
41741 +       {0, 0, 0, 0, 0, 0}
41742
41743  #define sisdrv_PCI_IDS \
41744         {0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41745 @@ -456,7 +456,7 @@
41746         {0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41747         {0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
41748         {0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
41749 -       {0, 0, 0}
41750 +       {0, 0, 0, 0, 0, 0}
41751
41752  #define tdfx_PCI_IDS \
41753         {0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41754 @@ -465,7 +465,7 @@
41755         {0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41756         {0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41757         {0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41758 -       {0, 0, 0}
41759 +       {0, 0, 0, 0, 0, 0}
41760
41761  #define viadrv_PCI_IDS \
41762         {0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41763 @@ -477,14 +477,14 @@
41764         {0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41765         {0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
41766         {0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
41767 -       {0, 0, 0}
41768 +       {0, 0, 0, 0, 0, 0}
41769
41770  #define i810_PCI_IDS \
41771         {0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41772         {0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41773         {0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41774         {0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41775 -       {0, 0, 0}
41776 +       {0, 0, 0, 0, 0, 0}
41777
41778  #define i830_PCI_IDS \
41779         {0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41780 @@ -492,11 +492,11 @@
41781         {0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41782         {0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41783         {0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41784 -       {0, 0, 0}
41785 +       {0, 0, 0, 0, 0, 0}
41786
41787  #define gamma_PCI_IDS \
41788         {0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
41789 -       {0, 0, 0}
41790 +       {0, 0, 0, 0, 0, 0}
41791
41792  #define savage_PCI_IDS \
41793         {0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
41794 @@ -522,10 +522,10 @@
41795         {0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
41796         {0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
41797         {0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
41798 -       {0, 0, 0}
41799 +       {0, 0, 0, 0, 0, 0}
41800
41801  #define ffb_PCI_IDS \
41802 -       {0, 0, 0}
41803 +       {0, 0, 0, 0, 0, 0}
41804
41805  #define i915_PCI_IDS \
41806         {0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
41807 @@ -558,4 +558,4 @@
41808         {0x8086, 0x35e8, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
41809         {0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
41810         {0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
41811 -       {0, 0, 0}
41812 +       {0, 0, 0, 0, 0, 0}
41813 diff -urNp linux-2.6.33/include/drm/drmP.h linux-2.6.33/include/drm/drmP.h
41814 --- linux-2.6.33/include/drm/drmP.h     2010-02-24 13:52:17.000000000 -0500
41815 +++ linux-2.6.33/include/drm/drmP.h     2010-03-07 12:23:36.113714966 -0500
41816 @@ -806,7 +806,7 @@ struct drm_driver {
41817         void (*vgaarb_irq)(struct drm_device *dev, bool state);
41818
41819         /* Driver private ops for this object */
41820 -       struct vm_operations_struct *gem_vm_ops;
41821 +       const struct vm_operations_struct *gem_vm_ops;
41822
41823         int major;
41824         int minor;
41825 @@ -915,7 +915,7 @@ struct drm_device {
41826
41827         /** \name Usage Counters */
41828         /*@{ */
41829 -       int open_count;                 /**< Outstanding files open */
41830 +       atomic_t open_count;            /**< Outstanding files open */
41831         atomic_t ioctl_count;           /**< Outstanding IOCTLs pending */
41832         atomic_t vma_count;             /**< Outstanding vma areas open */
41833         int buf_use;                    /**< Buffers in use -- cannot alloc */
41834 @@ -926,7 +926,7 @@ struct drm_device {
41835         /*@{ */
41836         unsigned long counters;
41837         enum drm_stat_type types[15];
41838 -       atomic_t counts[15];
41839 +       atomic_unchecked_t counts[15];
41840         /*@} */
41841
41842         struct list_head filelist;
41843 diff -urNp linux-2.6.33/include/linux/a.out.h linux-2.6.33/include/linux/a.out.h
41844 --- linux-2.6.33/include/linux/a.out.h  2010-02-24 13:52:17.000000000 -0500
41845 +++ linux-2.6.33/include/linux/a.out.h  2010-03-07 12:23:36.113714966 -0500
41846 @@ -39,6 +39,14 @@ enum machine_type {
41847    M_MIPS2 = 152                /* MIPS R6000/R4000 binary */
41848  };
41849
41850 +/* Constants for the N_FLAGS field */
41851 +#define F_PAX_PAGEEXEC 1       /* Paging based non-executable pages */
41852 +#define F_PAX_EMUTRAMP 2       /* Emulate trampolines */
41853 +#define F_PAX_MPROTECT 4       /* Restrict mprotect() */
41854 +#define F_PAX_RANDMMAP 8       /* Randomize mmap() base */
41855 +/*#define F_PAX_RANDEXEC       16*/    /* Randomize ET_EXEC base */
41856 +#define F_PAX_SEGMEXEC 32      /* Segmentation based non-executable pages */
41857 +
41858  #if !defined (N_MAGIC)
41859  #define N_MAGIC(exec) ((exec).a_info & 0xffff)
41860  #endif
41861 diff -urNp linux-2.6.33/include/linux/atmdev.h linux-2.6.33/include/linux/atmdev.h
41862 --- linux-2.6.33/include/linux/atmdev.h 2010-02-24 13:52:17.000000000 -0500
41863 +++ linux-2.6.33/include/linux/atmdev.h 2010-03-07 12:23:36.113714966 -0500
41864 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
41865  #endif
41866
41867  struct k_atm_aal_stats {
41868 -#define __HANDLE_ITEM(i) atomic_t i
41869 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
41870         __AAL_STAT_ITEMS
41871  #undef __HANDLE_ITEM
41872  };
41873 diff -urNp linux-2.6.33/include/linux/binfmts.h linux-2.6.33/include/linux/binfmts.h
41874 --- linux-2.6.33/include/linux/binfmts.h        2010-02-24 13:52:17.000000000 -0500
41875 +++ linux-2.6.33/include/linux/binfmts.h        2010-03-07 12:23:36.113714966 -0500
41876 @@ -86,6 +86,7 @@ struct linux_binfmt {
41877         int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
41878         int (*load_shlib)(struct file *);
41879         int (*core_dump)(struct coredump_params *cprm);
41880 +       void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
41881         unsigned long min_coredump;     /* minimal dump size */
41882         int hasvdso;
41883  };
41884 diff -urNp linux-2.6.33/include/linux/blkdev.h linux-2.6.33/include/linux/blkdev.h
41885 --- linux-2.6.33/include/linux/blkdev.h 2010-02-24 13:52:17.000000000 -0500
41886 +++ linux-2.6.33/include/linux/blkdev.h 2010-03-07 12:23:36.113714966 -0500
41887 @@ -1287,19 +1287,19 @@ static inline int blk_integrity_rq(struc
41888  #endif /* CONFIG_BLK_DEV_INTEGRITY */
41889
41890  struct block_device_operations {
41891 -       int (*open) (struct block_device *, fmode_t);
41892 -       int (*release) (struct gendisk *, fmode_t);
41893 -       int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41894 -       int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41895 -       int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41896 -       int (*direct_access) (struct block_device *, sector_t,
41897 +       int (* const open) (struct block_device *, fmode_t);
41898 +       int (* const release) (struct gendisk *, fmode_t);
41899 +       int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41900 +       int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41901 +       int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
41902 +       int (* const direct_access) (struct block_device *, sector_t,
41903                                                 void **, unsigned long *);
41904 -       int (*media_changed) (struct gendisk *);
41905 -       unsigned long long (*set_capacity) (struct gendisk *,
41906 +       int (* const media_changed) (struct gendisk *);
41907 +       unsigned long long (* const set_capacity) (struct gendisk *,
41908                                                 unsigned long long);
41909 -       int (*revalidate_disk) (struct gendisk *);
41910 -       int (*getgeo)(struct block_device *, struct hd_geometry *);
41911 -       struct module *owner;
41912 +       int (* const revalidate_disk) (struct gendisk *);
41913 +       int (* const getgeo)(struct block_device *, struct hd_geometry *);
41914 +       struct module * const owner;
41915  };
41916
41917  extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
41918 diff -urNp linux-2.6.33/include/linux/cache.h linux-2.6.33/include/linux/cache.h
41919 --- linux-2.6.33/include/linux/cache.h  2010-02-24 13:52:17.000000000 -0500
41920 +++ linux-2.6.33/include/linux/cache.h  2010-03-07 12:23:36.113714966 -0500
41921 @@ -16,6 +16,10 @@
41922  #define __read_mostly
41923  #endif
41924
41925 +#ifndef __read_only
41926 +#define __read_only __read_mostly
41927 +#endif
41928 +
41929  #ifndef ____cacheline_aligned
41930  #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
41931  #endif
41932 diff -urNp linux-2.6.33/include/linux/capability.h linux-2.6.33/include/linux/capability.h
41933 --- linux-2.6.33/include/linux/capability.h     2010-02-24 13:52:17.000000000 -0500
41934 +++ linux-2.6.33/include/linux/capability.h     2010-03-07 12:23:36.117645366 -0500
41935 @@ -561,6 +561,7 @@ extern const kernel_cap_t __cap_init_eff
41936         (security_real_capable_noaudit((t), (cap)) == 0)
41937
41938  extern int capable(int cap);
41939 +int capable_nolog(int cap);
41940
41941  /* audit system wants to get cap info from files as well */
41942  struct dentry;
41943 diff -urNp linux-2.6.33/include/linux/compiler-gcc4.h linux-2.6.33/include/linux/compiler-gcc4.h
41944 --- linux-2.6.33/include/linux/compiler-gcc4.h  2010-02-24 13:52:17.000000000 -0500
41945 +++ linux-2.6.33/include/linux/compiler-gcc4.h  2010-03-07 12:23:36.117645366 -0500
41946 @@ -50,6 +50,10 @@
41947  #define unreachable() __builtin_unreachable()
41948  #endif
41949
41950 +#define __alloc_size(...)      __attribute((alloc_size(__VA_ARGS__)))
41951 +#define __bos(ptr, arg)                __builtin_object_size((ptr), (arg))
41952 +#define __bos0(ptr)            __bos((ptr), 0)
41953 +#define __bos1(ptr)            __bos((ptr), 1)
41954  #endif
41955
41956  #if __GNUC_MINOR__ > 0
41957 diff -urNp linux-2.6.33/include/linux/compiler.h linux-2.6.33/include/linux/compiler.h
41958 --- linux-2.6.33/include/linux/compiler.h       2010-02-24 13:52:17.000000000 -0500
41959 +++ linux-2.6.33/include/linux/compiler.h       2010-03-07 12:23:36.117645366 -0500
41960 @@ -267,6 +267,22 @@ void ftrace_likely_update(struct ftrace_
41961  #define __cold
41962  #endif
41963
41964 +#ifndef __alloc_size
41965 +#define __alloc_size
41966 +#endif
41967 +
41968 +#ifndef __bos
41969 +#define __bos
41970 +#endif
41971 +
41972 +#ifndef __bos0
41973 +#define __bos0
41974 +#endif
41975 +
41976 +#ifndef __bos1
41977 +#define __bos1
41978 +#endif
41979 +
41980  /* Simple shorthand for a section definition */
41981  #ifndef __section
41982  # define __section(S) __attribute__ ((__section__(#S)))
41983 diff -urNp linux-2.6.33/include/linux/decompress/mm.h linux-2.6.33/include/linux/decompress/mm.h
41984 --- linux-2.6.33/include/linux/decompress/mm.h  2010-02-24 13:52:17.000000000 -0500
41985 +++ linux-2.6.33/include/linux/decompress/mm.h  2010-03-07 12:23:36.117645366 -0500
41986 @@ -68,7 +68,7 @@ static void free(void *where)
41987   * warnings when not needed (indeed large_malloc / large_free are not
41988   * needed by inflate */
41989
41990 -#define malloc(a) kmalloc(a, GFP_KERNEL)
41991 +#define malloc(a) kmalloc((a), GFP_KERNEL)
41992  #define free(a) kfree(a)
41993
41994  #define large_malloc(a) vmalloc(a)
41995 diff -urNp linux-2.6.33/include/linux/dma-mapping.h linux-2.6.33/include/linux/dma-mapping.h
41996 --- linux-2.6.33/include/linux/dma-mapping.h    2010-02-24 13:52:17.000000000 -0500
41997 +++ linux-2.6.33/include/linux/dma-mapping.h    2010-03-07 12:23:36.117645366 -0500
41998 @@ -16,50 +16,50 @@ enum dma_data_direction {
41999  };
42000
42001  struct dma_map_ops {
42002 -       void* (*alloc_coherent)(struct device *dev, size_t size,
42003 +       void* (* const alloc_coherent)(struct device *dev, size_t size,
42004                                 dma_addr_t *dma_handle, gfp_t gfp);
42005 -       void (*free_coherent)(struct device *dev, size_t size,
42006 +       void (* const free_coherent)(struct device *dev, size_t size,
42007                               void *vaddr, dma_addr_t dma_handle);
42008 -       dma_addr_t (*map_page)(struct device *dev, struct page *page,
42009 +       dma_addr_t (* const map_page)(struct device *dev, struct page *page,
42010                                unsigned long offset, size_t size,
42011                                enum dma_data_direction dir,
42012                                struct dma_attrs *attrs);
42013 -       void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
42014 +       void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
42015                            size_t size, enum dma_data_direction dir,
42016                            struct dma_attrs *attrs);
42017 -       int (*map_sg)(struct device *dev, struct scatterlist *sg,
42018 +       int (* const map_sg)(struct device *dev, struct scatterlist *sg,
42019                       int nents, enum dma_data_direction dir,
42020                       struct dma_attrs *attrs);
42021 -       void (*unmap_sg)(struct device *dev,
42022 +       void (* const unmap_sg)(struct device *dev,
42023                          struct scatterlist *sg, int nents,
42024                          enum dma_data_direction dir,
42025                          struct dma_attrs *attrs);
42026 -       void (*sync_single_for_cpu)(struct device *dev,
42027 +       void (* const sync_single_for_cpu)(struct device *dev,
42028                                     dma_addr_t dma_handle, size_t size,
42029                                     enum dma_data_direction dir);
42030 -       void (*sync_single_for_device)(struct device *dev,
42031 +       void (* const sync_single_for_device)(struct device *dev,
42032                                        dma_addr_t dma_handle, size_t size,
42033                                        enum dma_data_direction dir);
42034 -       void (*sync_single_range_for_cpu)(struct device *dev,
42035 +       void (* const sync_single_range_for_cpu)(struct device *dev,
42036                                           dma_addr_t dma_handle,
42037                                           unsigned long offset,
42038                                           size_t size,
42039                                           enum dma_data_direction dir);
42040 -       void (*sync_single_range_for_device)(struct device *dev,
42041 +       void (* const sync_single_range_for_device)(struct device *dev,
42042                                              dma_addr_t dma_handle,
42043                                              unsigned long offset,
42044                                              size_t size,
42045                                              enum dma_data_direction dir);
42046 -       void (*sync_sg_for_cpu)(struct device *dev,
42047 +       void (* const sync_sg_for_cpu)(struct device *dev,
42048                                 struct scatterlist *sg, int nents,
42049                                 enum dma_data_direction dir);
42050 -       void (*sync_sg_for_device)(struct device *dev,
42051 +       void (* const sync_sg_for_device)(struct device *dev,
42052                                    struct scatterlist *sg, int nents,
42053                                    enum dma_data_direction dir);
42054 -       int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
42055 -       int (*dma_supported)(struct device *dev, u64 mask);
42056 -       int (*set_dma_mask)(struct device *dev, u64 mask);
42057 -       int is_phys;
42058 +       int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
42059 +       int (* const dma_supported)(struct device *dev, u64 mask);
42060 +       int (* set_dma_mask)(struct device *dev, u64 mask);
42061 +       const int is_phys;
42062  };
42063
42064  #define DMA_BIT_MASK(n)        (((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
42065 diff -urNp linux-2.6.33/include/linux/elf.h linux-2.6.33/include/linux/elf.h
42066 --- linux-2.6.33/include/linux/elf.h    2010-02-24 13:52:17.000000000 -0500
42067 +++ linux-2.6.33/include/linux/elf.h    2010-03-07 12:23:36.117645366 -0500
42068 @@ -49,6 +49,17 @@ typedef __s64        Elf64_Sxword;
42069  #define PT_GNU_EH_FRAME                0x6474e550
42070
42071  #define PT_GNU_STACK   (PT_LOOS + 0x474e551)
42072 +#define PT_GNU_RELRO   (PT_LOOS + 0x474e552)
42073 +
42074 +#define PT_PAX_FLAGS   (PT_LOOS + 0x5041580)
42075 +
42076 +/* Constants for the e_flags field */
42077 +#define EF_PAX_PAGEEXEC                1       /* Paging based non-executable pages */
42078 +#define EF_PAX_EMUTRAMP                2       /* Emulate trampolines */
42079 +#define EF_PAX_MPROTECT                4       /* Restrict mprotect() */
42080 +#define EF_PAX_RANDMMAP                8       /* Randomize mmap() base */
42081 +/*#define EF_PAX_RANDEXEC              16*/    /* Randomize ET_EXEC base */
42082 +#define EF_PAX_SEGMEXEC                32      /* Segmentation based non-executable pages */
42083
42084  /* These constants define the different elf file types */
42085  #define ET_NONE   0
42086 @@ -84,6 +95,8 @@ typedef __s64 Elf64_Sxword;
42087  #define DT_DEBUG       21
42088  #define DT_TEXTREL     22
42089  #define DT_JMPREL      23
42090 +#define DT_FLAGS       30
42091 +  #define DF_TEXTREL  0x00000004
42092  #define DT_ENCODING    32
42093  #define OLD_DT_LOOS    0x60000000
42094  #define DT_LOOS                0x6000000d
42095 @@ -230,6 +243,19 @@ typedef struct elf64_hdr {
42096  #define PF_W           0x2
42097  #define PF_X           0x1
42098
42099 +#define PF_PAGEEXEC    (1U << 4)       /* Enable  PAGEEXEC */
42100 +#define PF_NOPAGEEXEC  (1U << 5)       /* Disable PAGEEXEC */
42101 +#define PF_SEGMEXEC    (1U << 6)       /* Enable  SEGMEXEC */
42102 +#define PF_NOSEGMEXEC  (1U << 7)       /* Disable SEGMEXEC */
42103 +#define PF_MPROTECT    (1U << 8)       /* Enable  MPROTECT */
42104 +#define PF_NOMPROTECT  (1U << 9)       /* Disable MPROTECT */
42105 +/*#define PF_RANDEXEC  (1U << 10)*/    /* Enable  RANDEXEC */
42106 +/*#define PF_NORANDEXEC        (1U << 11)*/    /* Disable RANDEXEC */
42107 +#define PF_EMUTRAMP    (1U << 12)      /* Enable  EMUTRAMP */
42108 +#define PF_NOEMUTRAMP  (1U << 13)      /* Disable EMUTRAMP */
42109 +#define PF_RANDMMAP    (1U << 14)      /* Enable  RANDMMAP */
42110 +#define PF_NORANDMMAP  (1U << 15)      /* Disable RANDMMAP */
42111 +
42112  typedef struct elf32_phdr{
42113    Elf32_Word   p_type;
42114    Elf32_Off    p_offset;
42115 @@ -322,6 +348,8 @@ typedef struct elf64_shdr {
42116  #define        EI_OSABI        7
42117  #define        EI_PAD          8
42118
42119 +#define        EI_PAX          14
42120 +
42121  #define        ELFMAG0         0x7f            /* EI_MAG */
42122  #define        ELFMAG1         'E'
42123  #define        ELFMAG2         'L'
42124 @@ -386,6 +414,7 @@ extern Elf32_Dyn _DYNAMIC [];
42125  #define elf_phdr       elf32_phdr
42126  #define elf_note       elf32_note
42127  #define elf_addr_t     Elf32_Off
42128 +#define elf_dyn                Elf32_Dyn
42129
42130  #else
42131
42132 @@ -394,6 +423,7 @@ extern Elf64_Dyn _DYNAMIC [];
42133  #define elf_phdr       elf64_phdr
42134  #define elf_note       elf64_note
42135  #define elf_addr_t     Elf64_Off
42136 +#define elf_dyn                Elf64_Dyn
42137
42138  #endif
42139
42140 diff -urNp linux-2.6.33/include/linux/fs.h linux-2.6.33/include/linux/fs.h
42141 --- linux-2.6.33/include/linux/fs.h     2010-02-24 13:52:17.000000000 -0500
42142 +++ linux-2.6.33/include/linux/fs.h     2010-03-07 12:23:36.117645366 -0500
42143 @@ -87,6 +87,10 @@ struct inodes_stat_t {
42144   */
42145  #define FMODE_NOCMTIME         ((__force fmode_t)2048)
42146
42147 +/* Hack for grsec so as not to require read permission simply to execute
42148 +   a binary */
42149 +#define FMODE_GREXEC           ((__force fmode_t)8192)
42150 +
42151  /*
42152   * The below are the various read and write types that we support. Some of
42153   * them include behavioral modifiers that send information down to the
42154 @@ -567,36 +571,38 @@ typedef int (*read_actor_t)(read_descrip
42155 -       void (*sync_page)(struct page *);
42156 +       int (* const writepage)(struct page *page, struct writeback_control *wbc);
42157 +       int (* const readpage)(struct file *, struct page *);
42158 +       void (* const sync_page)(struct page *);
42159
42160         /* Write back some dirty pages from this mapping. */
42161 -       int (*writepages)(struct address_space *, struct writeback_control *);
42162 +       int (* const writepages)(struct address_space *, struct writeback_control *);
42163
42164         /* Set a page dirty.  Return true if this dirtied it */
42165 -       int (*set_page_dirty)(struct page *page);
42166 +       int (* const set_page_dirty)(struct page *page);
42167
42168 -       int (*readpages)(struct file *filp, struct address_space *mapping,
42169 +       int (* const readpages)(struct file *filp, struct address_space *mapping,
42170                         struct list_head *pages, unsigned nr_pages);
42171
42172 -       int (*write_begin)(struct file *, struct address_space *mapping,
42173 +       int (* const write_begin)(struct file *, struct address_space *mapping,
42174                                 loff_t pos, unsigned len, unsigned flags,
42175                                 struct page **pagep, void **fsdata);
42176 -       int (*write_end)(struct file *, struct address_space *mapping,
42177 +       int (* const write_end)(struct file *, struct address_space *mapping,
42178                                 loff_t pos, unsigned len, unsigned copied,
42179                                 struct page *page, void *fsdata);
42180
42181         /* Unfortunately this kludge is needed for FIBMAP. Don't use it */
42182 -       sector_t (*bmap)(struct address_space *, sector_t);
42183 -       void (*invalidatepage) (struct page *, unsigned long);
42184 -       int (*releasepage) (struct page *, gfp_t);
42185 -       ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
42186 +       sector_t (* const bmap)(struct address_space *, sector_t);
42187 +       void (* const invalidatepage) (struct page *, unsigned long);
42188 +       int (* const releasepage) (struct page *, gfp_t);
42189 +       ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
42190                         loff_t offset, unsigned long nr_segs);
42191 -       int (*get_xip_mem)(struct address_space *, pgoff_t, int,
42192 +       int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
42193                                                 void **, unsigned long *);
42194         /* migrate the contents of a page to the specified target */
42195 -       int (*migratepage) (struct address_space *,
42196 +       int (* const migratepage) (struct address_space *,
42197                         struct page *, struct page *);
42198 -       int (*launder_page) (struct page *);
42199 -       int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
42200 +       int (* const launder_page) (struct page *);
42201 +       int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
42202                                         unsigned long);
42203 -       int (*error_remove_page)(struct address_space *, struct page *);
42204 +       int (* const error_remove_page)(struct address_space *, struct page *);
42205  };
42206
42207  /*
42208 @@ -1029,19 +1035,19 @@ static inline int file_check_writeable(s
42209  typedef struct files_struct *fl_owner_t;
42210
42211  struct file_lock_operations {
42212 -       void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
42213 -       void (*fl_release_private)(struct file_lock *);
42214 +       void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
42215 +       void (* const fl_release_private)(struct file_lock *);
42216  };
42217
42218  struct lock_manager_operations {
42219 -       int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
42220 -       void (*fl_notify)(struct file_lock *);  /* unblock callback */
42221 -       int (*fl_grant)(struct file_lock *, struct file_lock *, int);
42222 -       void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
42223 -       void (*fl_release_private)(struct file_lock *);
42224 -       void (*fl_break)(struct file_lock *);
42225 -       int (*fl_mylease)(struct file_lock *, struct file_lock *);
42226 -       int (*fl_change)(struct file_lock **, int);
42227 +       int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
42228 +       void (* const fl_notify)(struct file_lock *);   /* unblock callback */
42229 +       int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
42230 +       void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
42231 +       void (* const fl_release_private)(struct file_lock *);
42232 +       void (* const fl_break)(struct file_lock *);
42233 +       int (* const fl_mylease)(struct file_lock *, struct file_lock *);
42234 +       int (* const fl_change)(struct file_lock **, int);
42235  };
42236
42237  struct lock_manager {
42238 @@ -1434,7 +1440,7 @@ struct fiemap_extent_info {
42239         unsigned int fi_flags;          /* Flags as passed from user */
42240         unsigned int fi_extents_mapped; /* Number of mapped extents */
42241         unsigned int fi_extents_max;    /* Size of fiemap_extent array */
42242 -       struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
42243 +       struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
42244                                                  * array */
42245  };
42246  int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
42247 @@ -1551,32 +1557,32 @@ extern ssize_t vfs_writev(struct file *,
42248  ssize_t vfs_sendfile(struct file *, struct file *, loff_t *, size_t, loff_t);
42249
42250  struct super_operations {
42251 -       struct inode *(*alloc_inode)(struct super_block *sb);
42252 -       void (*destroy_inode)(struct inode *);
42253 +       struct inode *(* const alloc_inode)(struct super_block *sb);
42254 +       void (* const destroy_inode)(struct inode *);
42255
42256 -       void (*dirty_inode) (struct inode *);
42257 -       int (*write_inode) (struct inode *, int);
42258 -       void (*drop_inode) (struct inode *);
42259 -       void (*delete_inode) (struct inode *);
42260 -       void (*put_super) (struct super_block *);
42261 -       void (*write_super) (struct super_block *);
42262 -       int (*sync_fs)(struct super_block *sb, int wait);
42263 -       int (*freeze_fs) (struct super_block *);
42264 -       int (*unfreeze_fs) (struct super_block *);
42265 -       int (*statfs) (struct dentry *, struct kstatfs *);
42266 -       int (*remount_fs) (struct super_block *, int *, char *);
42267 -       void (*clear_inode) (struct inode *);
42268 -       void (*umount_begin) (struct super_block *);
42269 +       void (* const dirty_inode) (struct inode *);
42270 +       int (* const write_inode) (struct inode *, int);
42271 +       void (* const drop_inode) (struct inode *);
42272 +       void (* const delete_inode) (struct inode *);
42273 +       void (* const put_super) (struct super_block *);
42274 +       void (* const write_super) (struct super_block *);
42275 +       int (* const sync_fs)(struct super_block *sb, int wait);
42276 +       int (* const freeze_fs) (struct super_block *);
42277 +       int (* const unfreeze_fs) (struct super_block *);
42278 +       int (* const statfs) (struct dentry *, struct kstatfs *);
42279 +       int (* const remount_fs) (struct super_block *, int *, char *);
42280 +       void (* const clear_inode) (struct inode *);
42281 +       void (* const umount_begin) (struct super_block *);
42282
42283 -       void (*sync_inodes)(struct super_block *sb,
42284 +       void (* const sync_inodes)(struct super_block *sb,
42285                                 struct writeback_control *wbc);
42286 -       int (*show_options)(struct seq_file *, struct vfsmount *);
42287 -       int (*show_stats)(struct seq_file *, struct vfsmount *);
42288 +       int (* const show_options)(struct seq_file *, struct vfsmount *);
42289 +       int (* const show_stats)(struct seq_file *, struct vfsmount *);
42290  #ifdef CONFIG_QUOTA
42291 -       ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
42292 -       ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
42293 +       ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
42294 +       ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
42295  #endif
42296 -       int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
42297 +       int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
42298  };
42299
42300  /*
42301 diff -urNp linux-2.6.33/include/linux/fs_struct.h linux-2.6.33/include/linux/fs_struct.h
42302 --- linux-2.6.33/include/linux/fs_struct.h      2010-02-24 13:52:17.000000000 -0500
42303 +++ linux-2.6.33/include/linux/fs_struct.h      2010-03-07 12:23:36.117645366 -0500
42304 @@ -4,7 +4,7 @@
42305  #include <linux/path.h>
42306
42307  struct fs_struct {
42308 -       int users;
42309 +       atomic_t users;
42310         rwlock_t lock;
42311         int umask;
42312         int in_exec;
42313 diff -urNp linux-2.6.33/include/linux/genhd.h linux-2.6.33/include/linux/genhd.h
42314 --- linux-2.6.33/include/linux/genhd.h  2010-02-24 13:52:17.000000000 -0500
42315 +++ linux-2.6.33/include/linux/genhd.h  2010-03-07 12:23:36.117645366 -0500
42316 @@ -162,7 +162,7 @@ struct gendisk {
42317
42318         struct timer_rand_state *random;
42319
42320 -       atomic_t sync_io;               /* RAID */
42321 +       atomic_unchecked_t sync_io;     /* RAID */
42322         struct work_struct async_notify;
42323  #ifdef  CONFIG_BLK_DEV_INTEGRITY
42324         struct blk_integrity *integrity;
42325 diff -urNp linux-2.6.33/include/linux/gracl.h linux-2.6.33/include/linux/gracl.h
42326 --- linux-2.6.33/include/linux/gracl.h  1969-12-31 19:00:00.000000000 -0500
42327 +++ linux-2.6.33/include/linux/gracl.h  2010-03-07 12:23:36.117645366 -0500
42328 @@ -0,0 +1,309 @@
42329 +#ifndef GR_ACL_H
42330 +#define GR_ACL_H
42331 +
42332 +#include <linux/grdefs.h>
42333 +#include <linux/resource.h>
42334 +#include <linux/capability.h>
42335 +#include <linux/dcache.h>
42336 +#include <asm/resource.h>
42337 +
42338 +/* Major status information */
42339 +
42340 +#define GR_VERSION  "grsecurity 2.1.14"
42341 +#define GRSECURITY_VERSION 0x2114
42342 +
42343 +enum {
42344 +       GR_SHUTDOWN = 0,
42345 +       GR_ENABLE = 1,
42346 +       GR_SPROLE = 2,
42347 +       GR_RELOAD = 3,
42348 +       GR_SEGVMOD = 4,
42349 +       GR_STATUS = 5,
42350 +       GR_UNSPROLE = 6,
42351 +       GR_PASSSET = 7,
42352 +       GR_SPROLEPAM = 8,
42353 +};
42354 +
42355 +/* Password setup definitions
42356 + * kernel/grhash.c */
42357 +enum {
42358 +       GR_PW_LEN = 128,
42359 +       GR_SALT_LEN = 16,
42360 +       GR_SHA_LEN = 32,
42361 +};
42362 +
42363 +enum {
42364 +       GR_SPROLE_LEN = 64,
42365 +};
42366 +
42367 +#define GR_NLIMITS 32
42368 +
42369 +/* Begin Data Structures */
42370 +
42371 +struct sprole_pw {
42372 +       unsigned char *rolename;
42373 +       unsigned char salt[GR_SALT_LEN];
42374 +       unsigned char sum[GR_SHA_LEN];  /* 256-bit SHA hash of the password */
42375 +};
42376 +
42377 +struct name_entry {
42378 +       __u32 key;
42379 +       ino_t inode;
42380 +       dev_t device;
42381 +       char *name;
42382 +       __u16 len;
42383 +       __u8 deleted;
42384 +       struct name_entry *prev;
42385 +       struct name_entry *next;
42386 +};
42387 +
42388 +struct inodev_entry {
42389 +       struct name_entry *nentry;
42390 +       struct inodev_entry *prev;
42391 +       struct inodev_entry *next;
42392 +};
42393 +
42394 +struct acl_role_db {
42395 +       struct acl_role_label **r_hash;
42396 +       __u32 r_size;
42397 +};
42398 +
42399 +struct inodev_db {
42400 +       struct inodev_entry **i_hash;
42401 +       __u32 i_size;
42402 +};
42403 +
42404 +struct name_db {
42405 +       struct name_entry **n_hash;
42406 +       __u32 n_size;
42407 +};
42408 +
42409 +struct crash_uid {
42410 +       uid_t uid;
42411 +       unsigned long expires;
42412 +};
42413 +
42414 +struct gr_hash_struct {
42415 +       void **table;
42416 +       void **nametable;
42417 +       void *first;
42418 +       __u32 table_size;
42419 +       __u32 used_size;
42420 +       int type;
42421 +};
42422 +
42423 +/* Userspace Grsecurity ACL data structures */
42424 +
42425 +struct acl_subject_label {
42426 +       char *filename;
42427 +       ino_t inode;
42428 +       dev_t device;
42429 +       __u32 mode;
42430 +       kernel_cap_t cap_mask;
42431 +       kernel_cap_t cap_lower;
42432 +
42433 +       struct rlimit res[GR_NLIMITS];
42434 +       __u32 resmask;
42435 +
42436 +       __u8 user_trans_type;
42437 +       __u8 group_trans_type;
42438 +       uid_t *user_transitions;
42439 +       gid_t *group_transitions;
42440 +       __u16 user_trans_num;
42441 +       __u16 group_trans_num;
42442 +
42443 +       __u32 ip_proto[8];
42444 +       __u32 ip_type;
42445 +       struct acl_ip_label **ips;
42446 +       __u32 ip_num;
42447 +       __u32 inaddr_any_override;
42448 +
42449 +       __u32 crashes;
42450 +       unsigned long expires;
42451 +
42452 +       struct acl_subject_label *parent_subject;
42453 +       struct gr_hash_struct *hash;
42454 +       struct acl_subject_label *prev;
42455 +       struct acl_subject_label *next;
42456 +
42457 +       struct acl_object_label **obj_hash;
42458 +       __u32 obj_hash_size;
42459 +       __u16 pax_flags;
42460 +};
42461 +
42462 +struct role_allowed_ip {
42463 +       __u32 addr;
42464 +       __u32 netmask;
42465 +
42466 +       struct role_allowed_ip *prev;
42467 +       struct role_allowed_ip *next;
42468 +};
42469 +
42470 +struct role_transition {
42471 +       char *rolename;
42472 +
42473 +       struct role_transition *prev;
42474 +       struct role_transition *next;
42475 +};
42476 +
42477 +struct acl_role_label {
42478 +       char *rolename;
42479 +       uid_t uidgid;
42480 +       __u16 roletype;
42481 +
42482 +       __u16 auth_attempts;
42483 +       unsigned long expires;
42484 +
42485 +       struct acl_subject_label *root_label;
42486 +       struct gr_hash_struct *hash;
42487 +
42488 +       struct acl_role_label *prev;
42489 +       struct acl_role_label *next;
42490 +
42491 +       struct role_transition *transitions;
42492 +       struct role_allowed_ip *allowed_ips;
42493 +       uid_t *domain_children;
42494 +       __u16 domain_child_num;
42495 +
42496 +       struct acl_subject_label **subj_hash;
42497 +       __u32 subj_hash_size;
42498 +};
42499 +
42500 +struct user_acl_role_db {
42501 +       struct acl_role_label **r_table;
42502 +       __u32 num_pointers;             /* Number of allocations to track */
42503 +       __u32 num_roles;                /* Number of roles */
42504 +       __u32 num_domain_children;      /* Number of domain children */
42505 +       __u32 num_subjects;             /* Number of subjects */
42506 +       __u32 num_objects;              /* Number of objects */
42507 +};
42508 +
42509 +struct acl_object_label {
42510 +       char *filename;
42511 +       ino_t inode;
42512 +       dev_t device;
42513 +       __u32 mode;
42514 +
42515 +       struct acl_subject_label *nested;
42516 +       struct acl_object_label *globbed;
42517 +
42518 +       /* next two structures not used */
42519 +
42520 +       struct acl_object_label *prev;
42521 +       struct acl_object_label *next;
42522 +};
42523 +
42524 +struct acl_ip_label {
42525 +       char *iface;
42526 +       __u32 addr;
42527 +       __u32 netmask;
42528 +       __u16 low, high;
42529 +       __u8 mode;
42530 +       __u32 type;
42531 +       __u32 proto[8];
42532 +
42533 +       /* next two structures not used */
42534 +
42535 +       struct acl_ip_label *prev;
42536 +       struct acl_ip_label *next;
42537 +};
42538 +
42539 +struct gr_arg {
42540 +       struct user_acl_role_db role_db;
42541 +       unsigned char pw[GR_PW_LEN];
42542 +       unsigned char salt[GR_SALT_LEN];
42543 +       unsigned char sum[GR_SHA_LEN];
42544 +       unsigned char sp_role[GR_SPROLE_LEN];
42545 +       struct sprole_pw *sprole_pws;
42546 +       dev_t segv_device;
42547 +       ino_t segv_inode;
42548 +       uid_t segv_uid;
42549 +       __u16 num_sprole_pws;
42550 +       __u16 mode;
42551 +};
42552 +
42553 +struct gr_arg_wrapper {
42554 +       struct gr_arg *arg;
42555 +       __u32 version;
42556 +       __u32 size;
42557 +};
42558 +
42559 +struct subject_map {
42560 +       struct acl_subject_label *user;
42561 +       struct acl_subject_label *kernel;
42562 +       struct subject_map *prev;
42563 +       struct subject_map *next;
42564 +};
42565 +
42566 +struct acl_subj_map_db {
42567 +       struct subject_map **s_hash;
42568 +       __u32 s_size;
42569 +};
42570 +
42571 +/* End Data Structures Section */
42572 +
42573 +/* Hash functions generated by empirical testing by Brad Spengler
42574 +   Makes good use of the low bits of the inode.  Generally 0-1 times
42575 +   in loop for successful match.  0-3 for unsuccessful match.
42576 +   Shift/add algorithm with modulus of table size and an XOR*/
42577 +
42578 +static __inline__ unsigned int
42579 +rhash(const uid_t uid, const __u16 type, const unsigned int sz)
42580 +{
42581 +       return ((((uid + type) << (16 + type)) ^ uid) % sz);
42582 +}
42583 +
42584 + static __inline__ unsigned int
42585 +shash(const struct acl_subject_label *userp, const unsigned int sz)
42586 +{
42587 +       return ((const unsigned long)userp % sz);
42588 +}
42589 +
42590 +static __inline__ unsigned int
42591 +fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
42592 +{
42593 +       return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
42594 +}
42595 +
42596 +static __inline__ unsigned int
42597 +nhash(const char *name, const __u16 len, const unsigned int sz)
42598 +{
42599 +       return full_name_hash((const unsigned char *)name, len) % sz;
42600 +}
42601 +
42602 +#define FOR_EACH_ROLE_START(role) \
42603 +       role = role_list; \
42604 +       while (role) {
42605 +
42606 +#define FOR_EACH_ROLE_END(role) \
42607 +               role = role->prev; \
42608 +       }
42609 +
42610 +#define FOR_EACH_SUBJECT_START(role,subj,iter) \
42611 +       subj = NULL; \
42612 +       iter = 0; \
42613 +       while (iter < role->subj_hash_size) { \
42614 +               if (subj == NULL) \
42615 +                       subj = role->subj_hash[iter]; \
42616 +               if (subj == NULL) { \
42617 +                       iter++; \
42618 +                       continue; \
42619 +               }
42620 +
42621 +#define FOR_EACH_SUBJECT_END(subj,iter) \
42622 +               subj = subj->next; \
42623 +               if (subj == NULL) \
42624 +                       iter++; \
42625 +       }
42626 +
42627 +
42628 +#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
42629 +       subj = role->hash->first; \
42630 +       while (subj != NULL) {
42631 +
42632 +#define FOR_EACH_NESTED_SUBJECT_END(subj) \
42633 +               subj = subj->next; \
42634 +       }
42635 +
42636 +#endif
42637 +
42638 diff -urNp linux-2.6.33/include/linux/gralloc.h linux-2.6.33/include/linux/gralloc.h
42639 --- linux-2.6.33/include/linux/gralloc.h        1969-12-31 19:00:00.000000000 -0500
42640 +++ linux-2.6.33/include/linux/gralloc.h        2010-03-07 12:23:36.117645366 -0500
42641 @@ -0,0 +1,9 @@
42642 +#ifndef __GRALLOC_H
42643 +#define __GRALLOC_H
42644 +
42645 +void acl_free_all(void);
42646 +int acl_alloc_stack_init(unsigned long size);
42647 +void *acl_alloc(unsigned long len);
42648 +void *acl_alloc_num(unsigned long num, unsigned long len);
42649 +
42650 +#endif
42651 diff -urNp linux-2.6.33/include/linux/grdefs.h linux-2.6.33/include/linux/grdefs.h
42652 --- linux-2.6.33/include/linux/grdefs.h 1969-12-31 19:00:00.000000000 -0500
42653 +++ linux-2.6.33/include/linux/grdefs.h 2010-03-07 12:23:36.117645366 -0500
42654 @@ -0,0 +1,136 @@
42655 +#ifndef GRDEFS_H
42656 +#define GRDEFS_H
42657 +
42658 +/* Begin grsecurity status declarations */
42659 +
42660 +enum {
42661 +       GR_READY = 0x01,
42662 +       GR_STATUS_INIT = 0x00   // disabled state
42663 +};
42664 +
42665 +/* Begin  ACL declarations */
42666 +
42667 +/* Role flags */
42668 +
42669 +enum {
42670 +       GR_ROLE_USER = 0x0001,
42671 +       GR_ROLE_GROUP = 0x0002,
42672 +       GR_ROLE_DEFAULT = 0x0004,
42673 +       GR_ROLE_SPECIAL = 0x0008,
42674 +       GR_ROLE_AUTH = 0x0010,
42675 +       GR_ROLE_NOPW = 0x0020,
42676 +       GR_ROLE_GOD = 0x0040,
42677 +       GR_ROLE_LEARN = 0x0080,
42678 +       GR_ROLE_TPE = 0x0100,
42679 +       GR_ROLE_DOMAIN = 0x0200,
42680 +       GR_ROLE_PAM = 0x0400
42681 +};
42682 +
42683 +/* ACL Subject and Object mode flags */
42684 +enum {
42685 +       GR_DELETED = 0x80000000
42686 +};
42687 +
42688 +/* ACL Object-only mode flags */
42689 +enum {
42690 +       GR_READ         = 0x00000001,
42691 +       GR_APPEND       = 0x00000002,
42692 +       GR_WRITE        = 0x00000004,
42693 +       GR_EXEC         = 0x00000008,
42694 +       GR_FIND         = 0x00000010,
42695 +       GR_INHERIT      = 0x00000020,
42696 +       GR_SETID        = 0x00000040,
42697 +       GR_CREATE       = 0x00000080,
42698 +       GR_DELETE       = 0x00000100,
42699 +       GR_LINK         = 0x00000200,
42700 +       GR_AUDIT_READ   = 0x00000400,
42701 +       GR_AUDIT_APPEND = 0x00000800,
42702 +       GR_AUDIT_WRITE  = 0x00001000,
42703 +       GR_AUDIT_EXEC   = 0x00002000,
42704 +       GR_AUDIT_FIND   = 0x00004000,
42705 +       GR_AUDIT_INHERIT= 0x00008000,
42706 +       GR_AUDIT_SETID  = 0x00010000,
42707 +       GR_AUDIT_CREATE = 0x00020000,
42708 +       GR_AUDIT_DELETE = 0x00040000,
42709 +       GR_AUDIT_LINK   = 0x00080000,
42710 +       GR_PTRACERD     = 0x00100000,
42711 +       GR_NOPTRACE     = 0x00200000,
42712 +       GR_SUPPRESS     = 0x00400000,
42713 +       GR_NOLEARN      = 0x00800000
42714 +};
42715 +
42716 +#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
42717 +                  GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
42718 +                  GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
42719 +
42720 +/* ACL subject-only mode flags */
42721 +enum {
42722 +       GR_KILL         = 0x00000001,
42723 +       GR_VIEW         = 0x00000002,
42724 +       GR_PROTECTED    = 0x00000004,
42725 +       GR_LEARN        = 0x00000008,
42726 +       GR_OVERRIDE     = 0x00000010,
42727 +       /* just a placeholder, this mode is only used in userspace */
42728 +       GR_DUMMY        = 0x00000020,
42729 +       GR_PROTSHM      = 0x00000040,
42730 +       GR_KILLPROC     = 0x00000080,
42731 +       GR_KILLIPPROC   = 0x00000100,
42732 +       /* just a placeholder, this mode is only used in userspace */
42733 +       GR_NOTROJAN     = 0x00000200,
42734 +       GR_PROTPROCFD   = 0x00000400,
42735 +       GR_PROCACCT     = 0x00000800,
42736 +       GR_RELAXPTRACE  = 0x00001000,
42737 +       GR_NESTED       = 0x00002000,
42738 +       GR_INHERITLEARN = 0x00004000,
42739 +       GR_PROCFIND     = 0x00008000,
42740 +       GR_POVERRIDE    = 0x00010000,
42741 +       GR_KERNELAUTH   = 0x00020000,
42742 +};
42743 +
42744 +enum {
42745 +       GR_PAX_ENABLE_SEGMEXEC  = 0x0001,
42746 +       GR_PAX_ENABLE_PAGEEXEC  = 0x0002,
42747 +       GR_PAX_ENABLE_MPROTECT  = 0x0004,
42748 +       GR_PAX_ENABLE_RANDMMAP  = 0x0008,
42749 +       GR_PAX_ENABLE_EMUTRAMP  = 0x0010,
42750 +       GR_PAX_DISABLE_SEGMEXEC = 0x0100,
42751 +       GR_PAX_DISABLE_PAGEEXEC = 0x0200,
42752 +       GR_PAX_DISABLE_MPROTECT = 0x0400,
42753 +       GR_PAX_DISABLE_RANDMMAP = 0x0800,
42754 +       GR_PAX_DISABLE_EMUTRAMP = 0x1000,
42755 +};
42756 +
42757 +enum {
42758 +       GR_ID_USER      = 0x01,
42759 +       GR_ID_GROUP     = 0x02,
42760 +};
42761 +
42762 +enum {
42763 +       GR_ID_ALLOW     = 0x01,
42764 +       GR_ID_DENY      = 0x02,
42765 +};
42766 +
42767 +#define GR_CRASH_RES   31
42768 +#define GR_UIDTABLE_MAX 500
42769 +
42770 +/* begin resource learning section */
42771 +enum {
42772 +       GR_RLIM_CPU_BUMP = 60,
42773 +       GR_RLIM_FSIZE_BUMP = 50000,
42774 +       GR_RLIM_DATA_BUMP = 10000,
42775 +       GR_RLIM_STACK_BUMP = 1000,
42776 +       GR_RLIM_CORE_BUMP = 10000,
42777 +       GR_RLIM_RSS_BUMP = 500000,
42778 +       GR_RLIM_NPROC_BUMP = 1,
42779 +       GR_RLIM_NOFILE_BUMP = 5,
42780 +       GR_RLIM_MEMLOCK_BUMP = 50000,
42781 +       GR_RLIM_AS_BUMP = 500000,
42782 +       GR_RLIM_LOCKS_BUMP = 2,
42783 +       GR_RLIM_SIGPENDING_BUMP = 5,
42784 +       GR_RLIM_MSGQUEUE_BUMP = 10000,
42785 +       GR_RLIM_NICE_BUMP = 1,
42786 +       GR_RLIM_RTPRIO_BUMP = 1,
42787 +       GR_RLIM_RTTIME_BUMP = 1000000
42788 +};
42789 +
42790 +#endif
42791 diff -urNp linux-2.6.33/include/linux/grinternal.h linux-2.6.33/include/linux/grinternal.h
42792 --- linux-2.6.33/include/linux/grinternal.h     1969-12-31 19:00:00.000000000 -0500
42793 +++ linux-2.6.33/include/linux/grinternal.h     2010-03-07 12:23:36.117645366 -0500
42794 @@ -0,0 +1,213 @@
42795 +#ifndef __GRINTERNAL_H
42796 +#define __GRINTERNAL_H
42797 +
42798 +#ifdef CONFIG_GRKERNSEC
42799 +
42800 +#include <linux/fs.h>
42801 +#include <linux/mnt_namespace.h>
42802 +#include <linux/nsproxy.h>
42803 +#include <linux/gracl.h>
42804 +#include <linux/grdefs.h>
42805 +#include <linux/grmsg.h>
42806 +
42807 +void gr_add_learn_entry(const char *fmt, ...)
42808 +       __attribute__ ((format (printf, 1, 2)));
42809 +__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
42810 +                           const struct vfsmount *mnt);
42811 +__u32 gr_check_create(const struct dentry *new_dentry,
42812 +                            const struct dentry *parent,
42813 +                            const struct vfsmount *mnt, const __u32 mode);
42814 +int gr_check_protected_task(const struct task_struct *task);
42815 +__u32 to_gr_audit(const __u32 reqmode);
42816 +int gr_set_acls(const int type);
42817 +
42818 +int gr_acl_is_enabled(void);
42819 +char gr_roletype_to_char(void);
42820 +
42821 +void gr_handle_alertkill(struct task_struct *task);
42822 +char *gr_to_filename(const struct dentry *dentry,
42823 +                           const struct vfsmount *mnt);
42824 +char *gr_to_filename1(const struct dentry *dentry,
42825 +                           const struct vfsmount *mnt);
42826 +char *gr_to_filename2(const struct dentry *dentry,
42827 +                           const struct vfsmount *mnt);
42828 +char *gr_to_filename3(const struct dentry *dentry,
42829 +                           const struct vfsmount *mnt);
42830 +
42831 +extern int grsec_enable_harden_ptrace;
42832 +extern int grsec_enable_link;
42833 +extern int grsec_enable_fifo;
42834 +extern int grsec_enable_execve;
42835 +extern int grsec_enable_shm;
42836 +extern int grsec_enable_execlog;
42837 +extern int grsec_enable_signal;
42838 +extern int grsec_enable_audit_ptrace;
42839 +extern int grsec_enable_forkfail;
42840 +extern int grsec_enable_time;
42841 +extern int grsec_enable_rofs;
42842 +extern int grsec_enable_chroot_shmat;
42843 +extern int grsec_enable_chroot_findtask;
42844 +extern int grsec_enable_chroot_mount;
42845 +extern int grsec_enable_chroot_double;
42846 +extern int grsec_enable_chroot_pivot;
42847 +extern int grsec_enable_chroot_chdir;
42848 +extern int grsec_enable_chroot_chmod;
42849 +extern int grsec_enable_chroot_mknod;
42850 +extern int grsec_enable_chroot_fchdir;
42851 +extern int grsec_enable_chroot_nice;
42852 +extern int grsec_enable_chroot_execlog;
42853 +extern int grsec_enable_chroot_caps;
42854 +extern int grsec_enable_chroot_sysctl;
42855 +extern int grsec_enable_chroot_unix;
42856 +extern int grsec_enable_tpe;
42857 +extern int grsec_tpe_gid;
42858 +extern int grsec_enable_tpe_all;
42859 +extern int grsec_enable_sidcaps;
42860 +extern int grsec_enable_socket_all;
42861 +extern int grsec_socket_all_gid;
42862 +extern int grsec_enable_socket_client;
42863 +extern int grsec_socket_client_gid;
42864 +extern int grsec_enable_socket_server;
42865 +extern int grsec_socket_server_gid;
42866 +extern int grsec_audit_gid;
42867 +extern int grsec_enable_group;
42868 +extern int grsec_enable_audit_textrel;
42869 +extern int grsec_enable_mount;
42870 +extern int grsec_enable_chdir;
42871 +extern int grsec_resource_logging;
42872 +extern int grsec_lock;
42873 +
42874 +extern spinlock_t grsec_alert_lock;
42875 +extern unsigned long grsec_alert_wtime;
42876 +extern unsigned long grsec_alert_fyet;
42877 +
42878 +extern spinlock_t grsec_audit_lock;
42879 +
42880 +extern rwlock_t grsec_exec_file_lock;
42881 +
42882 +#define gr_task_fullpath(tsk) (tsk->exec_file ? \
42883 +                       gr_to_filename2(tsk->exec_file->f_path.dentry, \
42884 +                       tsk->exec_file->f_vfsmnt) : "/")
42885 +
42886 +#define gr_parent_task_fullpath(tsk) (tsk->parent->exec_file ? \
42887 +                       gr_to_filename3(tsk->parent->exec_file->f_path.dentry, \
42888 +                       tsk->parent->exec_file->f_vfsmnt) : "/")
42889 +
42890 +#define gr_task_fullpath0(tsk) (tsk->exec_file ? \
42891 +                       gr_to_filename(tsk->exec_file->f_path.dentry, \
42892 +                       tsk->exec_file->f_vfsmnt) : "/")
42893 +
42894 +#define gr_parent_task_fullpath0(tsk) (tsk->parent->exec_file ? \
42895 +                       gr_to_filename1(tsk->parent->exec_file->f_path.dentry, \
42896 +                       tsk->parent->exec_file->f_vfsmnt) : "/")
42897 +
42898 +#define proc_is_chrooted(tsk_a)  ((tsk_a->pid > 1) && (tsk_a->fs != NULL) && \
42899 +                         ((init_task.fs->root.dentry != tsk_a->fs->root.dentry) && \
42900 +                          (tsk_a->nsproxy->mnt_ns->root->mnt_root != \
42901 +                           tsk_a->fs->root.dentry)))
42902 +
42903 +#define have_same_root(tsk_a,tsk_b) ((tsk_a->fs != NULL) && (tsk_b->fs != NULL) && \
42904 +                         (tsk_a->fs->root.dentry == tsk_b->fs->root.dentry))
42905 +
42906 +#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), task->comm, \
42907 +                      task->pid, cred->uid, \
42908 +                      cred->euid, cred->gid, cred->egid, \
42909 +                      gr_parent_task_fullpath(task), \
42910 +                      task->parent->comm, task->parent->pid, \
42911 +                      pcred->uid, pcred->euid, \
42912 +                      pcred->gid, pcred->egid
42913 +
42914 +#define GR_CHROOT_CAPS {{ \
42915 +       CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
42916 +       CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
42917 +       CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
42918 +       CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
42919 +       CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
42920 +       CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
42921 +
42922 +#define security_learn(normal_msg,args...) \
42923 +({ \
42924 +       read_lock(&grsec_exec_file_lock); \
42925 +       gr_add_learn_entry(normal_msg "\n", ## args); \
42926 +       read_unlock(&grsec_exec_file_lock); \
42927 +})
42928 +
42929 +enum {
42930 +       GR_DO_AUDIT,
42931 +       GR_DONT_AUDIT,
42932 +       GR_DONT_AUDIT_GOOD
42933 +};
42934 +
42935 +enum {
42936 +       GR_TTYSNIFF,
42937 +       GR_RBAC,
42938 +       GR_RBAC_STR,
42939 +       GR_STR_RBAC,
42940 +       GR_RBAC_MODE2,
42941 +       GR_RBAC_MODE3,
42942 +       GR_FILENAME,
42943 +       GR_SYSCTL_HIDDEN,
42944 +       GR_NOARGS,
42945 +       GR_ONE_INT,
42946 +       GR_ONE_INT_TWO_STR,
42947 +       GR_ONE_STR,
42948 +       GR_STR_INT,
42949 +       GR_TWO_INT,
42950 +       GR_THREE_INT,
42951 +       GR_FIVE_INT_TWO_STR,
42952 +       GR_TWO_STR,
42953 +       GR_THREE_STR,
42954 +       GR_FOUR_STR,
42955 +       GR_STR_FILENAME,
42956 +       GR_FILENAME_STR,
42957 +       GR_FILENAME_TWO_INT,
42958 +       GR_FILENAME_TWO_INT_STR,
42959 +       GR_TEXTREL,
42960 +       GR_PTRACE,
42961 +       GR_RESOURCE,
42962 +       GR_CAP,
42963 +       GR_SIG,
42964 +       GR_SIG2,
42965 +       GR_CRASH1,
42966 +       GR_CRASH2,
42967 +       GR_PSACCT
42968 +};
42969 +
42970 +#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
42971 +#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
42972 +#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
42973 +#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
42974 +#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
42975 +#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
42976 +#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
42977 +#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
42978 +#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
42979 +#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
42980 +#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
42981 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
42982 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
42983 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
42984 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
42985 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
42986 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
42987 +#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
42988 +#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
42989 +#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
42990 +#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
42991 +#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
42992 +#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
42993 +#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
42994 +#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
42995 +#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
42996 +#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
42997 +#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
42998 +#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
42999 +#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
43000 +#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
43001 +#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
43002 +
43003 +void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
43004 +
43005 +#endif
43006 +
43007 +#endif
43008 diff -urNp linux-2.6.33/include/linux/grmsg.h linux-2.6.33/include/linux/grmsg.h
43009 --- linux-2.6.33/include/linux/grmsg.h  1969-12-31 19:00:00.000000000 -0500
43010 +++ linux-2.6.33/include/linux/grmsg.h  2010-03-07 12:23:36.117645366 -0500
43011 @@ -0,0 +1,108 @@
43012 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
43013 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
43014 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
43015 +#define GR_STOPMOD_MSG "denied modification of module state by "
43016 +#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
43017 +#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
43018 +#define GR_IOPERM_MSG "denied use of ioperm() by "
43019 +#define GR_IOPL_MSG "denied use of iopl() by "
43020 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
43021 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
43022 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
43023 +#define GR_KMEM_MSG "denied write of /dev/kmem by "
43024 +#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
43025 +#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
43026 +#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
43027 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
43028 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
43029 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
43030 +#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
43031 +#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
43032 +#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
43033 +#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
43034 +#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
43035 +#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
43036 +#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
43037 +#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
43038 +#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
43039 +#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
43040 +#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
43041 +#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
43042 +#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
43043 +#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
43044 +#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
43045 +#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
43046 +#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
43047 +#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
43048 +#define GR_NPROC_MSG "denied overstep of process limit by "
43049 +#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
43050 +#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
43051 +#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
43052 +#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
43053 +#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
43054 +#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
43055 +#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
43056 +#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
43057 +#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
43058 +#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
43059 +#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
43060 +#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
43061 +#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
43062 +#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
43063 +#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
43064 +#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
43065 +#define GR_INITF_ACL_MSG "init_variables() failed %s by "
43066 +#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
43067 +#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
43068 +#define GR_SHUTS_ACL_MSG "shutdown auth success for "
43069 +#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
43070 +#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
43071 +#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
43072 +#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
43073 +#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
43074 +#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
43075 +#define GR_ENABLEF_ACL_MSG "unable to load %s for "
43076 +#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
43077 +#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
43078 +#define GR_RELOADF_ACL_MSG "failed reload of %s for "
43079 +#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
43080 +#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
43081 +#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
43082 +#define GR_SPROLEF_ACL_MSG "special role %s failure for "
43083 +#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
43084 +#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
43085 +#define GR_UNSPROLEF_ACL_MSG "special role unauth of %s failure for "
43086 +#define GR_INVMODE_ACL_MSG "invalid mode %d by "
43087 +#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
43088 +#define GR_FAILFORK_MSG "failed fork with errno %d by "
43089 +#define GR_NICE_CHROOT_MSG "denied priority change by "
43090 +#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
43091 +#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
43092 +#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
43093 +#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
43094 +#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
43095 +#define GR_TIME_MSG "time set by "
43096 +#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
43097 +#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
43098 +#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
43099 +#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
43100 +#define GR_SOCK2_MSG "denied socket(%d,%.16s,%.16s) by "
43101 +#define GR_BIND_MSG "denied bind() by "
43102 +#define GR_CONNECT_MSG "denied connect() by "
43103 +#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
43104 +#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
43105 +#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
43106 +#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
43107 +#define GR_CAP_ACL_MSG "use of %s denied for "
43108 +#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
43109 +#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
43110 +#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
43111 +#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
43112 +#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
43113 +#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
43114 +#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
43115 +#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
43116 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
43117 +#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
43118 +#define GR_VM86_MSG "denied use of vm86 by "
43119 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
43120 diff -urNp linux-2.6.33/include/linux/grsecurity.h linux-2.6.33/include/linux/grsecurity.h
43121 --- linux-2.6.33/include/linux/grsecurity.h     1969-12-31 19:00:00.000000000 -0500
43122 +++ linux-2.6.33/include/linux/grsecurity.h     2010-03-07 12:23:36.117645366 -0500
43123 @@ -0,0 +1,201 @@
43124 +#ifndef GR_SECURITY_H
43125 +#define GR_SECURITY_H
43126 +#include <linux/fs.h>
43127 +#include <linux/fs_struct.h>
43128 +#include <linux/binfmts.h>
43129 +#include <linux/gracl.h>
43130 +
43131 +/* notify of brain-dead configs */
43132 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
43133 +#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
43134 +#endif
43135 +#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
43136 +#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
43137 +#endif
43138 +#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
43139 +#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
43140 +#endif
43141 +#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
43142 +#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
43143 +#endif
43144 +#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
43145 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
43146 +#endif
43147 +
43148 +void gr_handle_brute_attach(struct task_struct *p);
43149 +void gr_handle_brute_check(void);
43150 +
43151 +char gr_roletype_to_char(void);
43152 +
43153 +int gr_check_user_change(int real, int effective, int fs);
43154 +int gr_check_group_change(int real, int effective, int fs);
43155 +
43156 +void gr_del_task_from_ip_table(struct task_struct *p);
43157 +
43158 +int gr_pid_is_chrooted(struct task_struct *p);
43159 +int gr_handle_chroot_nice(void);
43160 +int gr_handle_chroot_sysctl(const int op);
43161 +int gr_handle_chroot_setpriority(struct task_struct *p,
43162 +                                       const int niceval);
43163 +int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
43164 +int gr_handle_chroot_chroot(const struct dentry *dentry,
43165 +                                  const struct vfsmount *mnt);
43166 +int gr_handle_chroot_caps(struct path *path);
43167 +void gr_handle_chroot_chdir(struct path *path);
43168 +int gr_handle_chroot_chmod(const struct dentry *dentry,
43169 +                                 const struct vfsmount *mnt, const int mode);
43170 +int gr_handle_chroot_mknod(const struct dentry *dentry,
43171 +                                 const struct vfsmount *mnt, const int mode);
43172 +int gr_handle_chroot_mount(const struct dentry *dentry,
43173 +                                 const struct vfsmount *mnt,
43174 +                                 const char *dev_name);
43175 +int gr_handle_chroot_pivot(void);
43176 +int gr_handle_chroot_unix(const pid_t pid);
43177 +
43178 +int gr_handle_rawio(const struct inode *inode);
43179 +int gr_handle_nproc(void);
43180 +
43181 +void gr_handle_ioperm(void);
43182 +void gr_handle_iopl(void);
43183 +
43184 +int gr_tpe_allow(const struct file *file);
43185 +
43186 +int gr_random_pid(void);
43187 +
43188 +void gr_log_forkfail(const int retval);
43189 +void gr_log_timechange(void);
43190 +void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
43191 +void gr_log_chdir(const struct dentry *dentry,
43192 +                        const struct vfsmount *mnt);
43193 +void gr_log_chroot_exec(const struct dentry *dentry,
43194 +                              const struct vfsmount *mnt);
43195 +void gr_handle_exec_args(struct linux_binprm *bprm, char **argv);
43196 +void gr_log_remount(const char *devname, const int retval);
43197 +void gr_log_unmount(const char *devname, const int retval);
43198 +void gr_log_mount(const char *from, const char *to, const int retval);
43199 +void gr_log_textrel(struct vm_area_struct *vma);
43200 +
43201 +int gr_handle_follow_link(const struct inode *parent,
43202 +                                const struct inode *inode,
43203 +                                const struct dentry *dentry,
43204 +                                const struct vfsmount *mnt);
43205 +int gr_handle_fifo(const struct dentry *dentry,
43206 +                         const struct vfsmount *mnt,
43207 +                         const struct dentry *dir, const int flag,
43208 +                         const int acc_mode);
43209 +int gr_handle_hardlink(const struct dentry *dentry,
43210 +                             const struct vfsmount *mnt,
43211 +                             struct inode *inode,
43212 +                             const int mode, const char *to);
43213 +
43214 +int gr_is_capable(const int cap);
43215 +int gr_is_capable_nolog(const int cap);
43216 +void gr_learn_resource(const struct task_struct *task, const int limit,
43217 +                             const unsigned long wanted, const int gt);
43218 +void gr_copy_label(struct task_struct *tsk);
43219 +void gr_handle_crash(struct task_struct *task, const int sig);
43220 +int gr_handle_signal(const struct task_struct *p, const int sig);
43221 +int gr_check_crash_uid(const uid_t uid);
43222 +int gr_check_protected_task(const struct task_struct *task);
43223 +int gr_acl_handle_mmap(const struct file *file,
43224 +                             const unsigned long prot);
43225 +int gr_acl_handle_mprotect(const struct file *file,
43226 +                                 const unsigned long prot);
43227 +int gr_check_hidden_task(const struct task_struct *tsk);
43228 +__u32 gr_acl_handle_truncate(const struct dentry *dentry,
43229 +                                   const struct vfsmount *mnt);
43230 +__u32 gr_acl_handle_utime(const struct dentry *dentry,
43231 +                                const struct vfsmount *mnt);
43232 +__u32 gr_acl_handle_access(const struct dentry *dentry,
43233 +                                 const struct vfsmount *mnt, const int fmode);
43234 +__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
43235 +                                 const struct vfsmount *mnt, mode_t mode);
43236 +__u32 gr_acl_handle_chmod(const struct dentry *dentry,
43237 +                                const struct vfsmount *mnt, mode_t mode);
43238 +__u32 gr_acl_handle_chown(const struct dentry *dentry,
43239 +                                const struct vfsmount *mnt);
43240 +int gr_handle_ptrace(struct task_struct *task, const long request);
43241 +int gr_handle_proc_ptrace(struct task_struct *task);
43242 +__u32 gr_acl_handle_execve(const struct dentry *dentry,
43243 +                                 const struct vfsmount *mnt);
43244 +int gr_check_crash_exec(const struct file *filp);
43245 +int gr_acl_is_enabled(void);
43246 +void gr_set_kernel_label(struct task_struct *task);
43247 +void gr_set_role_label(struct task_struct *task, const uid_t uid,
43248 +                             const gid_t gid);
43249 +int gr_set_proc_label(const struct dentry *dentry,
43250 +                       const struct vfsmount *mnt,
43251 +                       const int unsafe_share);
43252 +__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
43253 +                               const struct vfsmount *mnt);
43254 +__u32 gr_acl_handle_open(const struct dentry *dentry,
43255 +                               const struct vfsmount *mnt, const int fmode);
43256 +__u32 gr_acl_handle_creat(const struct dentry *dentry,
43257 +                                const struct dentry *p_dentry,
43258 +                                const struct vfsmount *p_mnt, const int fmode,
43259 +                                const int imode);
43260 +void gr_handle_create(const struct dentry *dentry,
43261 +                            const struct vfsmount *mnt);
43262 +__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
43263 +                                const struct dentry *parent_dentry,
43264 +                                const struct vfsmount *parent_mnt,
43265 +                                const int mode);
43266 +__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
43267 +                                const struct dentry *parent_dentry,
43268 +                                const struct vfsmount *parent_mnt);
43269 +__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
43270 +                                const struct vfsmount *mnt);
43271 +void gr_handle_delete(const ino_t ino, const dev_t dev);
43272 +__u32 gr_acl_handle_unlink(const struct dentry *dentry,
43273 +                                 const struct vfsmount *mnt);
43274 +__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
43275 +                                  const struct dentry *parent_dentry,
43276 +                                  const struct vfsmount *parent_mnt,
43277 +                                  const char *from);
43278 +__u32 gr_acl_handle_link(const struct dentry *new_dentry,
43279 +                               const struct dentry *parent_dentry,
43280 +                               const struct vfsmount *parent_mnt,
43281 +                               const struct dentry *old_dentry,
43282 +                               const struct vfsmount *old_mnt, const char *to);
43283 +int gr_acl_handle_rename(struct dentry *new_dentry,
43284 +                               struct dentry *parent_dentry,
43285 +                               const struct vfsmount *parent_mnt,
43286 +                               struct dentry *old_dentry,
43287 +                               struct inode *old_parent_inode,
43288 +                               struct vfsmount *old_mnt, const char *newname);
43289 +void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
43290 +                               struct dentry *old_dentry,
43291 +                               struct dentry *new_dentry,
43292 +                               struct vfsmount *mnt, const __u8 replace);
43293 +__u32 gr_check_link(const struct dentry *new_dentry,
43294 +                          const struct dentry *parent_dentry,
43295 +                          const struct vfsmount *parent_mnt,
43296 +                          const struct dentry *old_dentry,
43297 +                          const struct vfsmount *old_mnt);
43298 +int gr_acl_handle_filldir(const struct file *file, const char *name,
43299 +                                const unsigned int namelen, const ino_t ino);
43300 +
43301 +__u32 gr_acl_handle_unix(const struct dentry *dentry,
43302 +                               const struct vfsmount *mnt);
43303 +void gr_acl_handle_exit(void);
43304 +void gr_acl_handle_psacct(struct task_struct *task, const long code);
43305 +int gr_acl_handle_procpidmem(const struct task_struct *task);
43306 +int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
43307 +int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
43308 +void gr_audit_ptrace(struct task_struct *task);
43309 +
43310 +#ifdef CONFIG_GRKERNSEC
43311 +void gr_log_nonroot_mod_load(const char *modname);
43312 +void gr_handle_vm86(void);
43313 +void gr_handle_mem_write(void);
43314 +void gr_handle_kmem_write(void);
43315 +void gr_handle_open_port(void);
43316 +int gr_handle_mem_mmap(const unsigned long offset,
43317 +                             struct vm_area_struct *vma);
43318 +
43319 +extern int grsec_enable_dmesg;
43320 +extern int grsec_enable_randsrc;
43321 +extern int grsec_enable_shm;
43322 +#endif
43323 +
43324 +#endif
43325 diff -urNp linux-2.6.33/include/linux/grsock.h linux-2.6.33/include/linux/grsock.h
43326 --- linux-2.6.33/include/linux/grsock.h 1969-12-31 19:00:00.000000000 -0500
43327 +++ linux-2.6.33/include/linux/grsock.h 2010-03-07 12:23:36.117645366 -0500
43328 @@ -0,0 +1,19 @@
43329 +#ifndef __GRSOCK_H
43330 +#define __GRSOCK_H
43331 +
43332 +extern void gr_attach_curr_ip(const struct sock *sk);
43333 +extern int gr_handle_sock_all(const int family, const int type,
43334 +                             const int protocol);
43335 +extern int gr_handle_sock_server(const struct sockaddr *sck);
43336 +extern int gr_handle_sock_server_other(const struct socket *sck);
43337 +extern int gr_handle_sock_client(const struct sockaddr *sck);
43338 +extern int gr_search_connect(struct socket * sock,
43339 +                            struct sockaddr_in * addr);
43340 +extern int gr_search_bind(struct socket * sock,
43341 +                         struct sockaddr_in * addr);
43342 +extern int gr_search_listen(struct socket * sock);
43343 +extern int gr_search_accept(struct socket * sock);
43344 +extern int gr_search_socket(const int domain, const int type,
43345 +                           const int protocol);
43346 +
43347 +#endif
43348 diff -urNp linux-2.6.33/include/linux/hdpu_features.h linux-2.6.33/include/linux/hdpu_features.h
43349 --- linux-2.6.33/include/linux/hdpu_features.h  2010-02-24 13:52:17.000000000 -0500
43350 +++ linux-2.6.33/include/linux/hdpu_features.h  2010-03-07 12:23:36.117645366 -0500
43351 @@ -3,7 +3,7 @@
43352  struct cpustate_t {
43353         spinlock_t lock;
43354         int excl;
43355 -        int open_count;
43356 +       atomic_t open_count;
43357         unsigned char cached_val;
43358         int inited;
43359         unsigned long *set_addr;
43360 diff -urNp linux-2.6.33/include/linux/highmem.h linux-2.6.33/include/linux/highmem.h
43361 --- linux-2.6.33/include/linux/highmem.h        2010-02-24 13:52:17.000000000 -0500
43362 +++ linux-2.6.33/include/linux/highmem.h        2010-03-07 12:23:36.117645366 -0500
43363 @@ -137,6 +137,18 @@ static inline void clear_highpage(struct
43364         kunmap_atomic(kaddr, KM_USER0);
43365  }
43366
43367 +static inline void sanitize_highpage(struct page *page)
43368 +{
43369 +       void *kaddr;
43370 +       unsigned long flags;
43371 +
43372 +       local_irq_save(flags);
43373 +       kaddr = kmap_atomic(page, KM_CLEARPAGE);
43374 +       clear_page(kaddr);
43375 +       kunmap_atomic(kaddr, KM_CLEARPAGE);
43376 +       local_irq_restore(flags);
43377 +}
43378 +
43379  static inline void zero_user_segments(struct page *page,
43380         unsigned start1, unsigned end1,
43381         unsigned start2, unsigned end2)
43382 diff -urNp linux-2.6.33/include/linux/init_task.h linux-2.6.33/include/linux/init_task.h
43383 --- linux-2.6.33/include/linux/init_task.h      2010-02-24 13:52:17.000000000 -0500
43384 +++ linux-2.6.33/include/linux/init_task.h      2010-03-07 12:23:36.117645366 -0500
43385 @@ -111,6 +111,13 @@ extern struct cred init_cred;
43386  # define INIT_PERF_EVENTS(tsk)
43387  #endif
43388
43389 +#ifdef CONFIG_GRKERNSEC
43390 +# define INIT_GR_FS_LOCK                                       \
43391 +       .gr_fs_lock = __RW_LOCK_UNLOCKED(gr_fs_lock),
43392 +#else
43393 +# define INIT_GR_FS_LOCK
43394 +#endif
43395 +
43396  /*
43397   *  INIT_TASK is used to set up the first task table, touch at
43398   * your own risk!. Base=0, limit=0x1fffff (=2MB)
43399 @@ -180,6 +187,7 @@ extern struct cred init_cred;
43400         INIT_FTRACE_GRAPH                                               \
43401         INIT_TRACE_RECURSION                                            \
43402         INIT_TASK_RCU_PREEMPT(tsk)                                      \
43403 +       INIT_GR_FS_LOCK                                                 \
43404         .xid            = 0,                                            \
43405         .vx_info        = NULL,                                         \
43406         .nid            = 0,                                            \
43407 diff -urNp linux-2.6.33/include/linux/interrupt.h linux-2.6.33/include/linux/interrupt.h
43408 --- linux-2.6.33/include/linux/interrupt.h      2010-02-24 13:52:17.000000000 -0500
43409 +++ linux-2.6.33/include/linux/interrupt.h      2010-03-07 12:23:36.117645366 -0500
43410 @@ -357,7 +357,7 @@ enum
43411  /* map softirq index to softirq name. update 'softirq_to_name' in
43412   * kernel/softirq.c when adding a new softirq.
43413   */
43414 -extern char *softirq_to_name[NR_SOFTIRQS];
43415 +extern const char * const softirq_to_name[NR_SOFTIRQS];
43416
43417  /* softirq mask and active fields moved to irq_cpustat_t in
43418   * asm/hardirq.h to get better cache usage.  KAO
43419 @@ -365,12 +365,12 @@ extern char *softirq_to_name[NR_SOFTIRQS
43420
43421  struct softirq_action
43422  {
43423 -       void    (*action)(struct softirq_action *);
43424 +       void    (*action)(void);
43425  };
43426
43427  asmlinkage void do_softirq(void);
43428  asmlinkage void __do_softirq(void);
43429 -extern void open_softirq(int nr, void (*action)(struct softirq_action *));
43430 +extern void open_softirq(int nr, void (*action)(void));
43431  extern void softirq_init(void);
43432  #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
43433  extern void raise_softirq_irqoff(unsigned int nr);
43434 diff -urNp linux-2.6.33/include/linux/jbd2.h linux-2.6.33/include/linux/jbd2.h
43435 --- linux-2.6.33/include/linux/jbd2.h   2010-02-24 13:52:17.000000000 -0500
43436 +++ linux-2.6.33/include/linux/jbd2.h   2010-03-07 12:23:36.121768113 -0500
43437 @@ -66,7 +66,7 @@ extern u8 jbd2_journal_enable_debug;
43438                 }                                                       \
43439         } while (0)
43440  #else
43441 -#define jbd_debug(f, a...)     /**/
43442 +#define jbd_debug(f, a...)     do {} while (0)
43443  #endif
43444
43445  static inline void *jbd2_alloc(size_t size, gfp_t flags)
43446 diff -urNp linux-2.6.33/include/linux/jbd.h linux-2.6.33/include/linux/jbd.h
43447 --- linux-2.6.33/include/linux/jbd.h    2010-02-24 13:52:17.000000000 -0500
43448 +++ linux-2.6.33/include/linux/jbd.h    2010-03-07 12:23:36.121768113 -0500
43449 @@ -66,7 +66,7 @@ extern u8 journal_enable_debug;
43450                 }                                                       \
43451         } while (0)
43452  #else
43453 -#define jbd_debug(f, a...)     /**/
43454 +#define jbd_debug(f, a...)     do {} while (0)
43455  #endif
43456
43457  static inline void *jbd_alloc(size_t size, gfp_t flags)
43458 diff -urNp linux-2.6.33/include/linux/kallsyms.h linux-2.6.33/include/linux/kallsyms.h
43459 --- linux-2.6.33/include/linux/kallsyms.h       2010-02-24 13:52:17.000000000 -0500
43460 +++ linux-2.6.33/include/linux/kallsyms.h       2010-03-07 12:23:36.121768113 -0500
43461 @@ -15,7 +15,8 @@
43462
43463  struct module;
43464
43465 -#ifdef CONFIG_KALLSYMS
43466 +#ifndef __INCLUDED_BY_HIDESYM
43467 +#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
43468  /* Lookup the address for a symbol. Returns 0 if not found. */
43469  unsigned long kallsyms_lookup_name(const char *name);
43470
43471 @@ -92,6 +93,9 @@ static inline int lookup_symbol_attrs(un
43472  /* Stupid that this does nothing, but I didn't create this mess. */
43473  #define __print_symbol(fmt, addr)
43474  #endif /*CONFIG_KALLSYMS*/
43475 +#else /* when included by kallsyms.c, with HIDESYM enabled */
43476 +extern void __print_symbol(const char *fmt, unsigned long address);
43477 +#endif
43478
43479  /* This macro allows us to keep printk typechecking */
43480  static void __check_printsym_format(const char *fmt, ...)
43481 diff -urNp linux-2.6.33/include/linux/kgdb.h linux-2.6.33/include/linux/kgdb.h
43482 --- linux-2.6.33/include/linux/kgdb.h   2010-02-24 13:52:17.000000000 -0500
43483 +++ linux-2.6.33/include/linux/kgdb.h   2010-03-07 12:23:36.121768113 -0500
43484 @@ -250,20 +250,20 @@ struct kgdb_arch {
43485   */
43486  struct kgdb_io {
43487         const char              *name;
43488 -       int                     (*read_char) (void);
43489 -       void                    (*write_char) (u8);
43490 -       void                    (*flush) (void);
43491 -       int                     (*init) (void);
43492 -       void                    (*pre_exception) (void);
43493 -       void                    (*post_exception) (void);
43494 +       int                     (* const read_char) (void);
43495 +       void                    (* const write_char) (u8);
43496 +       void                    (* const flush) (void);
43497 +       int                     (* const init) (void);
43498 +       void                    (* const pre_exception) (void);
43499 +       void                    (* const post_exception) (void);
43500  };
43501
43502 -extern struct kgdb_arch                arch_kgdb_ops;
43503 +extern const struct kgdb_arch arch_kgdb_ops;
43504
43505  extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
43506
43507 -extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
43508 -extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
43509 +extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
43510 +extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
43511
43512  extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
43513  extern int kgdb_mem2hex(char *mem, char *buf, int count);
43514 diff -urNp linux-2.6.33/include/linux/kobject.h linux-2.6.33/include/linux/kobject.h
43515 --- linux-2.6.33/include/linux/kobject.h        2010-02-24 13:52:17.000000000 -0500
43516 +++ linux-2.6.33/include/linux/kobject.h        2010-03-07 12:23:36.121768113 -0500
43517 @@ -106,7 +106,7 @@ extern char *kobject_get_path(struct kob
43518
43519  struct kobj_type {
43520         void (*release)(struct kobject *kobj);
43521 -       struct sysfs_ops *sysfs_ops;
43522 +       const struct sysfs_ops *sysfs_ops;
43523         struct attribute **default_attrs;
43524  };
43525
43526 @@ -118,9 +118,9 @@ struct kobj_uevent_env {
43527  };
43528
43529  struct kset_uevent_ops {
43530 -       int (*filter)(struct kset *kset, struct kobject *kobj);
43531 -       const char *(*name)(struct kset *kset, struct kobject *kobj);
43532 -       int (*uevent)(struct kset *kset, struct kobject *kobj,
43533 +       int (* const filter)(struct kset *kset, struct kobject *kobj);
43534 +       const char *(* const name)(struct kset *kset, struct kobject *kobj);
43535 +       int (* const uevent)(struct kset *kset, struct kobject *kobj,
43536                       struct kobj_uevent_env *env);
43537  };
43538
43539 @@ -132,7 +132,7 @@ struct kobj_attribute {
43540                          const char *buf, size_t count);
43541  };
43542
43543 -extern struct sysfs_ops kobj_sysfs_ops;
43544 +extern const struct sysfs_ops kobj_sysfs_ops;
43545
43546  /**
43547   * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
43548 @@ -155,14 +155,14 @@ struct kset {
43549         struct list_head list;
43550         spinlock_t list_lock;
43551         struct kobject kobj;
43552 -       struct kset_uevent_ops *uevent_ops;
43553 +       const struct kset_uevent_ops *uevent_ops;
43554  };
43555
43556  extern void kset_init(struct kset *kset);
43557  extern int __must_check kset_register(struct kset *kset);
43558  extern void kset_unregister(struct kset *kset);
43559  extern struct kset * __must_check kset_create_and_add(const char *name,
43560 -                                               struct kset_uevent_ops *u,
43561 +                                               const struct kset_uevent_ops *u,
43562                                                 struct kobject *parent_kobj);
43563
43564  static inline struct kset *to_kset(struct kobject *kobj)
43565 diff -urNp linux-2.6.33/include/linux/kvm_host.h linux-2.6.33/include/linux/kvm_host.h
43566 --- linux-2.6.33/include/linux/kvm_host.h       2010-02-24 13:52:17.000000000 -0500
43567 +++ linux-2.6.33/include/linux/kvm_host.h       2010-03-07 12:23:36.121768113 -0500
43568 @@ -225,7 +225,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
43569  void vcpu_load(struct kvm_vcpu *vcpu);
43570  void vcpu_put(struct kvm_vcpu *vcpu);
43571
43572 -int kvm_init(void *opaque, unsigned int vcpu_size,
43573 +int kvm_init(const void *opaque, unsigned int vcpu_size,
43574                   struct module *module);
43575  void kvm_exit(void);
43576
43577 @@ -332,7 +332,7 @@ int kvm_arch_vcpu_ioctl_set_guest_debug(
43578                                         struct kvm_guest_debug *dbg);
43579  int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
43580
43581 -int kvm_arch_init(void *opaque);
43582 +int kvm_arch_init(const void *opaque);
43583  void kvm_arch_exit(void);
43584
43585  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
43586 diff -urNp linux-2.6.33/include/linux/libata.h linux-2.6.33/include/linux/libata.h
43587 --- linux-2.6.33/include/linux/libata.h 2010-02-24 13:52:17.000000000 -0500
43588 +++ linux-2.6.33/include/linux/libata.h 2010-03-07 12:23:36.121768113 -0500
43589 @@ -64,11 +64,11 @@
43590  #ifdef ATA_VERBOSE_DEBUG
43591  #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
43592  #else
43593 -#define VPRINTK(fmt, args...)
43594 +#define VPRINTK(fmt, args...) do {} while (0)
43595  #endif /* ATA_VERBOSE_DEBUG */
43596  #else
43597 -#define DPRINTK(fmt, args...)
43598 -#define VPRINTK(fmt, args...)
43599 +#define DPRINTK(fmt, args...) do {} while (0)
43600 +#define VPRINTK(fmt, args...) do {} while (0)
43601  #endif /* ATA_DEBUG */
43602
43603  #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
43604 @@ -524,11 +524,11 @@ struct ata_ioports {
43605
43606  struct ata_host {
43607         spinlock_t              lock;
43608 -       struct device           *dev;
43609 +       struct device           *dev;
43610         void __iomem * const    *iomap;
43611         unsigned int            n_ports;
43612         void                    *private_data;
43613 -       struct ata_port_operations *ops;
43614 +       const struct ata_port_operations *ops;
43615         unsigned long           flags;
43616  #ifdef CONFIG_ATA_ACPI
43617         acpi_handle             acpi_handle;
43618 @@ -710,7 +710,7 @@ struct ata_link {
43619
43620  struct ata_port {
43621         struct Scsi_Host        *scsi_host; /* our co-allocated scsi host */
43622 -       struct ata_port_operations *ops;
43623 +       const struct ata_port_operations *ops;
43624         spinlock_t              *lock;
43625         /* Flags owned by the EH context. Only EH should touch these once the
43626            port is active */
43627 @@ -892,7 +892,7 @@ struct ata_port_info {
43628         unsigned long           pio_mask;
43629         unsigned long           mwdma_mask;
43630         unsigned long           udma_mask;
43631 -       struct ata_port_operations *port_ops;
43632 +       const struct ata_port_operations *port_ops;
43633         void                    *private_data;
43634  };
43635
43636 @@ -916,7 +916,7 @@ extern const unsigned long sata_deb_timi
43637  extern const unsigned long sata_deb_timing_hotplug[];
43638  extern const unsigned long sata_deb_timing_long[];
43639
43640 -extern struct ata_port_operations ata_dummy_port_ops;
43641 +extern const struct ata_port_operations ata_dummy_port_ops;
43642  extern const struct ata_port_info ata_dummy_port_info;
43643
43644  static inline const unsigned long *
43645 @@ -962,7 +962,7 @@ extern int ata_host_activate(struct ata_
43646                              struct scsi_host_template *sht);
43647  extern void ata_host_detach(struct ata_host *host);
43648  extern void ata_host_init(struct ata_host *, struct device *,
43649 -                         unsigned long, struct ata_port_operations *);
43650 +                         unsigned long, const struct ata_port_operations *);
43651  extern int ata_scsi_detect(struct scsi_host_template *sht);
43652  extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
43653  extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
43654 diff -urNp linux-2.6.33/include/linux/lockd/bind.h linux-2.6.33/include/linux/lockd/bind.h
43655 --- linux-2.6.33/include/linux/lockd/bind.h     2010-02-24 13:52:17.000000000 -0500
43656 +++ linux-2.6.33/include/linux/lockd/bind.h     2010-03-07 12:23:36.121768113 -0500
43657 @@ -23,13 +23,13 @@ struct svc_rqst;
43658   * This is the set of functions for lockd->nfsd communication
43659   */
43660  struct nlmsvc_binding {
43661 -       __be32                  (*fopen)(struct svc_rqst *,
43662 +       __be32                  (* const fopen)(struct svc_rqst *,
43663                                                 struct nfs_fh *,
43664                                                 struct file **);
43665 -       void                    (*fclose)(struct file *);
43666 +       void                    (* const fclose)(struct file *);
43667  };
43668
43669 -extern struct nlmsvc_binding * nlmsvc_ops;
43670 +extern const struct nlmsvc_binding *   nlmsvc_ops;
43671
43672  /*
43673   * Similar to nfs_client_initdata, but without the NFS-specific
43674 diff -urNp linux-2.6.33/include/linux/mm.h linux-2.6.33/include/linux/mm.h
43675 --- linux-2.6.33/include/linux/mm.h     2010-02-24 13:52:17.000000000 -0500
43676 +++ linux-2.6.33/include/linux/mm.h     2010-03-07 12:23:36.121768113 -0500
43677 @@ -106,6 +106,10 @@ extern unsigned int kobjsize(const void
43678  #define VM_PFN_AT_MMAP 0x40000000      /* PFNMAP vma that is fully mapped at mmap time */
43679  #define VM_MERGEABLE   0x80000000      /* KSM may merge identical pages */
43680
43681 +#ifdef CONFIG_PAX_PAGEEXEC
43682 +#define VM_PAGEEXEC    0x80000000      /* vma->vm_page_prot needs special handling */
43683 +#endif
43684 +
43685  #ifndef VM_STACK_DEFAULT_FLAGS         /* arch can override this */
43686  #define VM_STACK_DEFAULT_FLAGS VM_DATA_DEFAULT_FLAGS
43687  #endif
43688 @@ -895,6 +899,8 @@ struct shrinker {
43689  extern void register_shrinker(struct shrinker *);
43690  extern void unregister_shrinker(struct shrinker *);
43691
43692 +pgprot_t vm_get_page_prot(unsigned long vm_flags);
43693 +
43694  int vma_wants_writenotify(struct vm_area_struct *vma);
43695
43696  extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
43697 @@ -1171,6 +1177,7 @@ out:
43698  }
43699
43700  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
43701 +extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
43702
43703  extern unsigned long do_brk(unsigned long, unsigned long);
43704
43705 @@ -1225,6 +1232,10 @@ extern struct vm_area_struct * find_vma(
43706  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
43707                                              struct vm_area_struct **pprev);
43708
43709 +extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
43710 +extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
43711 +extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
43712 +
43713  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
43714     NULL if none.  Assume start_addr < end_addr. */
43715  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
43716 @@ -1241,7 +1252,6 @@ static inline unsigned long vma_pages(st
43717         return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
43718  }
43719
43720 -pgprot_t vm_get_page_prot(unsigned long vm_flags);
43721  struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
43722  int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
43723                         unsigned long pfn, unsigned long size, pgprot_t);
43724 @@ -1344,8 +1354,14 @@ extern int unpoison_memory(unsigned long
43725  extern int sysctl_memory_failure_early_kill;
43726  extern int sysctl_memory_failure_recovery;
43727  extern void shake_page(struct page *p, int access);
43728 -extern atomic_long_t mce_bad_pages;
43729 +extern atomic_long_unchecked_t mce_bad_pages;
43730  extern int soft_offline_page(struct page *page, int flags);
43731
43732 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
43733 +extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
43734 +#else
43735 +static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
43736 +#endif
43737 +
43738  #endif /* __KERNEL__ */
43739  #endif /* _LINUX_MM_H */
43740 diff -urNp linux-2.6.33/include/linux/mm_types.h linux-2.6.33/include/linux/mm_types.h
43741 --- linux-2.6.33/include/linux/mm_types.h       2010-02-24 13:52:17.000000000 -0500
43742 +++ linux-2.6.33/include/linux/mm_types.h       2010-03-07 12:23:36.121768113 -0500
43743 @@ -188,6 +188,8 @@ struct vm_area_struct {
43744  #ifdef CONFIG_NUMA
43745         struct mempolicy *vm_policy;    /* NUMA policy for the VMA */
43746  #endif
43747 +
43748 +       struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
43749  };
43750
43751  struct core_thread {
43752 @@ -291,6 +293,24 @@ struct mm_struct {
43753  #ifdef CONFIG_MMU_NOTIFIER
43754         struct mmu_notifier_mm *mmu_notifier_mm;
43755  #endif
43756 +
43757 +#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
43758 +       unsigned long pax_flags;
43759 +#endif
43760 +
43761 +#ifdef CONFIG_PAX_DLRESOLVE
43762 +       unsigned long call_dl_resolve;
43763 +#endif
43764 +
43765 +#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
43766 +       unsigned long call_syscall;
43767 +#endif
43768 +
43769 +#ifdef CONFIG_PAX_ASLR
43770 +       unsigned long delta_mmap;               /* randomized offset */
43771 +       unsigned long delta_stack;              /* randomized offset */
43772 +#endif
43773 +
43774  };
43775
43776  /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
43777 diff -urNp linux-2.6.33/include/linux/mmu_notifier.h linux-2.6.33/include/linux/mmu_notifier.h
43778 --- linux-2.6.33/include/linux/mmu_notifier.h   2010-02-24 13:52:17.000000000 -0500
43779 +++ linux-2.6.33/include/linux/mmu_notifier.h   2010-03-07 12:23:36.121768113 -0500
43780 @@ -235,12 +235,12 @@ static inline void mmu_notifier_mm_destr
43781   */
43782  #define ptep_clear_flush_notify(__vma, __address, __ptep)              \
43783  ({                                                                     \
43784 -       pte_t __pte;                                                    \
43785 +       pte_t ___pte;                                                   \
43786         struct vm_area_struct *___vma = __vma;                          \
43787         unsigned long ___address = __address;                           \
43788 -       __pte = ptep_clear_flush(___vma, ___address, __ptep);           \
43789 +       ___pte = ptep_clear_flush(___vma, ___address, __ptep);          \
43790         mmu_notifier_invalidate_page(___vma->vm_mm, ___address);        \
43791 -       __pte;                                                          \
43792 +       ___pte;                                                         \
43793  })
43794
43795  #define ptep_clear_flush_young_notify(__vma, __address, __ptep)                \
43796 diff -urNp linux-2.6.33/include/linux/mod_devicetable.h linux-2.6.33/include/linux/mod_devicetable.h
43797 --- linux-2.6.33/include/linux/mod_devicetable.h        2010-02-24 13:52:17.000000000 -0500
43798 +++ linux-2.6.33/include/linux/mod_devicetable.h        2010-03-07 12:23:36.121768113 -0500
43799 @@ -12,7 +12,7 @@
43800  typedef unsigned long kernel_ulong_t;
43801  #endif
43802
43803 -#define PCI_ANY_ID (~0)
43804 +#define PCI_ANY_ID ((__u16)~0)
43805
43806  struct pci_device_id {
43807         __u32 vendor, device;           /* Vendor and device ID or PCI_ANY_ID*/
43808 @@ -131,7 +131,7 @@ struct usb_device_id {
43809  #define USB_DEVICE_ID_MATCH_INT_SUBCLASS       0x0100
43810  #define USB_DEVICE_ID_MATCH_INT_PROTOCOL       0x0200
43811
43812 -#define HID_ANY_ID                             (~0)
43813 +#define HID_ANY_ID                             (~0U)
43814
43815  struct hid_device_id {
43816         __u16 bus;
43817 diff -urNp linux-2.6.33/include/linux/module.h linux-2.6.33/include/linux/module.h
43818 --- linux-2.6.33/include/linux/module.h 2010-02-24 13:52:17.000000000 -0500
43819 +++ linux-2.6.33/include/linux/module.h 2010-03-07 12:23:36.121768113 -0500
43820 @@ -289,16 +289,16 @@ struct module
43821         int (*init)(void);
43822
43823         /* If this is non-NULL, vfree after init() returns */
43824 -       void *module_init;
43825 +       void *module_init_rx, *module_init_rw;
43826
43827         /* Here is the actual code + data, vfree'd on unload. */
43828 -       void *module_core;
43829 +       void *module_core_rx, *module_core_rw;
43830
43831         /* Here are the sizes of the init and core sections */
43832 -       unsigned int init_size, core_size;
43833 +       unsigned int init_size_rw, core_size_rw;
43834
43835         /* The size of the executable code in each section.  */
43836 -       unsigned int init_text_size, core_text_size;
43837 +       unsigned int init_size_rx, core_size_rx;
43838
43839         /* Arch-specific module values */
43840         struct mod_arch_specific arch;
43841 @@ -395,16 +395,46 @@ struct module *__module_address(unsigned
43842  bool is_module_address(unsigned long addr);
43843  bool is_module_text_address(unsigned long addr);
43844
43845 +static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
43846 +{
43847 +
43848 +#ifdef CONFIG_PAX_KERNEXEC
43849 +       if (ktla_ktva(addr) >= (unsigned long)start &&
43850 +           ktla_ktva(addr) < (unsigned long)start + size)
43851 +               return 1;
43852 +#endif
43853 +
43854 +       return ((void *)addr >= start && (void *)addr < start + size);
43855 +}
43856 +
43857 +static inline int within_module_core_rx(unsigned long addr, struct module *mod)
43858 +{
43859 +       return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
43860 +}
43861 +
43862 +static inline int within_module_core_rw(unsigned long addr, struct module *mod)
43863 +{
43864 +       return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
43865 +}
43866 +
43867 +static inline int within_module_init_rx(unsigned long addr, struct module *mod)
43868 +{
43869 +       return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
43870 +}
43871 +
43872 +static inline int within_module_init_rw(unsigned long addr, struct module *mod)
43873 +{
43874 +       return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
43875 +}
43876 +
43877  static inline int within_module_core(unsigned long addr, struct module *mod)
43878  {
43879 -       return (unsigned long)mod->module_core <= addr &&
43880 -              addr < (unsigned long)mod->module_core + mod->core_size;
43881 +       return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
43882  }
43883
43884  static inline int within_module_init(unsigned long addr, struct module *mod)
43885  {
43886 -       return (unsigned long)mod->module_init <= addr &&
43887 -              addr < (unsigned long)mod->module_init + mod->init_size;
43888 +       return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
43889  }
43890
43891  /* Search for module by name: must hold module_mutex. */
43892 diff -urNp linux-2.6.33/include/linux/moduleloader.h linux-2.6.33/include/linux/moduleloader.h
43893 --- linux-2.6.33/include/linux/moduleloader.h   2010-02-24 13:52:17.000000000 -0500
43894 +++ linux-2.6.33/include/linux/moduleloader.h   2010-03-07 12:23:36.121768113 -0500
43895 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
43896     sections.  Returns NULL on failure. */
43897  void *module_alloc(unsigned long size);
43898
43899 +#ifdef CONFIG_PAX_KERNEXEC
43900 +void *module_alloc_exec(unsigned long size);
43901 +#else
43902 +#define module_alloc_exec(x) module_alloc(x)
43903 +#endif
43904 +
43905  /* Free memory returned from module_alloc. */
43906  void module_free(struct module *mod, void *module_region);
43907
43908 +#ifdef CONFIG_PAX_KERNEXEC
43909 +void module_free_exec(struct module *mod, void *module_region);
43910 +#else
43911 +#define module_free_exec(x, y) module_free((x), (y))
43912 +#endif
43913 +
43914  /* Apply the given relocation to the (simplified) ELF.  Return -error
43915     or 0. */
43916  int apply_relocate(Elf_Shdr *sechdrs,
43917 diff -urNp linux-2.6.33/include/linux/namei.h linux-2.6.33/include/linux/namei.h
43918 --- linux-2.6.33/include/linux/namei.h  2010-02-24 13:52:17.000000000 -0500
43919 +++ linux-2.6.33/include/linux/namei.h  2010-03-07 12:23:36.121768113 -0500
43920 @@ -22,7 +22,7 @@ struct nameidata {
43921         unsigned int    flags;
43922         int             last_type;
43923         unsigned        depth;
43924 -       char *saved_names[MAX_NESTED_LINKS + 1];
43925 +       const char *saved_names[MAX_NESTED_LINKS + 1];
43926
43927         /* Intent data */
43928         union {
43929 @@ -81,12 +81,12 @@ extern int follow_up(struct path *);
43930  extern struct dentry *lock_rename(struct dentry *, struct dentry *);
43931  extern void unlock_rename(struct dentry *, struct dentry *);
43932
43933 -static inline void nd_set_link(struct nameidata *nd, char *path)
43934 +static inline void nd_set_link(struct nameidata *nd, const char *path)
43935  {
43936         nd->saved_names[nd->depth] = path;
43937  }
43938
43939 -static inline char *nd_get_link(struct nameidata *nd)
43940 +static inline const char *nd_get_link(const struct nameidata *nd)
43941  {
43942         return nd->saved_names[nd->depth];
43943  }
43944 diff -urNp linux-2.6.33/include/linux/nodemask.h linux-2.6.33/include/linux/nodemask.h
43945 --- linux-2.6.33/include/linux/nodemask.h       2010-02-24 13:52:17.000000000 -0500
43946 +++ linux-2.6.33/include/linux/nodemask.h       2010-03-07 12:23:36.121768113 -0500
43947 @@ -469,11 +469,11 @@ static inline int num_node_state(enum no
43948
43949  #define any_online_node(mask)                  \
43950  ({                                             \
43951 -       int node;                               \
43952 -       for_each_node_mask(node, (mask))        \
43953 -               if (node_online(node))          \
43954 +       int __node;                             \
43955 +       for_each_node_mask(__node, (mask))      \
43956 +               if (node_online(__node))        \
43957                         break;                  \
43958 -       node;                                   \
43959 +       __node;                                 \
43960  })
43961
43962  #define num_online_nodes()     num_node_state(N_ONLINE)
43963 diff -urNp linux-2.6.33/include/linux/oprofile.h linux-2.6.33/include/linux/oprofile.h
43964 --- linux-2.6.33/include/linux/oprofile.h       2010-02-24 13:52:17.000000000 -0500
43965 +++ linux-2.6.33/include/linux/oprofile.h       2010-03-07 12:23:36.121768113 -0500
43966 @@ -129,9 +129,9 @@ int oprofilefs_create_ulong(struct super
43967  int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
43968         char const * name, ulong * val);
43969
43970 -/** Create a file for read-only access to an atomic_t. */
43971 +/** Create a file for read-only access to an atomic_unchecked_t. */
43972  int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
43973 -       char const * name, atomic_t * val);
43974 +       char const * name, atomic_unchecked_t * val);
43975
43976  /** create a directory */
43977  struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
43978 diff -urNp linux-2.6.33/include/linux/pipe_fs_i.h linux-2.6.33/include/linux/pipe_fs_i.h
43979 --- linux-2.6.33/include/linux/pipe_fs_i.h      2010-02-24 13:52:17.000000000 -0500
43980 +++ linux-2.6.33/include/linux/pipe_fs_i.h      2010-03-07 12:23:36.125670889 -0500
43981 @@ -46,9 +46,9 @@ struct pipe_inode_info {
43982         wait_queue_head_t wait;
43983         unsigned int nrbufs, curbuf;
43984         struct page *tmp_page;
43985 -       unsigned int readers;
43986 -       unsigned int writers;
43987 -       unsigned int waiting_writers;
43988 +       atomic_t readers;
43989 +       atomic_t writers;
43990 +       atomic_t waiting_writers;
43991         unsigned int r_counter;
43992         unsigned int w_counter;
43993         struct fasync_struct *fasync_readers;
43994 diff -urNp linux-2.6.33/include/linux/poison.h linux-2.6.33/include/linux/poison.h
43995 --- linux-2.6.33/include/linux/poison.h 2010-02-24 13:52:17.000000000 -0500
43996 +++ linux-2.6.33/include/linux/poison.h 2010-03-07 12:23:36.125670889 -0500
43997 @@ -19,8 +19,8 @@
43998   * under normal circumstances, used to verify that nobody uses
43999   * non-initialized list entries.
44000   */
44001 -#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
44002 -#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
44003 +#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
44004 +#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
44005
44006  /********** include/linux/timer.h **********/
44007  /*
44008 diff -urNp linux-2.6.33/include/linux/proc_fs.h linux-2.6.33/include/linux/proc_fs.h
44009 --- linux-2.6.33/include/linux/proc_fs.h        2010-02-24 13:52:17.000000000 -0500
44010 +++ linux-2.6.33/include/linux/proc_fs.h        2010-03-07 12:23:36.125670889 -0500
44011 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
44012         return proc_create_data(name, mode, parent, proc_fops, NULL);
44013  }
44014
44015 +static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
44016 +       struct proc_dir_entry *parent, const struct file_operations *proc_fops)
44017 +{
44018 +#ifdef CONFIG_GRKERNSEC_PROC_USER
44019 +       return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
44020 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
44021 +       return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
44022 +#else
44023 +       return proc_create_data(name, mode, parent, proc_fops, NULL);
44024 +#endif
44025 +}
44026 +
44027 +
44028  static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
44029         mode_t mode, struct proc_dir_entry *base,
44030         read_proc_t *read_proc, void * data)
44031 diff -urNp linux-2.6.33/include/linux/random.h linux-2.6.33/include/linux/random.h
44032 --- linux-2.6.33/include/linux/random.h 2010-02-24 13:52:17.000000000 -0500
44033 +++ linux-2.6.33/include/linux/random.h 2010-03-07 12:23:36.125670889 -0500
44034 @@ -74,6 +74,11 @@ unsigned long randomize_range(unsigned l
44035  u32 random32(void);
44036  void srandom32(u32 seed);
44037
44038 +static inline unsigned long pax_get_random_long(void)
44039 +{
44040 +       return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
44041 +}
44042 +
44043  #endif /* __KERNEL___ */
44044
44045  #endif /* _LINUX_RANDOM_H */
44046 diff -urNp linux-2.6.33/include/linux/reiserfs_fs.h linux-2.6.33/include/linux/reiserfs_fs.h
44047 --- linux-2.6.33/include/linux/reiserfs_fs.h    2010-02-24 13:52:17.000000000 -0500
44048 +++ linux-2.6.33/include/linux/reiserfs_fs.h    2010-03-07 12:23:36.125670889 -0500
44049 @@ -1404,7 +1404,7 @@ static inline loff_t max_reiserfs_offset
44050  #define REISERFS_USER_MEM              1       /* reiserfs user memory mode            */
44051
44052  #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
44053 -#define get_generation(s) atomic_read (&fs_generation(s))
44054 +#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
44055  #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
44056  #define __fs_changed(gen,s) (gen != get_generation (s))
44057  #define fs_changed(gen,s)              \
44058 @@ -1616,24 +1616,24 @@ static inline struct super_block *sb_fro
44059  */
44060
44061  struct item_operations {
44062 -       int (*bytes_number) (struct item_head * ih, int block_size);
44063 -       void (*decrement_key) (struct cpu_key *);
44064 -       int (*is_left_mergeable) (struct reiserfs_key * ih,
44065 +       int (* const bytes_number) (struct item_head * ih, int block_size);
44066 +       void (* const decrement_key) (struct cpu_key *);
44067 +       int (* const is_left_mergeable) (struct reiserfs_key * ih,
44068                                   unsigned long bsize);
44069 -       void (*print_item) (struct item_head *, char *item);
44070 -       void (*check_item) (struct item_head *, char *item);
44071 +       void (* const print_item) (struct item_head *, char *item);
44072 +       void (* const check_item) (struct item_head *, char *item);
44073
44074 -       int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
44075 +       int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
44076                           int is_affected, int insert_size);
44077 -       int (*check_left) (struct virtual_item * vi, int free,
44078 +       int (* const check_left) (struct virtual_item * vi, int free,
44079                            int start_skip, int end_skip);
44080 -       int (*check_right) (struct virtual_item * vi, int free);
44081 -       int (*part_size) (struct virtual_item * vi, int from, int to);
44082 -       int (*unit_num) (struct virtual_item * vi);
44083 -       void (*print_vi) (struct virtual_item * vi);
44084 +       int (* const check_right) (struct virtual_item * vi, int free);
44085 +       int (* const part_size) (struct virtual_item * vi, int from, int to);
44086 +       int (* const unit_num) (struct virtual_item * vi);
44087 +       void (* const print_vi) (struct virtual_item * vi);
44088  };
44089
44090 -extern struct item_operations *item_ops[TYPE_ANY + 1];
44091 +extern const struct item_operations * const item_ops[TYPE_ANY + 1];
44092
44093  #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
44094  #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
44095 diff -urNp linux-2.6.33/include/linux/reiserfs_fs_sb.h linux-2.6.33/include/linux/reiserfs_fs_sb.h
44096 --- linux-2.6.33/include/linux/reiserfs_fs_sb.h 2010-02-24 13:52:17.000000000 -0500
44097 +++ linux-2.6.33/include/linux/reiserfs_fs_sb.h 2010-03-07 12:23:36.125670889 -0500
44098 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
44099         /* Comment? -Hans */
44100         wait_queue_head_t s_wait;
44101         /* To be obsoleted soon by per buffer seals.. -Hans */
44102 -       atomic_t s_generation_counter;  // increased by one every time the
44103 +       atomic_unchecked_t s_generation_counter;        // increased by one every time the
44104         // tree gets re-balanced
44105         unsigned long s_properties;     /* File system properties. Currently holds
44106                                            on-disk FS format */
44107 diff -urNp linux-2.6.33/include/linux/sched.h linux-2.6.33/include/linux/sched.h
44108 --- linux-2.6.33/include/linux/sched.h  2010-02-24 13:52:17.000000000 -0500
44109 +++ linux-2.6.33/include/linux/sched.h  2010-03-07 12:23:36.125670889 -0500
44110 @@ -101,6 +101,7 @@ struct bio;
44111  struct fs_struct;
44112  struct bts_context;
44113  struct perf_event_context;
44114 +struct linux_binprm;
44115
44116  /*
44117   * List of flags we want to share for kernel threads,
44118 @@ -678,6 +679,15 @@ struct signal_struct {
44119         struct tty_audit_buf *tty_audit_buf;
44120  #endif
44121
44122 +#ifdef CONFIG_GRKERNSEC
44123 +       u32 curr_ip;
44124 +       u32 gr_saddr;
44125 +       u32 gr_daddr;
44126 +       u16 gr_sport;
44127 +       u16 gr_dport;
44128 +       u8 used_accept:1;
44129 +#endif
44130 +
44131         int oom_adj;    /* OOM kill score adjustment (bit shift) */
44132  };
44133
44134 @@ -1231,7 +1241,7 @@ struct rcu_node;
44135
44136  struct task_struct {
44137         volatile long state;    /* -1 unrunnable, 0 runnable, >0 stopped */
44138 -       void *stack;
44139 +       struct thread_info *stack;
44140         atomic_t usage;
44141         unsigned int flags;     /* per process flags, defined below */
44142         unsigned int ptrace;
44143 @@ -1343,8 +1353,8 @@ struct task_struct {
44144         struct list_head thread_group;
44145
44146         struct completion *vfork_done;          /* for vfork() */
44147 -       int __user *set_child_tid;              /* CLONE_CHILD_SETTID */
44148 -       int __user *clear_child_tid;            /* CLONE_CHILD_CLEARTID */
44149 +       pid_t __user *set_child_tid;            /* CLONE_CHILD_SETTID */
44150 +       pid_t __user *clear_child_tid;          /* CLONE_CHILD_CLEARTID */
44151
44152         cputime_t utime, stime, utimescaled, stimescaled;
44153         cputime_t gtime;
44154 @@ -1360,16 +1370,6 @@ struct task_struct {
44155         struct task_cputime cputime_expires;
44156         struct list_head cpu_timers[3];
44157
44158 -/* process credentials */
44159 -       const struct cred *real_cred;   /* objective and real subjective task
44160 -                                        * credentials (COW) */
44161 -       const struct cred *cred;        /* effective (overridable) subjective task
44162 -                                        * credentials (COW) */
44163 -       struct mutex cred_guard_mutex;  /* guard against foreign influences on
44164 -                                        * credential calculations
44165 -                                        * (notably. ptrace) */
44166 -       struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
44167 -
44168         char comm[TASK_COMM_LEN]; /* executable name excluding path
44169                                      - access with [gs]et_task_comm (which lock
44170                                        it with task_lock())
44171 @@ -1453,6 +1453,15 @@ struct task_struct {
44172         int softirqs_enabled;
44173         int softirq_context;
44174  #endif
44175 +
44176 +/* process credentials */
44177 +       const struct cred *real_cred;   /* objective and real subjective task
44178 +                                        * credentials (COW) */
44179 +       struct mutex cred_guard_mutex;  /* guard against foreign influences on
44180 +                                        * credential calculations
44181 +                                        * (notably. ptrace) */
44182 +       struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
44183 +
44184  #ifdef CONFIG_LOCKDEP
44185  # define MAX_LOCK_DEPTH 48UL
44186         u64 curr_chain_key;
44187 @@ -1473,6 +1482,9 @@ struct task_struct {
44188
44189         struct backing_dev_info *backing_dev_info;
44190
44191 +       const struct cred *cred;        /* effective (overridable) subjective task
44192 +                                        * credentials (COW) */
44193 +
44194         struct io_context *io_context;
44195
44196         unsigned long ptrace_message;
44197 @@ -1536,6 +1548,19 @@ struct task_struct {
44198         unsigned long default_timer_slack_ns;
44199
44200         struct list_head        *scm_work_list;
44201 +
44202 +#ifdef CONFIG_GRKERNSEC
44203 +       /* grsecurity */
44204 +       rwlock_t gr_fs_lock;
44205 +       struct acl_subject_label *acl;
44206 +       struct acl_role_label *role;
44207 +       struct file *exec_file;
44208 +       u16 acl_role_id;
44209 +       u8 acl_sp_role;
44210 +       u8 is_writable;
44211 +       u8 brute;
44212 +#endif
44213 +
44214  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
44215         /* Index of current stored adress in ret_stack */
44216         int curr_ret_stack;
44217 @@ -1568,6 +1593,52 @@ struct task_struct {
44218  #endif
44219  };
44220
44221 +#define MF_PAX_PAGEEXEC                0x01000000      /* Paging based non-executable pages */
44222 +#define MF_PAX_EMUTRAMP                0x02000000      /* Emulate trampolines */
44223 +#define MF_PAX_MPROTECT                0x04000000      /* Restrict mprotect() */
44224 +#define MF_PAX_RANDMMAP                0x08000000      /* Randomize mmap() base */
44225 +/*#define MF_PAX_RANDEXEC              0x10000000*/    /* Randomize ET_EXEC base */
44226 +#define MF_PAX_SEGMEXEC                0x20000000      /* Segmentation based non-executable pages */
44227 +
44228 +#ifdef CONFIG_PAX_SOFTMODE
44229 +extern unsigned int pax_softmode;
44230 +#endif
44231 +
44232 +extern int pax_check_flags(unsigned long *);
44233 +
44234 +/* if tsk != current then task_lock must be held on it */
44235 +#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
44236 +static inline unsigned long pax_get_flags(struct task_struct *tsk)
44237 +{
44238 +       if (likely(tsk->mm))
44239 +               return tsk->mm->pax_flags;
44240 +       else
44241 +               return 0UL;
44242 +}
44243 +
44244 +/* if tsk != current then task_lock must be held on it */
44245 +static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
44246 +{
44247 +       if (likely(tsk->mm)) {
44248 +               tsk->mm->pax_flags = flags;
44249 +               return 0;
44250 +       }
44251 +       return -EINVAL;
44252 +}
44253 +#endif
44254 +
44255 +#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
44256 +extern void pax_set_initial_flags(struct linux_binprm *bprm);
44257 +#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
44258 +extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
44259 +#endif
44260 +
44261 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
44262 +void pax_report_insns(void *pc, void *sp);
44263 +void pax_report_refcount_overflow(struct pt_regs *regs);
44264 +void pax_report_leak_to_user(const void *ptr, unsigned long len);
44265 +void pax_report_overflow_from_user(const void *ptr, unsigned long len);
44266 +
44267  /* Future-safe accessor for struct task_struct's cpus_allowed. */
44268  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
44269
44270 @@ -2169,7 +2240,7 @@ extern void __cleanup_sighand(struct sig
44271  extern void exit_itimers(struct signal_struct *);
44272  extern void flush_itimer_signals(void);
44273
44274 -extern NORET_TYPE void do_group_exit(int);
44275 +extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
44276
44277  extern void daemonize(const char *, ...);
44278  extern int allow_signal(int);
44279 @@ -2271,6 +2342,33 @@ static inline void task_unlock(struct ta
44280         spin_unlock(&p->alloc_lock);
44281  }
44282
44283 +/* grsec: protects only ->fs as task_lock is overkill and we can't
44284 +   be using a spin_lock in interrupt context
44285 +*/
44286 +#ifdef CONFIG_GRKERNSEC
44287 +#define gr_fs_write_lock_irqsave(x, y)                         \
44288 +       write_lock_irqsave(&x->gr_fs_lock, y)
44289 +#define gr_fs_write_unlock_irqrestore(x, y)                    \
44290 +       write_unlock_irqrestore(&x->gr_fs_lock, y)
44291 +#else
44292 +#define gr_fs_write_lock_irqsave(x, y)
44293 +#define gr_fs_write_unlock_irqrestore(x, y)
44294 +#endif
44295 +
44296 +static inline void gr_fs_read_lock(struct task_struct *p)
44297 +{
44298 +#ifdef CONFIG_GRKERNSEC
44299 +       read_lock(&p->gr_fs_lock);
44300 +#endif
44301 +}
44302 +
44303 +static inline void gr_fs_read_unlock(struct task_struct *p)
44304 +{
44305 +#ifdef CONFIG_GRKERNSEC
44306 +       read_unlock(&p->gr_fs_lock);
44307 +#endif
44308 +}
44309 +
44310  extern struct sighand_struct *lock_task_sighand(struct task_struct *tsk,
44311                                                         unsigned long *flags);
44312
44313 @@ -2282,8 +2380,8 @@ static inline void unlock_task_sighand(s
44314
44315  #ifndef __HAVE_THREAD_FUNCTIONS
44316
44317 -#define task_thread_info(task) ((struct thread_info *)(task)->stack)
44318 -#define task_stack_page(task)  ((task)->stack)
44319 +#define task_thread_info(task) ((task)->stack)
44320 +#define task_stack_page(task)  ((void *)(task)->stack)
44321
44322  static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
44323  {
44324 @@ -2298,13 +2396,31 @@ static inline unsigned long *end_of_stac
44325
44326  #endif
44327
44328 -static inline int object_is_on_stack(void *obj)
44329 +static inline int object_starts_on_stack(void *obj)
44330  {
44331 -       void *stack = task_stack_page(current);
44332 +       const void *stack = task_stack_page(current);
44333
44334         return (obj >= stack) && (obj < (stack + THREAD_SIZE));
44335  }
44336
44337 +/* 0: not at all, 1: fully, -1: partially (implies an error) */
44338 +static inline int object_is_on_stack(const void *obj, unsigned long len)
44339 +{
44340 +       const void *stack = task_stack_page(current);
44341 +       const void *stackend = stack + THREAD_SIZE;
44342 +
44343 +       if (obj + len < obj)
44344 +               return -1;
44345 +
44346 +       if (stack <= obj && obj + len <= stackend)
44347 +               return 1;
44348 +
44349 +       if (obj + len <= stack || stackend <=  obj)
44350 +               return 0;
44351 +
44352 +       return -1;
44353 +}
44354 +
44355  extern void thread_info_cache_init(void);
44356
44357  #ifdef CONFIG_DEBUG_STACK_USAGE
44358 diff -urNp linux-2.6.33/include/linux/screen_info.h linux-2.6.33/include/linux/screen_info.h
44359 --- linux-2.6.33/include/linux/screen_info.h    2010-02-24 13:52:17.000000000 -0500
44360 +++ linux-2.6.33/include/linux/screen_info.h    2010-03-07 12:23:36.125670889 -0500
44361 @@ -43,7 +43,8 @@ struct screen_info {
44362         __u16 pages;            /* 0x32 */
44363         __u16 vesa_attributes;  /* 0x34 */
44364         __u32 capabilities;     /* 0x36 */
44365 -       __u8  _reserved[6];     /* 0x3a */
44366 +       __u16 vesapm_size;      /* 0x3a */
44367 +       __u8  _reserved[4];     /* 0x3c */
44368  } __attribute__((packed));
44369
44370  #define VIDEO_TYPE_MDA         0x10    /* Monochrome Text Display      */
44371 diff -urNp linux-2.6.33/include/linux/security.h linux-2.6.33/include/linux/security.h
44372 --- linux-2.6.33/include/linux/security.h       2010-02-24 13:52:17.000000000 -0500
44373 +++ linux-2.6.33/include/linux/security.h       2010-03-07 12:23:36.125670889 -0500
44374 @@ -34,6 +34,7 @@
44375  #include <linux/key.h>
44376  #include <linux/xfrm.h>
44377  #include <linux/gfp.h>
44378 +#include <linux/grsecurity.h>
44379  #include <net/flow.h>
44380
44381  /* Maximum number of letters for an LSM name string */
44382 diff -urNp linux-2.6.33/include/linux/shm.h linux-2.6.33/include/linux/shm.h
44383 --- linux-2.6.33/include/linux/shm.h    2010-02-24 13:52:17.000000000 -0500
44384 +++ linux-2.6.33/include/linux/shm.h    2010-03-07 12:23:36.129711674 -0500
44385 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
44386         pid_t                   shm_cprid;
44387         pid_t                   shm_lprid;
44388         struct user_struct      *mlock_user;
44389 +#ifdef CONFIG_GRKERNSEC
44390 +       time_t                  shm_createtime;
44391 +       pid_t                   shm_lapid;
44392 +#endif
44393  };
44394
44395  /* shm_mode upper byte flags */
44396 diff -urNp linux-2.6.33/include/linux/slab.h linux-2.6.33/include/linux/slab.h
44397 --- linux-2.6.33/include/linux/slab.h   2010-02-24 13:52:17.000000000 -0500
44398 +++ linux-2.6.33/include/linux/slab.h   2010-03-07 12:23:36.129711674 -0500
44399 @@ -11,6 +11,7 @@
44400
44401  #include <linux/gfp.h>
44402  #include <linux/types.h>
44403 +#include <linux/err.h>
44404
44405  /*
44406   * Flags to pass to kmem_cache_create().
44407 @@ -82,10 +83,13 @@
44408   * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
44409   * Both make kfree a no-op.
44410   */
44411 -#define ZERO_SIZE_PTR ((void *)16)
44412 +#define ZERO_SIZE_PTR                          \
44413 +({                                             \
44414 +       BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
44415 +       (void *)(-MAX_ERRNO-1L);                \
44416 +})
44417
44418 -#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
44419 -                               (unsigned long)ZERO_SIZE_PTR)
44420 +#define ZERO_OR_NULL_PTR(x) (!(x) || (x) == ZERO_SIZE_PTR)
44421
44422  /*
44423   * struct kmem_cache related prototypes
44424 @@ -138,6 +142,7 @@ void * __must_check krealloc(const void
44425  void kfree(const void *);
44426  void kzfree(const void *);
44427  size_t ksize(const void *);
44428 +void check_object_size(const void *ptr, unsigned long n, bool to);
44429
44430  /*
44431   * Allocator specific definitions. These are mainly used to establish optimized
44432 @@ -328,4 +333,37 @@ static inline void *kzalloc_node(size_t
44433
44434  void __init kmem_cache_init_late(void);
44435
44436 +#define kmalloc(x, y)                                  \
44437 +({                                                     \
44438 +       void *___retval;                                \
44439 +       intoverflow_t ___x = (intoverflow_t)x;          \
44440 +       if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
44441 +               ___retval = NULL;                       \
44442 +       else                                            \
44443 +               ___retval = kmalloc((size_t)___x, (y)); \
44444 +       ___retval;                                      \
44445 +})
44446 +
44447 +#define kmalloc_node(x, y, z)                                  \
44448 +({                                                             \
44449 +       void *___retval;                                        \
44450 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44451 +       if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
44452 +               ___retval = NULL;                               \
44453 +       else                                                    \
44454 +               ___retval = kmalloc_node((size_t)___x, (y), (z));\
44455 +       ___retval;                                              \
44456 +})
44457 +
44458 +#define kzalloc(x, y)                                  \
44459 +({                                                     \
44460 +       void *___retval;                                \
44461 +       intoverflow_t ___x = (intoverflow_t)x;          \
44462 +       if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
44463 +               ___retval = NULL;                       \
44464 +       else                                            \
44465 +               ___retval = kzalloc((size_t)___x, (y)); \
44466 +       ___retval;                                      \
44467 +})
44468 +
44469  #endif /* _LINUX_SLAB_H */
44470 diff -urNp linux-2.6.33/include/linux/slub_def.h linux-2.6.33/include/linux/slub_def.h
44471 --- linux-2.6.33/include/linux/slub_def.h       2010-02-24 13:52:17.000000000 -0500
44472 +++ linux-2.6.33/include/linux/slub_def.h       2010-03-07 12:23:36.129711674 -0500
44473 @@ -86,7 +86,7 @@ struct kmem_cache {
44474         struct kmem_cache_order_objects max;
44475         struct kmem_cache_order_objects min;
44476         gfp_t allocflags;       /* gfp flags to use on each alloc */
44477 -       int refcount;           /* Refcount for slab cache destroy */
44478 +       atomic_t refcount;      /* Refcount for slab cache destroy */
44479         void (*ctor)(void *);
44480         int inuse;              /* Offset to metadata */
44481         int align;              /* Alignment */
44482 diff -urNp linux-2.6.33/include/linux/sonet.h linux-2.6.33/include/linux/sonet.h
44483 --- linux-2.6.33/include/linux/sonet.h  2010-02-24 13:52:17.000000000 -0500
44484 +++ linux-2.6.33/include/linux/sonet.h  2010-03-07 12:23:36.129711674 -0500
44485 @@ -61,7 +61,7 @@ struct sonet_stats {
44486  #include <asm/atomic.h>
44487
44488  struct k_sonet_stats {
44489 -#define __HANDLE_ITEM(i) atomic_t i
44490 +#define __HANDLE_ITEM(i) atomic_unchecked_t i
44491         __SONET_ITEMS
44492  #undef __HANDLE_ITEM
44493  };
44494 diff -urNp linux-2.6.33/include/linux/suspend.h linux-2.6.33/include/linux/suspend.h
44495 --- linux-2.6.33/include/linux/suspend.h        2010-02-24 13:52:17.000000000 -0500
44496 +++ linux-2.6.33/include/linux/suspend.h        2010-03-07 12:23:36.129711674 -0500
44497 @@ -104,15 +104,15 @@ typedef int __bitwise suspend_state_t;
44498   *     which require special recovery actions in that situation.
44499   */
44500  struct platform_suspend_ops {
44501 -       int (*valid)(suspend_state_t state);
44502 -       int (*begin)(suspend_state_t state);
44503 -       int (*prepare)(void);
44504 -       int (*prepare_late)(void);
44505 -       int (*enter)(suspend_state_t state);
44506 -       void (*wake)(void);
44507 -       void (*finish)(void);
44508 -       void (*end)(void);
44509 -       void (*recover)(void);
44510 +       int (* const valid)(suspend_state_t state);
44511 +       int (* const begin)(suspend_state_t state);
44512 +       int (* const prepare)(void);
44513 +       int (* const prepare_late)(void);
44514 +       int (* const enter)(suspend_state_t state);
44515 +       void (* const wake)(void);
44516 +       void (* const finish)(void);
44517 +       void (* const end)(void);
44518 +       void (* const recover)(void);
44519  };
44520
44521  #ifdef CONFIG_SUSPEND
44522 @@ -120,7 +120,7 @@ struct platform_suspend_ops {
44523   * suspend_set_ops - set platform dependent suspend operations
44524   * @ops: The new suspend operations to set.
44525   */
44526 -extern void suspend_set_ops(struct platform_suspend_ops *ops);
44527 +extern void suspend_set_ops(const struct platform_suspend_ops *ops);
44528  extern int suspend_valid_only_mem(suspend_state_t state);
44529
44530  /**
44531 @@ -145,7 +145,7 @@ extern int pm_suspend(suspend_state_t st
44532  #else /* !CONFIG_SUSPEND */
44533  #define suspend_valid_only_mem NULL
44534
44535 -static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
44536 +static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
44537  static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
44538  #endif /* !CONFIG_SUSPEND */
44539
44540 @@ -215,16 +215,16 @@ extern void mark_free_pages(struct zone
44541   *     platforms which require special recovery actions in that situation.
44542   */
44543  struct platform_hibernation_ops {
44544 -       int (*begin)(void);
44545 -       void (*end)(void);
44546 -       int (*pre_snapshot)(void);
44547 -       void (*finish)(void);
44548 -       int (*prepare)(void);
44549 -       int (*enter)(void);
44550 -       void (*leave)(void);
44551 -       int (*pre_restore)(void);
44552 -       void (*restore_cleanup)(void);
44553 -       void (*recover)(void);
44554 +       int (* const begin)(void);
44555 +       void (* const end)(void);
44556 +       int (* const pre_snapshot)(void);
44557 +       void (* const finish)(void);
44558 +       int (* const prepare)(void);
44559 +       int (* const enter)(void);
44560 +       void (* const leave)(void);
44561 +       int (* const pre_restore)(void);
44562 +       void (* const restore_cleanup)(void);
44563 +       void (* const recover)(void);
44564  };
44565
44566  #ifdef CONFIG_HIBERNATION
44567 @@ -243,7 +243,7 @@ extern void swsusp_set_page_free(struct
44568  extern void swsusp_unset_page_free(struct page *);
44569  extern unsigned long get_safe_page(gfp_t gfp_mask);
44570
44571 -extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
44572 +extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
44573  extern int hibernate(void);
44574  extern bool system_entering_hibernation(void);
44575  #else /* CONFIG_HIBERNATION */
44576 @@ -251,7 +251,7 @@ static inline int swsusp_page_is_forbidd
44577  static inline void swsusp_set_page_free(struct page *p) {}
44578  static inline void swsusp_unset_page_free(struct page *p) {}
44579
44580 -static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
44581 +static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
44582  static inline int hibernate(void) { return -ENOSYS; }
44583  static inline bool system_entering_hibernation(void) { return false; }
44584  #endif /* CONFIG_HIBERNATION */
44585 diff -urNp linux-2.6.33/include/linux/sysctl.h linux-2.6.33/include/linux/sysctl.h
44586 --- linux-2.6.33/include/linux/sysctl.h 2010-02-24 13:52:17.000000000 -0500
44587 +++ linux-2.6.33/include/linux/sysctl.h 2010-03-07 12:23:36.129711674 -0500
44588 @@ -155,7 +155,11 @@ enum
44589         KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
44590  };
44591
44592 -
44593 +#ifdef CONFIG_PAX_SOFTMODE
44594 +enum {
44595 +       PAX_SOFTMODE=1          /* PaX: disable/enable soft mode */
44596 +};
44597 +#endif
44598
44599  /* CTL_VM names: */
44600  enum
44601 diff -urNp linux-2.6.33/include/linux/sysfs.h linux-2.6.33/include/linux/sysfs.h
44602 --- linux-2.6.33/include/linux/sysfs.h  2010-02-24 13:52:17.000000000 -0500
44603 +++ linux-2.6.33/include/linux/sysfs.h  2010-03-07 12:23:36.129711674 -0500
44604 @@ -75,8 +75,8 @@ struct bin_attribute {
44605  };
44606
44607  struct sysfs_ops {
44608 -       ssize_t (*show)(struct kobject *, struct attribute *,char *);
44609 -       ssize_t (*store)(struct kobject *,struct attribute *,const char *, size_t);
44610 +       ssize_t (* const show)(struct kobject *, struct attribute *,char *);
44611 +       ssize_t (* const store)(struct kobject *,struct attribute *,const char *, size_t);
44612  };
44613
44614  struct sysfs_dirent;
44615 diff -urNp linux-2.6.33/include/linux/thread_info.h linux-2.6.33/include/linux/thread_info.h
44616 --- linux-2.6.33/include/linux/thread_info.h    2010-02-24 13:52:17.000000000 -0500
44617 +++ linux-2.6.33/include/linux/thread_info.h    2010-03-07 12:23:36.129711674 -0500
44618 @@ -23,7 +23,7 @@ struct restart_block {
44619                 };
44620                 /* For futex_wait and futex_wait_requeue_pi */
44621                 struct {
44622 -                       u32 *uaddr;
44623 +                       u32 __user *uaddr;
44624                         u32 val;
44625                         u32 flags;
44626                         u32 bitset;
44627 diff -urNp linux-2.6.33/include/linux/tty.h linux-2.6.33/include/linux/tty.h
44628 --- linux-2.6.33/include/linux/tty.h    2010-02-24 13:52:17.000000000 -0500
44629 +++ linux-2.6.33/include/linux/tty.h    2010-03-07 12:23:36.129711674 -0500
44630 @@ -13,6 +13,7 @@
44631  #include <linux/tty_driver.h>
44632  #include <linux/tty_ldisc.h>
44633  #include <linux/mutex.h>
44634 +#include <linux/poll.h>
44635
44636  #include <asm/system.h>
44637
44638 @@ -440,7 +441,6 @@ extern int tty_perform_flush(struct tty_
44639  extern dev_t tty_devnum(struct tty_struct *tty);
44640  extern void proc_clear_tty(struct task_struct *p);
44641  extern struct tty_struct *get_current_tty(void);
44642 -extern void tty_default_fops(struct file_operations *fops);
44643  extern struct tty_struct *alloc_tty_struct(void);
44644  extern void free_tty_struct(struct tty_struct *tty);
44645  extern void initialize_tty_struct(struct tty_struct *tty,
44646 @@ -501,6 +501,18 @@ extern void tty_ldisc_begin(void);
44647  /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
44648  extern void tty_ldisc_enable(struct tty_struct *tty);
44649
44650 +/* tty_io.c */
44651 +extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
44652 +extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
44653 +extern unsigned int tty_poll(struct file *, poll_table *);
44654 +#ifdef CONFIG_COMPAT
44655 +extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
44656 +                               unsigned long arg);
44657 +#else
44658 +#define tty_compat_ioctl NULL
44659 +#endif
44660 +extern int tty_release(struct inode *, struct file *);
44661 +extern int tty_fasync(int fd, struct file *filp, int on);
44662
44663  /* n_tty.c */
44664  extern struct tty_ldisc_ops tty_ldisc_N_TTY;
44665 diff -urNp linux-2.6.33/include/linux/tty_ldisc.h linux-2.6.33/include/linux/tty_ldisc.h
44666 --- linux-2.6.33/include/linux/tty_ldisc.h      2010-02-24 13:52:17.000000000 -0500
44667 +++ linux-2.6.33/include/linux/tty_ldisc.h      2010-03-07 12:23:36.129711674 -0500
44668 @@ -139,7 +139,7 @@ struct tty_ldisc_ops {
44669
44670         struct  module *owner;
44671
44672 -       int refcount;
44673 +       atomic_t refcount;
44674  };
44675
44676  struct tty_ldisc {
44677 diff -urNp linux-2.6.33/include/linux/types.h linux-2.6.33/include/linux/types.h
44678 --- linux-2.6.33/include/linux/types.h  2010-02-24 13:52:17.000000000 -0500
44679 +++ linux-2.6.33/include/linux/types.h  2010-03-07 12:23:36.129711674 -0500
44680 @@ -191,10 +191,26 @@ typedef struct {
44681         volatile int counter;
44682  } atomic_t;
44683
44684 +#ifdef CONFIG_PAX_REFCOUNT
44685 +typedef struct {
44686 +       volatile int counter;
44687 +} atomic_unchecked_t;
44688 +#else
44689 +typedef atomic_t atomic_unchecked_t;
44690 +#endif
44691 +
44692  #ifdef CONFIG_64BIT
44693  typedef struct {
44694         volatile long counter;
44695  } atomic64_t;
44696 +
44697 +#ifdef CONFIG_PAX_REFCOUNT
44698 +typedef struct {
44699 +       volatile long counter;
44700 +} atomic64_unchecked_t;
44701 +#else
44702 +typedef atomic64_t atomic64_unchecked_t;
44703 +#endif
44704  #endif
44705
44706  struct ustat {
44707 diff -urNp linux-2.6.33/include/linux/uaccess.h linux-2.6.33/include/linux/uaccess.h
44708 --- linux-2.6.33/include/linux/uaccess.h        2010-02-24 13:52:17.000000000 -0500
44709 +++ linux-2.6.33/include/linux/uaccess.h        2010-03-07 12:23:36.129711674 -0500
44710 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
44711                 long ret;                               \
44712                 mm_segment_t old_fs = get_fs();         \
44713                                                         \
44714 -               set_fs(KERNEL_DS);                      \
44715                 pagefault_disable();                    \
44716 +               set_fs(KERNEL_DS);                      \
44717                 ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));            \
44718 -               pagefault_enable();                     \
44719                 set_fs(old_fs);                         \
44720 +               pagefault_enable();                     \
44721                 ret;                                    \
44722         })
44723
44724 @@ -93,8 +93,8 @@ static inline unsigned long __copy_from_
44725   * Safely read from address @src to the buffer at @dst.  If a kernel fault
44726   * happens, handle that and return -EFAULT.
44727   */
44728 -extern long probe_kernel_read(void *dst, void *src, size_t size);
44729 -extern long __probe_kernel_read(void *dst, void *src, size_t size);
44730 +extern long probe_kernel_read(void *dst, const void *src, size_t size);
44731 +extern long __probe_kernel_read(void *dst, const void *src, size_t size);
44732
44733  /*
44734   * probe_kernel_write(): safely attempt to write to a location
44735 @@ -105,7 +105,7 @@ extern long __probe_kernel_read(void *ds
44736   * Safely write to address @dst from the buffer at @src.  If a kernel fault
44737   * happens, handle that and return -EFAULT.
44738   */
44739 -extern long notrace probe_kernel_write(void *dst, void *src, size_t size);
44740 -extern long notrace __probe_kernel_write(void *dst, void *src, size_t size);
44741 +extern long notrace probe_kernel_write(void *dst, const void *src, size_t size);
44742 +extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
44743
44744  #endif         /* __LINUX_UACCESS_H__ */
44745 diff -urNp linux-2.6.33/include/linux/vmalloc.h linux-2.6.33/include/linux/vmalloc.h
44746 --- linux-2.6.33/include/linux/vmalloc.h        2010-02-24 13:52:17.000000000 -0500
44747 +++ linux-2.6.33/include/linux/vmalloc.h        2010-03-07 12:23:36.129711674 -0500
44748 @@ -13,6 +13,11 @@ struct vm_area_struct;               /* vma defining
44749  #define VM_MAP         0x00000004      /* vmap()ed pages */
44750  #define VM_USERMAP     0x00000008      /* suitable for remap_vmalloc_range */
44751  #define VM_VPAGES      0x00000010      /* buffer for pages was vmalloc'ed */
44752 +
44753 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
44754 +#define VM_KERNEXEC    0x00000020      /* allocate from executable kernel memory range */
44755 +#endif
44756 +
44757  /* bits [20..32] reserved for arch specific ioremap internals */
44758
44759  /*
44760 @@ -121,4 +126,81 @@ struct vm_struct **pcpu_get_vm_areas(con
44761
44762  void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
44763
44764 +#define vmalloc(x)                                             \
44765 +({                                                             \
44766 +       void *___retval;                                        \
44767 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44768 +       if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))  \
44769 +               ___retval = NULL;                               \
44770 +       else                                                    \
44771 +               ___retval = vmalloc((unsigned long)___x);       \
44772 +       ___retval;                                              \
44773 +})
44774 +
44775 +#define __vmalloc(x, y, z)                                     \
44776 +({                                                             \
44777 +       void *___retval;                                        \
44778 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44779 +       if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
44780 +               ___retval = NULL;                               \
44781 +       else                                                    \
44782 +               ___retval = __vmalloc((unsigned long)___x, (y), (z));\
44783 +       ___retval;                                              \
44784 +})
44785 +
44786 +#define vmalloc_user(x)                                                \
44787 +({                                                             \
44788 +       void *___retval;                                        \
44789 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44790 +       if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
44791 +               ___retval = NULL;                               \
44792 +       else                                                    \
44793 +               ___retval = vmalloc_user((unsigned long)___x);  \
44794 +       ___retval;                                              \
44795 +})
44796 +
44797 +#define vmalloc_exec(x)                                                \
44798 +({                                                             \
44799 +       void *___retval;                                        \
44800 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44801 +       if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
44802 +               ___retval = NULL;                               \
44803 +       else                                                    \
44804 +               ___retval = vmalloc_exec((unsigned long)___x);  \
44805 +       ___retval;                                              \
44806 +})
44807 +
44808 +#define vmalloc_node(x, y)                                     \
44809 +({                                                             \
44810 +       void *___retval;                                        \
44811 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44812 +       if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
44813 +               ___retval = NULL;                               \
44814 +       else                                                    \
44815 +               ___retval = vmalloc_node((unsigned long)___x, (y));\
44816 +       ___retval;                                              \
44817 +})
44818 +
44819 +#define vmalloc_32(x)                                          \
44820 +({                                                             \
44821 +       void *___retval;                                        \
44822 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44823 +       if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
44824 +               ___retval = NULL;                               \
44825 +       else                                                    \
44826 +               ___retval = vmalloc_32((unsigned long)___x);    \
44827 +       ___retval;                                              \
44828 +})
44829 +
44830 +#define vmalloc_32_user(x)                                     \
44831 +({                                                             \
44832 +       void *___retval;                                        \
44833 +       intoverflow_t ___x = (intoverflow_t)x;                  \
44834 +       if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
44835 +               ___retval = NULL;                               \
44836 +       else                                                    \
44837 +               ___retval = vmalloc_32_user((unsigned long)___x);\
44838 +       ___retval;                                              \
44839 +})
44840 +
44841  #endif /* _LINUX_VMALLOC_H */
44842 diff -urNp linux-2.6.33/include/net/irda/ircomm_tty.h linux-2.6.33/include/net/irda/ircomm_tty.h
44843 --- linux-2.6.33/include/net/irda/ircomm_tty.h  2010-02-24 13:52:17.000000000 -0500
44844 +++ linux-2.6.33/include/net/irda/ircomm_tty.h  2010-03-07 12:23:36.129711674 -0500
44845 @@ -105,8 +105,8 @@ struct ircomm_tty_cb {
44846          unsigned short    close_delay;
44847          unsigned short    closing_wait; /* time to wait before closing */
44848
44849 -       int  open_count;
44850 -       int  blocked_open;      /* # of blocked opens */
44851 +       atomic_t open_count;
44852 +       atomic_t blocked_open;  /* # of blocked opens */
44853
44854         /* Protect concurent access to :
44855          *      o self->open_count
44856 diff -urNp linux-2.6.33/include/net/neighbour.h linux-2.6.33/include/net/neighbour.h
44857 --- linux-2.6.33/include/net/neighbour.h        2010-02-24 13:52:17.000000000 -0500
44858 +++ linux-2.6.33/include/net/neighbour.h        2010-03-07 12:23:36.129711674 -0500
44859 @@ -116,12 +116,12 @@ struct neighbour {
44860
44861  struct neigh_ops {
44862         int                     family;
44863 -       void                    (*solicit)(struct neighbour *, struct sk_buff*);
44864 -       void                    (*error_report)(struct neighbour *, struct sk_buff*);
44865 -       int                     (*output)(struct sk_buff*);
44866 -       int                     (*connected_output)(struct sk_buff*);
44867 -       int                     (*hh_output)(struct sk_buff*);
44868 -       int                     (*queue_xmit)(struct sk_buff*);
44869 +       void                    (* const solicit)(struct neighbour *, struct sk_buff*);
44870 +       void                    (* const error_report)(struct neighbour *, struct sk_buff*);
44871 +       int                     (* const output)(struct sk_buff*);
44872 +       int                     (* const connected_output)(struct sk_buff*);
44873 +       int                     (* const hh_output)(struct sk_buff*);
44874 +       int                     (* const queue_xmit)(struct sk_buff*);
44875  };
44876
44877  struct pneigh_entry {
44878 diff -urNp linux-2.6.33/include/net/sctp/sctp.h linux-2.6.33/include/net/sctp/sctp.h
44879 --- linux-2.6.33/include/net/sctp/sctp.h        2010-02-24 13:52:17.000000000 -0500
44880 +++ linux-2.6.33/include/net/sctp/sctp.h        2010-03-07 12:23:36.129711674 -0500
44881 @@ -304,8 +304,8 @@ extern int sctp_debug_flag;
44882
44883  #else  /* SCTP_DEBUG */
44884
44885 -#define SCTP_DEBUG_PRINTK(whatever...)
44886 -#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
44887 +#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
44888 +#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
44889  #define SCTP_ENABLE_DEBUG
44890  #define SCTP_DISABLE_DEBUG
44891  #define SCTP_ASSERT(expr, str, func)
44892 diff -urNp linux-2.6.33/include/net/tcp.h linux-2.6.33/include/net/tcp.h
44893 --- linux-2.6.33/include/net/tcp.h      2010-02-24 13:52:17.000000000 -0500
44894 +++ linux-2.6.33/include/net/tcp.h      2010-03-07 12:23:36.129711674 -0500
44895 @@ -1392,6 +1392,7 @@ enum tcp_seq_states {
44896  struct tcp_seq_afinfo {
44897         char                    *name;
44898         sa_family_t             family;
44899 +       /* cannot be const */
44900         struct file_operations  seq_fops;
44901         struct seq_operations   seq_ops;
44902  };
44903 diff -urNp linux-2.6.33/include/net/udp.h linux-2.6.33/include/net/udp.h
44904 --- linux-2.6.33/include/net/udp.h      2010-02-24 13:52:17.000000000 -0500
44905 +++ linux-2.6.33/include/net/udp.h      2010-03-07 12:23:36.129711674 -0500
44906 @@ -221,6 +221,7 @@ struct udp_seq_afinfo {
44907         char                    *name;
44908         sa_family_t             family;
44909         struct udp_table        *udp_table;
44910 +       /* cannot be const */
44911         struct file_operations  seq_fops;
44912         struct seq_operations   seq_ops;
44913  };
44914 diff -urNp linux-2.6.33/include/sound/ac97_codec.h linux-2.6.33/include/sound/ac97_codec.h
44915 --- linux-2.6.33/include/sound/ac97_codec.h     2010-02-24 13:52:17.000000000 -0500
44916 +++ linux-2.6.33/include/sound/ac97_codec.h     2010-03-07 12:23:36.129711674 -0500
44917 @@ -419,15 +419,15 @@
44918  struct snd_ac97;
44919
44920  struct snd_ac97_build_ops {
44921 -       int (*build_3d) (struct snd_ac97 *ac97);
44922 -       int (*build_specific) (struct snd_ac97 *ac97);
44923 -       int (*build_spdif) (struct snd_ac97 *ac97);
44924 -       int (*build_post_spdif) (struct snd_ac97 *ac97);
44925 +       int (* const build_3d) (struct snd_ac97 *ac97);
44926 +       int (* const build_specific) (struct snd_ac97 *ac97);
44927 +       int (* const build_spdif) (struct snd_ac97 *ac97);
44928 +       int (* const build_post_spdif) (struct snd_ac97 *ac97);
44929  #ifdef CONFIG_PM
44930 -       void (*suspend) (struct snd_ac97 *ac97);
44931 -       void (*resume) (struct snd_ac97 *ac97);
44932 +       void (* const suspend) (struct snd_ac97 *ac97);
44933 +       void (* const resume) (struct snd_ac97 *ac97);
44934  #endif
44935 -       void (*update_jacks) (struct snd_ac97 *ac97);   /* for jack-sharing */
44936 +       void (* const update_jacks) (struct snd_ac97 *ac97);    /* for jack-sharing */
44937  };
44938
44939  struct snd_ac97_bus_ops {
44940 @@ -477,7 +477,7 @@ struct snd_ac97_template {
44941
44942  struct snd_ac97 {
44943         /* -- lowlevel (hardware) driver specific -- */
44944 -       struct snd_ac97_build_ops * build_ops;
44945 +       const struct snd_ac97_build_ops * build_ops;
44946         void *private_data;
44947         void (*private_free) (struct snd_ac97 *ac97);
44948         /* --- */
44949 diff -urNp linux-2.6.33/include/trace/events/irq.h linux-2.6.33/include/trace/events/irq.h
44950 --- linux-2.6.33/include/trace/events/irq.h     2010-02-24 13:52:17.000000000 -0500
44951 +++ linux-2.6.33/include/trace/events/irq.h     2010-03-07 12:23:36.129711674 -0500
44952 @@ -34,7 +34,7 @@
44953   */
44954  TRACE_EVENT(irq_handler_entry,
44955
44956 -       TP_PROTO(int irq, struct irqaction *action),
44957 +       TP_PROTO(int irq, const struct irqaction *action),
44958
44959         TP_ARGS(irq, action),
44960
44961 @@ -64,7 +64,7 @@ TRACE_EVENT(irq_handler_entry,
44962   */
44963  TRACE_EVENT(irq_handler_exit,
44964
44965 -       TP_PROTO(int irq, struct irqaction *action, int ret),
44966 +       TP_PROTO(int irq, const struct irqaction *action, int ret),
44967
44968         TP_ARGS(irq, action, ret),
44969
44970 @@ -84,7 +84,7 @@ TRACE_EVENT(irq_handler_exit,
44971
44972  DECLARE_EVENT_CLASS(softirq,
44973
44974 -       TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
44975 +       TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
44976
44977         TP_ARGS(h, vec),
44978
44979 @@ -113,7 +113,7 @@ DECLARE_EVENT_CLASS(softirq,
44980   */
44981  DEFINE_EVENT(softirq, softirq_entry,
44982
44983 -       TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
44984 +       TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
44985
44986         TP_ARGS(h, vec)
44987  );
44988 @@ -131,7 +131,7 @@ DEFINE_EVENT(softirq, softirq_entry,
44989   */
44990  DEFINE_EVENT(softirq, softirq_exit,
44991
44992 -       TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
44993 +       TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
44994
44995         TP_ARGS(h, vec)
44996  );
44997 diff -urNp linux-2.6.33/include/video/uvesafb.h linux-2.6.33/include/video/uvesafb.h
44998 --- linux-2.6.33/include/video/uvesafb.h        2010-02-24 13:52:17.000000000 -0500
44999 +++ linux-2.6.33/include/video/uvesafb.h        2010-03-07 12:23:36.129711674 -0500
45000 @@ -177,6 +177,7 @@ struct uvesafb_par {
45001         u8 ypan;                        /* 0 - nothing, 1 - ypan, 2 - ywrap */
45002         u8 pmi_setpal;                  /* PMI for palette changes */
45003         u16 *pmi_base;                  /* protected mode interface location */
45004 +       u8 *pmi_code;                   /* protected mode code location */
45005         void *pmi_start;
45006         void *pmi_pal;
45007         u8 *vbe_state_orig;             /*
45008 diff -urNp linux-2.6.33/init/do_mounts.c linux-2.6.33/init/do_mounts.c
45009 --- linux-2.6.33/init/do_mounts.c       2010-02-24 13:52:17.000000000 -0500
45010 +++ linux-2.6.33/init/do_mounts.c       2010-03-07 12:23:36.133586895 -0500
45011 @@ -216,11 +216,11 @@ static void __init get_fs_names(char *pa
45012
45013  static int __init do_mount_root(char *name, char *fs, int flags, void *data)
45014  {
45015 -       int err = sys_mount(name, "/root", fs, flags, data);
45016 +       int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
45017         if (err)
45018                 return err;
45019
45020 -       sys_chdir("/root");
45021 +       sys_chdir((__force char __user *)"/root");
45022         ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
45023         printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
45024                current->fs->pwd.mnt->mnt_sb->s_type->name,
45025 @@ -311,18 +311,18 @@ void __init change_floppy(char *fmt, ...
45026         va_start(args, fmt);
45027         vsprintf(buf, fmt, args);
45028         va_end(args);
45029 -       fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
45030 +       fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
45031         if (fd >= 0) {
45032                 sys_ioctl(fd, FDEJECT, 0);
45033                 sys_close(fd);
45034         }
45035         printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
45036 -       fd = sys_open("/dev/console", O_RDWR, 0);
45037 +       fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
45038         if (fd >= 0) {
45039                 sys_ioctl(fd, TCGETS, (long)&termios);
45040                 termios.c_lflag &= ~ICANON;
45041                 sys_ioctl(fd, TCSETSF, (long)&termios);
45042 -               sys_read(fd, &c, 1);
45043 +               sys_read(fd, (char __user *)&c, 1);
45044                 termios.c_lflag |= ICANON;
45045                 sys_ioctl(fd, TCSETSF, (long)&termios);
45046                 sys_close(fd);
45047 @@ -416,6 +416,6 @@ void __init prepare_namespace(void)
45048         mount_root();
45049  out:
45050         devtmpfs_mount("dev");
45051 -       sys_mount(".", "/", NULL, MS_MOVE, NULL);
45052 -       sys_chroot(".");
45053 +       sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
45054 +       sys_chroot((__force char __user *)".");
45055  }
45056 diff -urNp linux-2.6.33/init/do_mounts.h linux-2.6.33/init/do_mounts.h
45057 --- linux-2.6.33/init/do_mounts.h       2010-02-24 13:52:17.000000000 -0500
45058 +++ linux-2.6.33/init/do_mounts.h       2010-03-07 12:23:36.133586895 -0500
45059 @@ -15,15 +15,15 @@ extern int root_mountflags;
45060
45061  static inline int create_dev(char *name, dev_t dev)
45062  {
45063 -       sys_unlink(name);
45064 -       return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
45065 +       sys_unlink((__force char __user *)name);
45066 +       return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
45067  }
45068
45069  #if BITS_PER_LONG == 32
45070  static inline u32 bstat(char *name)
45071  {
45072         struct stat64 stat;
45073 -       if (sys_stat64(name, &stat) != 0)
45074 +       if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
45075                 return 0;
45076         if (!S_ISBLK(stat.st_mode))
45077                 return 0;
45078 diff -urNp linux-2.6.33/init/do_mounts_initrd.c linux-2.6.33/init/do_mounts_initrd.c
45079 --- linux-2.6.33/init/do_mounts_initrd.c        2010-02-24 13:52:17.000000000 -0500
45080 +++ linux-2.6.33/init/do_mounts_initrd.c        2010-03-07 12:23:36.133586895 -0500
45081 @@ -32,7 +32,7 @@ static int __init do_linuxrc(void * shel
45082         sys_close(old_fd);sys_close(root_fd);
45083         sys_close(0);sys_close(1);sys_close(2);
45084         sys_setsid();
45085 -       (void) sys_open("/dev/console",O_RDWR,0);
45086 +       (void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
45087         (void) sys_dup(0);
45088         (void) sys_dup(0);
45089         return kernel_execve(shell, argv, envp_init);
45090 @@ -47,13 +47,13 @@ static void __init handle_initrd(void)
45091         create_dev("/dev/root.old", Root_RAM0);
45092         /* mount initrd on rootfs' /root */
45093         mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
45094 -       sys_mkdir("/old", 0700);
45095 -       root_fd = sys_open("/", 0, 0);
45096 -       old_fd = sys_open("/old", 0, 0);
45097 +       sys_mkdir((__force const char __user *)"/old", 0700);
45098 +       root_fd = sys_open((__force const char __user *)"/", 0, 0);
45099 +       old_fd = sys_open((__force const char __user *)"/old", 0, 0);
45100         /* move initrd over / and chdir/chroot in initrd root */
45101 -       sys_chdir("/root");
45102 -       sys_mount(".", "/", NULL, MS_MOVE, NULL);
45103 -       sys_chroot(".");
45104 +       sys_chdir((__force const char __user *)"/root");
45105 +       sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
45106 +       sys_chroot((__force const char __user *)".");
45107
45108         /*
45109          * In case that a resume from disk is carried out by linuxrc or one of
45110 @@ -70,15 +70,15 @@ static void __init handle_initrd(void)
45111
45112         /* move initrd to rootfs' /old */
45113         sys_fchdir(old_fd);
45114 -       sys_mount("/", ".", NULL, MS_MOVE, NULL);
45115 +       sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
45116         /* switch root and cwd back to / of rootfs */
45117         sys_fchdir(root_fd);
45118 -       sys_chroot(".");
45119 +       sys_chroot((__force const char __user *)".");
45120         sys_close(old_fd);
45121         sys_close(root_fd);
45122
45123         if (new_decode_dev(real_root_dev) == Root_RAM0) {
45124 -               sys_chdir("/old");
45125 +               sys_chdir((__force const char __user *)"/old");
45126                 return;
45127         }
45128
45129 @@ -86,17 +86,17 @@ static void __init handle_initrd(void)
45130         mount_root();
45131
45132         printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
45133 -       error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
45134 +       error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
45135         if (!error)
45136                 printk("okay\n");
45137         else {
45138 -               int fd = sys_open("/dev/root.old", O_RDWR, 0);
45139 +               int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
45140                 if (error == -ENOENT)
45141                         printk("/initrd does not exist. Ignored.\n");
45142                 else
45143                         printk("failed\n");
45144                 printk(KERN_NOTICE "Unmounting old root\n");
45145 -               sys_umount("/old", MNT_DETACH);
45146 +               sys_umount((__force char __user *)"/old", MNT_DETACH);
45147                 printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
45148                 if (fd < 0) {
45149                         error = fd;
45150 @@ -119,11 +119,11 @@ int __init initrd_load(void)
45151                  * mounted in the normal path.
45152                  */
45153                 if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
45154 -                       sys_unlink("/initrd.image");
45155 +                       sys_unlink((__force const char __user *)"/initrd.image");
45156                         handle_initrd();
45157                         return 1;
45158                 }
45159         }
45160 -       sys_unlink("/initrd.image");
45161 +       sys_unlink((__force const char __user *)"/initrd.image");
45162         return 0;
45163  }
45164 diff -urNp linux-2.6.33/init/do_mounts_md.c linux-2.6.33/init/do_mounts_md.c
45165 --- linux-2.6.33/init/do_mounts_md.c    2010-02-24 13:52:17.000000000 -0500
45166 +++ linux-2.6.33/init/do_mounts_md.c    2010-03-07 12:23:36.133586895 -0500
45167 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
45168                         partitioned ? "_d" : "", minor,
45169                         md_setup_args[ent].device_names);
45170
45171 -               fd = sys_open(name, 0, 0);
45172 +               fd = sys_open((__force char __user *)name, 0, 0);
45173                 if (fd < 0) {
45174                         printk(KERN_ERR "md: open failed - cannot start "
45175                                         "array %s\n", name);
45176 @@ -233,7 +233,7 @@ static void __init md_setup_drive(void)
45177                          * array without it
45178                          */
45179                         sys_close(fd);
45180 -                       fd = sys_open(name, 0, 0);
45181 +                       fd = sys_open((__force char __user *)name, 0, 0);
45182                         sys_ioctl(fd, BLKRRPART, 0);
45183                 }
45184                 sys_close(fd);
45185 @@ -283,7 +283,7 @@ static void __init autodetect_raid(void)
45186
45187         wait_for_device_probe();
45188
45189 -       fd = sys_open("/dev/md0", 0, 0);
45190 +       fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
45191         if (fd >= 0) {
45192                 sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
45193                 sys_close(fd);
45194 diff -urNp linux-2.6.33/init/initramfs.c linux-2.6.33/init/initramfs.c
45195 --- linux-2.6.33/init/initramfs.c       2010-02-24 13:52:17.000000000 -0500
45196 +++ linux-2.6.33/init/initramfs.c       2010-03-07 12:23:36.133586895 -0500
45197 @@ -74,7 +74,7 @@ static void __init free_hash(void)
45198         }
45199  }
45200
45201 -static long __init do_utime(char __user *filename, time_t mtime)
45202 +static long __init do_utime(__force char __user *filename, time_t mtime)
45203  {
45204         struct timespec t[2];
45205
45206 @@ -109,7 +109,7 @@ static void __init dir_utime(void)
45207         struct dir_entry *de, *tmp;
45208         list_for_each_entry_safe(de, tmp, &dir_list, list) {
45209                 list_del(&de->list);
45210 -               do_utime(de->name, de->mtime);
45211 +               do_utime((__force char __user *)de->name, de->mtime);
45212                 kfree(de->name);
45213                 kfree(de);
45214         }
45215 @@ -271,7 +271,7 @@ static int __init maybe_link(void)
45216         if (nlink >= 2) {
45217                 char *old = find_link(major, minor, ino, mode, collected);
45218                 if (old)
45219 -                       return (sys_link(old, collected) < 0) ? -1 : 1;
45220 +                       return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
45221         }
45222         return 0;
45223  }
45224 @@ -280,11 +280,11 @@ static void __init clean_path(char *path
45225  {
45226         struct stat st;
45227
45228 -       if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
45229 +       if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
45230                 if (S_ISDIR(st.st_mode))
45231 -                       sys_rmdir(path);
45232 +                       sys_rmdir((__force char __user *)path);
45233                 else
45234 -                       sys_unlink(path);
45235 +                       sys_unlink((__force char __user *)path);
45236         }
45237  }
45238
45239 @@ -305,7 +305,7 @@ static int __init do_name(void)
45240                         int openflags = O_WRONLY|O_CREAT;
45241                         if (ml != 1)
45242                                 openflags |= O_TRUNC;
45243 -                       wfd = sys_open(collected, openflags, mode);
45244 +                       wfd = sys_open((__force char __user *)collected, openflags, mode);
45245
45246                         if (wfd >= 0) {
45247                                 sys_fchown(wfd, uid, gid);
45248 @@ -317,17 +317,17 @@ static int __init do_name(void)
45249                         }
45250                 }
45251         } else if (S_ISDIR(mode)) {
45252 -               sys_mkdir(collected, mode);
45253 -               sys_chown(collected, uid, gid);
45254 -               sys_chmod(collected, mode);
45255 +               sys_mkdir((__force char __user *)collected, mode);
45256 +               sys_chown((__force char __user *)collected, uid, gid);
45257 +               sys_chmod((__force char __user *)collected, mode);
45258                 dir_add(collected, mtime);
45259         } else if (S_ISBLK(mode) || S_ISCHR(mode) ||
45260                    S_ISFIFO(mode) || S_ISSOCK(mode)) {
45261                 if (maybe_link() == 0) {
45262 -                       sys_mknod(collected, mode, rdev);
45263 -                       sys_chown(collected, uid, gid);
45264 -                       sys_chmod(collected, mode);
45265 -                       do_utime(collected, mtime);
45266 +                       sys_mknod((__force char __user *)collected, mode, rdev);
45267 +                       sys_chown((__force char __user *)collected, uid, gid);
45268 +                       sys_chmod((__force char __user *)collected, mode);
45269 +                       do_utime((__force char __user *)collected, mtime);
45270                 }
45271         }
45272         return 0;
45273 @@ -336,15 +336,15 @@ static int __init do_name(void)
45274  static int __init do_copy(void)
45275  {
45276         if (count >= body_len) {
45277 -               sys_write(wfd, victim, body_len);
45278 +               sys_write(wfd, (__force char __user *)victim, body_len);
45279                 sys_close(wfd);
45280 -               do_utime(vcollected, mtime);
45281 +               do_utime((__force char __user *)vcollected, mtime);
45282                 kfree(vcollected);
45283                 eat(body_len);
45284                 state = SkipIt;
45285                 return 0;
45286         } else {
45287 -               sys_write(wfd, victim, count);
45288 +               sys_write(wfd, (__force char __user *)victim, count);
45289                 body_len -= count;
45290                 eat(count);
45291                 return 1;
45292 @@ -355,9 +355,9 @@ static int __init do_symlink(void)
45293  {
45294         collected[N_ALIGN(name_len) + body_len] = '\0';
45295         clean_path(collected, 0);
45296 -       sys_symlink(collected + N_ALIGN(name_len), collected);
45297 -       sys_lchown(collected, uid, gid);
45298 -       do_utime(collected, mtime);
45299 +       sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
45300 +       sys_lchown((__force char __user *)collected, uid, gid);
45301 +       do_utime((__force char __user *)collected, mtime);
45302         state = SkipIt;
45303         next_state = Reset;
45304         return 0;
45305 diff -urNp linux-2.6.33/init/Kconfig linux-2.6.33/init/Kconfig
45306 --- linux-2.6.33/init/Kconfig   2010-02-24 13:52:17.000000000 -0500
45307 +++ linux-2.6.33/init/Kconfig   2010-03-07 12:23:36.133586895 -0500
45308 @@ -1046,7 +1046,7 @@ config SLUB_DEBUG
45309
45310  config COMPAT_BRK
45311         bool "Disable heap randomization"
45312 -       default y
45313 +       default n
45314         help
45315           Randomizing heap placement makes heap exploits harder, but it
45316           also breaks ancient binaries (including anything libc5 based).
45317 @@ -1158,9 +1158,9 @@ config HAVE_GENERIC_DMA_COHERENT
45318
45319  config SLABINFO
45320         bool
45321 -       depends on PROC_FS
45322 +       depends on PROC_FS && !GRKERNSEC_PROC_ADD
45323         depends on SLAB || SLUB_DEBUG
45324 -       default y
45325 +       default n
45326
45327  config RT_MUTEXES
45328         boolean
45329 diff -urNp linux-2.6.33/init/main.c linux-2.6.33/init/main.c
45330 --- linux-2.6.33/init/main.c    2010-02-24 13:52:17.000000000 -0500
45331 +++ linux-2.6.33/init/main.c    2010-03-07 12:23:36.133586895 -0500
45332 @@ -97,6 +97,7 @@ static inline void mark_rodata_ro(void)
45333  #ifdef CONFIG_TC
45334  extern void tc_init(void);
45335  #endif
45336 +extern void grsecurity_init(void);
45337
45338  enum system_states system_state __read_mostly;
45339  EXPORT_SYMBOL(system_state);
45340 @@ -183,6 +184,35 @@ static int __init set_reset_devices(char
45341
45342  __setup("reset_devices", set_reset_devices);
45343
45344 +#if defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32)
45345 +static int __init setup_pax_nouderef(char *str)
45346 +{
45347 +       unsigned int cpu;
45348 +
45349 +       for (cpu = 0; cpu < NR_CPUS; cpu++) {
45350 +               get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
45351 +               get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
45352 +       }
45353 +       asm("mov %0, %%ds" : : "r" (__KERNEL_DS) : "memory");
45354 +       asm("mov %0, %%es" : : "r" (__KERNEL_DS) : "memory");
45355 +       asm("mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
45356 +
45357 +       return 0;
45358 +}
45359 +early_param("pax_nouderef", setup_pax_nouderef);
45360 +#endif
45361 +
45362 +#ifdef CONFIG_PAX_SOFTMODE
45363 +unsigned int pax_softmode;
45364 +
45365 +static int __init setup_pax_softmode(char *str)
45366 +{
45367 +       get_option(&str, &pax_softmode);
45368 +       return 1;
45369 +}
45370 +__setup("pax_softmode=", setup_pax_softmode);
45371 +#endif
45372 +
45373  static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
45374  char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
45375  static const char *panic_later, *panic_param;
45376 @@ -697,52 +727,53 @@ int initcall_debug;
45377  core_param(initcall_debug, initcall_debug, bool, 0644);
45378
45379  static char msgbuf[64];
45380 -static struct boot_trace_call call;
45381 -static struct boot_trace_ret ret;
45382 +static struct boot_trace_call trace_call;
45383 +static struct boot_trace_ret trace_ret;
45384
45385  int do_one_initcall(initcall_t fn)
45386  {
45387         int count = preempt_count();
45388         ktime_t calltime, delta, rettime;
45389 +       const char *msg1 = "", *msg2 = "";
45390
45391         if (initcall_debug) {
45392 -               call.caller = task_pid_nr(current);
45393 -               printk("calling  %pF @ %i\n", fn, call.caller);
45394 +               trace_call.caller = task_pid_nr(current);
45395 +               printk("calling  %pF @ %i\n", fn, trace_call.caller);
45396                 calltime = ktime_get();
45397 -               trace_boot_call(&call, fn);
45398 +               trace_boot_call(&trace_call, fn);
45399                 enable_boot_trace();
45400         }
45401
45402 -       ret.result = fn();
45403 +       trace_ret.result = fn();
45404
45405         if (initcall_debug) {
45406                 disable_boot_trace();
45407                 rettime = ktime_get();
45408                 delta = ktime_sub(rettime, calltime);
45409 -               ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
45410 -               trace_boot_ret(&ret, fn);
45411 +               trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
45412 +               trace_boot_ret(&trace_ret, fn);
45413                 printk("initcall %pF returned %d after %Ld usecs\n", fn,
45414 -                       ret.result, ret.duration);
45415 +                       trace_ret.result, trace_ret.duration);
45416         }
45417
45418         msgbuf[0] = 0;
45419
45420 -       if (ret.result && ret.result != -ENODEV && initcall_debug)
45421 -               sprintf(msgbuf, "error code %d ", ret.result);
45422 +       if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
45423 +               sprintf(msgbuf, "error code %d ", trace_ret.result);
45424
45425         if (preempt_count() != count) {
45426 -               strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
45427 +               msg1 = " preemption imbalance";
45428                 preempt_count() = count;
45429         }
45430         if (irqs_disabled()) {
45431 -               strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
45432 +               msg2 = " disabled interrupts";
45433                 local_irq_enable();
45434         }
45435 -       if (msgbuf[0]) {
45436 -               printk("initcall %pF returned with %s\n", fn, msgbuf);
45437 +       if (msgbuf[0] || *msg1 || *msg2) {
45438 +               printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
45439         }
45440
45441 -       return ret.result;
45442 +       return trace_ret.result;
45443  }
45444
45445
45446 @@ -881,11 +912,13 @@ static int __init kernel_init(void * unu
45447         if (!ramdisk_execute_command)
45448                 ramdisk_execute_command = "/init";
45449
45450 -       if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
45451 +       if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
45452                 ramdisk_execute_command = NULL;
45453                 prepare_namespace();
45454         }
45455
45456 +       grsecurity_init();
45457 +
45458         /*
45459          * Ok, we have completed the initial bootup, and
45460          * we're essentially up and running. Get rid of the
45461 diff -urNp linux-2.6.33/init/noinitramfs.c linux-2.6.33/init/noinitramfs.c
45462 --- linux-2.6.33/init/noinitramfs.c     2010-02-24 13:52:17.000000000 -0500
45463 +++ linux-2.6.33/init/noinitramfs.c     2010-03-07 12:23:36.133586895 -0500
45464 @@ -29,7 +29,7 @@ static int __init default_rootfs(void)
45465  {
45466         int err;
45467
45468 -       err = sys_mkdir("/dev", 0755);
45469 +       err = sys_mkdir((const char __user *)"/dev", 0755);
45470         if (err < 0)
45471                 goto out;
45472
45473 @@ -39,7 +39,7 @@ static int __init default_rootfs(void)
45474         if (err < 0)
45475                 goto out;
45476
45477 -       err = sys_mkdir("/root", 0700);
45478 +       err = sys_mkdir((const char __user *)"/root", 0700);
45479         if (err < 0)
45480                 goto out;
45481
45482 diff -urNp linux-2.6.33/ipc/mqueue.c linux-2.6.33/ipc/mqueue.c
45483 --- linux-2.6.33/ipc/mqueue.c   2010-02-24 13:52:17.000000000 -0500
45484 +++ linux-2.6.33/ipc/mqueue.c   2010-03-07 12:23:36.133586895 -0500
45485 @@ -149,6 +149,7 @@ static struct inode *mqueue_get_inode(st
45486                         mq_bytes = (mq_msg_tblsz +
45487                                 (info->attr.mq_maxmsg * info->attr.mq_msgsize));
45488
45489 +                       gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
45490                         spin_lock(&mq_lock);
45491                         if (u->mq_bytes + mq_bytes < u->mq_bytes ||
45492                             u->mq_bytes + mq_bytes >
45493 diff -urNp linux-2.6.33/ipc/shm.c linux-2.6.33/ipc/shm.c
45494 --- linux-2.6.33/ipc/shm.c      2010-02-24 13:52:17.000000000 -0500
45495 +++ linux-2.6.33/ipc/shm.c      2010-03-07 12:23:36.133586895 -0500
45496 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
45497  static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
45498  #endif
45499
45500 +#ifdef CONFIG_GRKERNSEC
45501 +extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
45502 +                          const time_t shm_createtime, const uid_t cuid,
45503 +                          const int shmid);
45504 +extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
45505 +                          const time_t shm_createtime);
45506 +#endif
45507 +
45508  void shm_init_ns(struct ipc_namespace *ns)
45509  {
45510         ns->shm_ctlmax = SHMMAX;
45511 @@ -398,6 +406,14 @@ static int newseg(struct ipc_namespace *
45512         shp->shm_lprid = 0;
45513         shp->shm_atim = shp->shm_dtim = 0;
45514         shp->shm_ctim = get_seconds();
45515 +#ifdef CONFIG_GRKERNSEC
45516 +       {
45517 +               struct timespec timeval;
45518 +               do_posix_clock_monotonic_gettime(&timeval);
45519 +
45520 +               shp->shm_createtime = timeval.tv_sec;
45521 +       }
45522 +#endif
45523         shp->shm_segsz = size;
45524         shp->shm_nattch = 0;
45525         shp->shm_file = file;
45526 @@ -881,9 +897,21 @@ long do_shmat(int shmid, char __user *sh
45527         if (err)
45528                 goto out_unlock;
45529
45530 +#ifdef CONFIG_GRKERNSEC
45531 +       if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
45532 +                            shp->shm_perm.cuid, shmid) ||
45533 +           !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
45534 +               err = -EACCES;
45535 +               goto out_unlock;
45536 +       }
45537 +#endif
45538 +
45539         path = shp->shm_file->f_path;
45540         path_get(&path);
45541         shp->shm_nattch++;
45542 +#ifdef CONFIG_GRKERNSEC
45543 +       shp->shm_lapid = current->pid;
45544 +#endif
45545         size = i_size_read(path.dentry->d_inode);
45546         shm_unlock(shp);
45547
45548 diff -urNp linux-2.6.33/kernel/acct.c linux-2.6.33/kernel/acct.c
45549 --- linux-2.6.33/kernel/acct.c  2010-02-24 13:52:17.000000000 -0500
45550 +++ linux-2.6.33/kernel/acct.c  2010-03-07 12:23:36.133586895 -0500
45551 @@ -579,7 +579,7 @@ static void do_acct_process(struct bsd_a
45552          */
45553         flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
45554         current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
45555 -       file->f_op->write(file, (char *)&ac,
45556 +       file->f_op->write(file, (__force char __user *)&ac,
45557                                sizeof(acct_t), &file->f_pos);
45558         current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
45559         set_fs(fs);
45560 diff -urNp linux-2.6.33/kernel/capability.c linux-2.6.33/kernel/capability.c
45561 --- linux-2.6.33/kernel/capability.c    2010-02-24 13:52:17.000000000 -0500
45562 +++ linux-2.6.33/kernel/capability.c    2010-03-07 12:23:36.133586895 -0500
45563 @@ -206,6 +206,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
45564                  * before modification is attempted and the application
45565                  * fails.
45566                  */
45567 +               if (tocopy > ARRAY_SIZE(kdata))
45568 +                       return -EFAULT;
45569 +
45570                 if (copy_to_user(dataptr, kdata, tocopy
45571                                  * sizeof(struct __user_cap_data_struct))) {
45572                         return -EFAULT;
45573 @@ -307,10 +310,21 @@ int capable(int cap)
45574                 BUG();
45575         }
45576
45577 -       if (security_capable(cap) == 0) {
45578 +       if (security_capable(cap) == 0 && gr_is_capable(cap)) {
45579 +               current->flags |= PF_SUPERPRIV;
45580 +               return 1;
45581 +       }
45582 +       return 0;
45583 +}
45584 +
45585 +int capable_nolog(int cap)
45586 +{
45587 +       if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
45588                 current->flags |= PF_SUPERPRIV;
45589                 return 1;
45590         }
45591         return 0;
45592  }
45593 +
45594  EXPORT_SYMBOL(capable);
45595 +EXPORT_SYMBOL(capable_nolog);
45596 diff -urNp linux-2.6.33/kernel/configs.c linux-2.6.33/kernel/configs.c
45597 --- linux-2.6.33/kernel/configs.c       2010-02-24 13:52:17.000000000 -0500
45598 +++ linux-2.6.33/kernel/configs.c       2010-03-07 12:23:36.133586895 -0500
45599 @@ -73,8 +73,19 @@ static int __init ikconfig_init(void)
45600         struct proc_dir_entry *entry;
45601
45602         /* create the current config file */
45603 +#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
45604 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
45605 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
45606 +                           &ikconfig_file_ops);
45607 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
45608 +       entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
45609 +                           &ikconfig_file_ops);
45610 +#endif
45611 +#else
45612         entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
45613                             &ikconfig_file_ops);
45614 +#endif
45615 +
45616         if (!entry)
45617                 return -ENOMEM;
45618
45619 diff -urNp linux-2.6.33/kernel/cpu.c linux-2.6.33/kernel/cpu.c
45620 --- linux-2.6.33/kernel/cpu.c   2010-02-24 13:52:17.000000000 -0500
45621 +++ linux-2.6.33/kernel/cpu.c   2010-03-07 12:23:36.133586895 -0500
45622 @@ -19,7 +19,7 @@
45623  /* Serializes the updates to cpu_online_mask, cpu_present_mask */
45624  static DEFINE_MUTEX(cpu_add_remove_lock);
45625
45626 -static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
45627 +static RAW_NOTIFIER_HEAD(cpu_chain);
45628
45629  /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
45630   * Should always be manipulated under cpu_add_remove_lock
45631 diff -urNp linux-2.6.33/kernel/cred.c linux-2.6.33/kernel/cred.c
45632 --- linux-2.6.33/kernel/cred.c  2010-02-24 13:52:17.000000000 -0500
45633 +++ linux-2.6.33/kernel/cred.c  2010-03-07 12:23:36.133586895 -0500
45634 @@ -520,6 +520,8 @@ int commit_creds(struct cred *new)
45635
45636         get_cred(new); /* we will require a ref for the subj creds too */
45637
45638 +       gr_set_role_label(task, new->uid, new->gid);
45639 +
45640         /* dumpability changes */
45641         if (old->euid != new->euid ||
45642             old->egid != new->egid ||
45643 diff -urNp linux-2.6.33/kernel/exit.c linux-2.6.33/kernel/exit.c
45644 --- linux-2.6.33/kernel/exit.c  2010-02-24 13:52:17.000000000 -0500
45645 +++ linux-2.6.33/kernel/exit.c  2010-03-07 12:23:36.133586895 -0500
45646 @@ -57,6 +57,10 @@
45647  #include <asm/mmu_context.h>
45648  #include "cred-internals.h"
45649
45650 +#ifdef CONFIG_GRKERNSEC
45651 +extern rwlock_t grsec_exec_file_lock;
45652 +#endif
45653 +
45654  static void exit_mm(struct task_struct * tsk);
45655
45656  static void __unhash_process(struct task_struct *p)
45657 @@ -168,6 +172,8 @@ void release_task(struct task_struct * p
45658         struct task_struct *leader;
45659         int zap_leader;
45660  repeat:
45661 +       gr_del_task_from_ip_table(p);
45662 +
45663         tracehook_prepare_release_task(p);
45664         /* don't need to get the RCU readlock here - the process is dead and
45665          * can't be modifying its own credentials */
45666 @@ -335,11 +341,22 @@ static void reparent_to_kthreadd(void)
45667  {
45668         write_lock_irq(&tasklist_lock);
45669
45670 +#ifdef CONFIG_GRKERNSEC
45671 +       write_lock(&grsec_exec_file_lock);
45672 +       if (current->exec_file) {
45673 +               fput(current->exec_file);
45674 +               current->exec_file = NULL;
45675 +       }
45676 +       write_unlock(&grsec_exec_file_lock);
45677 +#endif
45678 +
45679         ptrace_unlink(current);
45680         /* Reparent to init */
45681         current->real_parent = current->parent = kthreadd_task;
45682         list_move_tail(&current->sibling, &current->real_parent->children);
45683
45684 +       gr_set_kernel_label(current);
45685 +
45686         /* Set the exit signal to SIGCHLD so we signal init on exit */
45687         current->exit_signal = SIGCHLD;
45688
45689 @@ -391,7 +408,7 @@ int allow_signal(int sig)
45690          * know it'll be handled, so that they don't get converted to
45691          * SIGKILL or just silently dropped.
45692          */
45693 -       current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
45694 +       current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
45695         recalc_sigpending();
45696         spin_unlock_irq(&current->sighand->siglock);
45697         return 0;
45698 @@ -427,6 +444,17 @@ void daemonize(const char *name, ...)
45699         vsnprintf(current->comm, sizeof(current->comm), name, args);
45700         va_end(args);
45701
45702 +#ifdef CONFIG_GRKERNSEC
45703 +       write_lock(&grsec_exec_file_lock);
45704 +       if (current->exec_file) {
45705 +               fput(current->exec_file);
45706 +               current->exec_file = NULL;
45707 +       }
45708 +       write_unlock(&grsec_exec_file_lock);
45709 +#endif
45710 +
45711 +       gr_set_kernel_label(current);
45712 +
45713         /*
45714          * If we were started as result of loading a module, close all of the
45715          * user space pages.  We don't need them, and if we didn't close them
45716 @@ -961,6 +989,9 @@ NORET_TYPE void do_exit(long code)
45717         tsk->exit_code = code;
45718         taskstats_exit(tsk, group_dead);
45719
45720 +       gr_acl_handle_psacct(tsk, code);
45721 +       gr_acl_handle_exit();
45722 +
45723         exit_mm(tsk);
45724
45725         if (group_dead)
45726 @@ -1180,7 +1211,7 @@ static int wait_task_zombie(struct wait_
45727
45728         if (unlikely(wo->wo_flags & WNOWAIT)) {
45729                 int exit_code = p->exit_code;
45730 -               int why, status;
45731 +               int why;
45732
45733                 get_task_struct(p);
45734                 read_unlock(&tasklist_lock);
45735 diff -urNp linux-2.6.33/kernel/fork.c linux-2.6.33/kernel/fork.c
45736 --- linux-2.6.33/kernel/fork.c  2010-02-24 13:52:17.000000000 -0500
45737 +++ linux-2.6.33/kernel/fork.c  2010-03-07 12:23:36.133586895 -0500
45738 @@ -255,7 +255,7 @@ static struct task_struct *dup_task_stru
45739         *stackend = STACK_END_MAGIC;    /* for overflow detection */
45740
45741  #ifdef CONFIG_CC_STACKPROTECTOR
45742 -       tsk->stack_canary = get_random_int();
45743 +       tsk->stack_canary = pax_get_random_long();
45744  #endif
45745
45746         /* One for us, one for whoever does the "release_task()" (usually parent) */
45747 @@ -295,8 +295,8 @@ static int dup_mmap(struct mm_struct *mm
45748         mm->locked_vm = 0;
45749         mm->mmap = NULL;
45750         mm->mmap_cache = NULL;
45751 -       mm->free_area_cache = oldmm->mmap_base;
45752 -       mm->cached_hole_size = ~0UL;
45753 +       mm->free_area_cache = oldmm->free_area_cache;
45754 +       mm->cached_hole_size = oldmm->cached_hole_size;
45755         mm->map_count = 0;
45756         cpumask_clear(mm_cpumask(mm));
45757         mm->mm_rb = RB_ROOT;
45758 @@ -336,6 +336,7 @@ static int dup_mmap(struct mm_struct *mm
45759                 tmp->vm_flags &= ~VM_LOCKED;
45760                 tmp->vm_mm = mm;
45761                 tmp->vm_next = NULL;
45762 +               tmp->vm_mirror = NULL;
45763                 anon_vma_link(tmp);
45764                 file = tmp->vm_file;
45765                 if (file) {
45766 @@ -383,6 +384,31 @@ static int dup_mmap(struct mm_struct *mm
45767                 if (retval)
45768                         goto out;
45769         }
45770 +
45771 +#ifdef CONFIG_PAX_SEGMEXEC
45772 +       if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
45773 +               struct vm_area_struct *mpnt_m;
45774 +
45775 +               for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
45776 +                       BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
45777 +
45778 +                       if (!mpnt->vm_mirror)
45779 +                               continue;
45780 +
45781 +                       if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
45782 +                               BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
45783 +                               mpnt->vm_mirror = mpnt_m;
45784 +                       } else {
45785 +                               BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
45786 +                               mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
45787 +                               mpnt_m->vm_mirror->vm_mirror = mpnt_m;
45788 +                               mpnt->vm_mirror->vm_mirror = mpnt;
45789 +                       }
45790 +               }
45791 +               BUG_ON(mpnt_m);
45792 +       }
45793 +#endif
45794 +
45795         /* a new mm has just been created */
45796         arch_dup_mmap(oldmm, mm);
45797         retval = 0;
45798 @@ -733,7 +759,7 @@ static int copy_fs(unsigned long clone_f
45799                         write_unlock(&fs->lock);
45800                         return -EAGAIN;
45801                 }
45802 -               fs->users++;
45803 +               atomic_inc(&fs->users);
45804                 write_unlock(&fs->lock);
45805                 return 0;
45806         }
45807 @@ -1032,10 +1058,10 @@ static struct task_struct *copy_process(
45808         retval = -EAGAIN;
45809         if (!vx_nproc_avail(1))
45810                 goto bad_fork_cleanup_vm;
45811 +       gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
45812         if (atomic_read(&p->real_cred->user->processes) >=
45813                         p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
45814 -               if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
45815 -                   p->real_cred->user != INIT_USER)
45816 +               if (p->real_cred->user != INIT_USER && !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE))
45817                         goto bad_fork_cleanup_vm;
45818         }
45819
45820 @@ -1064,6 +1090,10 @@ static struct task_struct *copy_process(
45821         p->vfork_done = NULL;
45822         spin_lock_init(&p->alloc_lock);
45823
45824 +#ifdef CONFIG_GRKERNSEC
45825 +       rwlock_init(&p->gr_fs_lock);
45826 +#endif
45827 +
45828         init_sigpending(&p->pending);
45829
45830         p->utime = cputime_zero;
45831 @@ -1190,6 +1220,8 @@ static struct task_struct *copy_process(
45832                         goto bad_fork_free_pid;
45833         }
45834
45835 +       gr_copy_label(p);
45836 +
45837         p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
45838         /*
45839          * Clear TID on mm_release()?
45840 @@ -1342,6 +1374,8 @@ bad_fork_cleanup_count:
45841  bad_fork_free:
45842         free_task(p);
45843  fork_out:
45844 +       gr_log_forkfail(retval);
45845 +
45846         return ERR_PTR(retval);
45847  }
45848
45849 @@ -1435,6 +1469,8 @@ long do_fork(unsigned long clone_flags,
45850                 if (clone_flags & CLONE_PARENT_SETTID)
45851                         put_user(nr, parent_tidptr);
45852
45853 +               gr_handle_brute_check();
45854 +
45855                 if (clone_flags & CLONE_VFORK) {
45856                         p->vfork_done = &vfork;
45857                         init_completion(&vfork);
45858 @@ -1567,7 +1603,7 @@ static int unshare_fs(unsigned long unsh
45859                 return 0;
45860
45861         /* don't need lock here; in the worst case we'll do useless copy */
45862 -       if (fs->users == 1)
45863 +       if (atomic_read(&fs->users) == 1)
45864                 return 0;
45865
45866         *new_fsp = copy_fs_struct(fs);
45867 @@ -1687,14 +1723,18 @@ SYSCALL_DEFINE1(unshare, unsigned long,
45868                 task_lock(current);
45869
45870                 if (new_fs) {
45871 +                       unsigned long flags;
45872 +
45873 +                       gr_fs_write_lock_irqsave(current, flags);
45874                         fs = current->fs;
45875                         write_lock(&fs->lock);
45876                         current->fs = new_fs;
45877 -                       if (--fs->users)
45878 +                       if (atomic_dec_return(&fs->users))
45879                                 new_fs = NULL;
45880                         else
45881                                 new_fs = fs;
45882                         write_unlock(&fs->lock);
45883 +                       gr_fs_write_unlock_irqrestore(current, flags);
45884                 }
45885
45886                 if (new_mm) {
45887 diff -urNp linux-2.6.33/kernel/futex.c linux-2.6.33/kernel/futex.c
45888 --- linux-2.6.33/kernel/futex.c 2010-02-24 13:52:17.000000000 -0500
45889 +++ linux-2.6.33/kernel/futex.c 2010-03-07 12:23:36.137713527 -0500
45890 @@ -54,6 +54,7 @@
45891  #include <linux/mount.h>
45892  #include <linux/pagemap.h>
45893  #include <linux/syscalls.h>
45894 +#include <linux/ptrace.h>
45895  #include <linux/signal.h>
45896  #include <linux/module.h>
45897  #include <linux/magic.h>
45898 @@ -221,6 +222,11 @@ get_futex_key(u32 __user *uaddr, int fsh
45899         struct page *page;
45900         int err;
45901
45902 +#ifdef CONFIG_PAX_SEGMEXEC
45903 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
45904 +               return -EFAULT;
45905 +#endif
45906 +
45907         /*
45908          * The futex address must be "naturally" aligned.
45909          */
45910 @@ -1852,7 +1858,7 @@ retry:
45911
45912         restart = &current_thread_info()->restart_block;
45913         restart->fn = futex_wait_restart;
45914 -       restart->futex.uaddr = (u32 *)uaddr;
45915 +       restart->futex.uaddr = uaddr;
45916         restart->futex.val = val;
45917         restart->futex.time = abs_time->tv64;
45918         restart->futex.bitset = bitset;
45919 @@ -2385,7 +2391,10 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
45920  {
45921         struct robust_list_head __user *head;
45922         unsigned long ret;
45923 -       const struct cred *cred = current_cred(), *pcred;
45924 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
45925 +       const struct cred *cred = current_cred();
45926 +       const struct cred *pcred;
45927 +#endif
45928
45929         if (!futex_cmpxchg_enabled)
45930                 return -ENOSYS;
45931 @@ -2401,11 +2410,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
45932                 if (!p)
45933                         goto err_unlock;
45934                 ret = -EPERM;
45935 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45936 +               if (!ptrace_may_access(p, PTRACE_MODE_READ))
45937 +                       goto err_unlock;
45938 +#else
45939                 pcred = __task_cred(p);
45940                 if (cred->euid != pcred->euid &&
45941                     cred->euid != pcred->uid &&
45942                     !capable(CAP_SYS_PTRACE))
45943                         goto err_unlock;
45944 +#endif
45945                 head = p->robust_list;
45946                 rcu_read_unlock();
45947         }
45948 @@ -2467,7 +2481,7 @@ retry:
45949   */
45950  static inline int fetch_robust_entry(struct robust_list __user **entry,
45951                                      struct robust_list __user * __user *head,
45952 -                                    int *pi)
45953 +                                    unsigned int *pi)
45954  {
45955         unsigned long uentry;
45956
45957 diff -urNp linux-2.6.33/kernel/futex_compat.c linux-2.6.33/kernel/futex_compat.c
45958 --- linux-2.6.33/kernel/futex_compat.c  2010-02-24 13:52:17.000000000 -0500
45959 +++ linux-2.6.33/kernel/futex_compat.c  2010-03-07 12:23:36.137713527 -0500
45960 @@ -10,6 +10,7 @@
45961  #include <linux/compat.h>
45962  #include <linux/nsproxy.h>
45963  #include <linux/futex.h>
45964 +#include <linux/ptrace.h>
45965
45966  #include <asm/uaccess.h>
45967
45968 @@ -135,7 +136,10 @@ compat_sys_get_robust_list(int pid, comp
45969  {
45970         struct compat_robust_list_head __user *head;
45971         unsigned long ret;
45972 -       const struct cred *cred = current_cred(), *pcred;
45973 +       const struct cred *cred = current_cred();
45974 +#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
45975 +       const struct cred *pcred;
45976 +#endif
45977
45978         if (!futex_cmpxchg_enabled)
45979                 return -ENOSYS;
45980 @@ -151,11 +155,16 @@ compat_sys_get_robust_list(int pid, comp
45981                 if (!p)
45982                         goto err_unlock;
45983                 ret = -EPERM;
45984 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
45985 +               if (!ptrace_may_access(p, PTRACE_MODE_READ))
45986 +                       goto err_unlock;
45987 +#else
45988                 pcred = __task_cred(p);
45989                 if (cred->euid != pcred->euid &&
45990                     cred->euid != pcred->uid &&
45991                     !capable(CAP_SYS_PTRACE))
45992                         goto err_unlock;
45993 +#endif
45994                 head = p->compat_robust_list;
45995                 read_unlock(&tasklist_lock);
45996         }
45997 diff -urNp linux-2.6.33/kernel/gcov/base.c linux-2.6.33/kernel/gcov/base.c
45998 --- linux-2.6.33/kernel/gcov/base.c     2010-02-24 13:52:17.000000000 -0500
45999 +++ linux-2.6.33/kernel/gcov/base.c     2010-03-07 12:23:36.137713527 -0500
46000 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
46001  }
46002
46003  #ifdef CONFIG_MODULES
46004 -static inline int within(void *addr, void *start, unsigned long size)
46005 -{
46006 -       return ((addr >= start) && (addr < start + size));
46007 -}
46008 -
46009  /* Update list and generate events when modules are unloaded. */
46010  static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
46011                                 void *data)
46012 @@ -121,7 +116,7 @@ static int gcov_module_notifier(struct n
46013         prev = NULL;
46014         /* Remove entries located in module from linked list. */
46015         for (info = gcov_info_head; info; info = info->next) {
46016 -               if (within(info, mod->module_core, mod->core_size)) {
46017 +               if (within_module_core_rw((unsigned long)info, mod)) {
46018                         if (prev)
46019                                 prev->next = info->next;
46020                         else
46021 diff -urNp linux-2.6.33/kernel/hrtimer.c linux-2.6.33/kernel/hrtimer.c
46022 --- linux-2.6.33/kernel/hrtimer.c       2010-02-24 13:52:17.000000000 -0500
46023 +++ linux-2.6.33/kernel/hrtimer.c       2010-03-07 12:23:36.137713527 -0500
46024 @@ -1398,7 +1398,7 @@ void hrtimer_peek_ahead_timers(void)
46025         local_irq_restore(flags);
46026  }
46027
46028 -static void run_hrtimer_softirq(struct softirq_action *h)
46029 +static void run_hrtimer_softirq(void)
46030  {
46031         hrtimer_peek_ahead_timers();
46032  }
46033 diff -urNp linux-2.6.33/kernel/kallsyms.c linux-2.6.33/kernel/kallsyms.c
46034 --- linux-2.6.33/kernel/kallsyms.c      2010-02-24 13:52:17.000000000 -0500
46035 +++ linux-2.6.33/kernel/kallsyms.c      2010-03-07 12:23:36.137713527 -0500
46036 @@ -11,6 +11,9 @@
46037   *      Changed the compression method from stem compression to "table lookup"
46038   *      compression (see scripts/kallsyms.c for a more complete description)
46039   */
46040 +#ifdef CONFIG_GRKERNSEC_HIDESYM
46041 +#define __INCLUDED_BY_HIDESYM 1
46042 +#endif
46043  #include <linux/kallsyms.h>
46044  #include <linux/module.h>
46045  #include <linux/init.h>
46046 @@ -51,6 +54,9 @@ extern const unsigned long kallsyms_mark
46047
46048  static inline int is_kernel_inittext(unsigned long addr)
46049  {
46050 +       if (system_state != SYSTEM_BOOTING)
46051 +               return 0;
46052 +
46053         if (addr >= (unsigned long)_sinittext
46054             && addr <= (unsigned long)_einittext)
46055                 return 1;
46056 @@ -67,6 +73,24 @@ static inline int is_kernel_text(unsigne
46057
46058  static inline int is_kernel(unsigned long addr)
46059  {
46060 +       if (is_kernel_inittext(addr))
46061 +               return 1;
46062 +
46063 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
46064 +       if ((unsigned long)MODULES_EXEC_VADDR <= ktla_ktva(addr) && ktla_ktva(addr) <= (unsigned long)MODULES_EXEC_END)
46065 +               return 0;
46066 +
46067 +       if (is_kernel_text(addr))
46068 +               return 1;
46069 +
46070 +       if (ktla_ktva((unsigned long)_stext) <= addr && addr < ktla_ktva((unsigned long)_etext))
46071 +               return 1;
46072 +
46073 +       if ((addr >= (unsigned long)_sdata && addr <= (unsigned long)_end))
46074 +               return 1;
46075 +       return in_gate_area_no_task(addr);
46076 +#endif
46077 +
46078         if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
46079                 return 1;
46080         return in_gate_area_no_task(addr);
46081 @@ -414,7 +438,6 @@ static unsigned long get_ksymbol_core(st
46082
46083  static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
46084  {
46085 -       iter->name[0] = '\0';
46086         iter->nameoff = get_symbol_offset(new_pos);
46087         iter->pos = new_pos;
46088  }
46089 @@ -462,6 +485,11 @@ static int s_show(struct seq_file *m, vo
46090  {
46091         struct kallsym_iter *iter = m->private;
46092
46093 +#ifdef CONFIG_GRKERNSEC_HIDESYM
46094 +       if (current_uid())
46095 +               return 0;
46096 +#endif
46097 +
46098         /* Some debugging symbols have no name.  Ignore them. */
46099         if (!iter->name[0])
46100                 return 0;
46101 @@ -502,7 +530,7 @@ static int kallsyms_open(struct inode *i
46102         struct kallsym_iter *iter;
46103         int ret;
46104
46105 -       iter = kmalloc(sizeof(*iter), GFP_KERNEL);
46106 +       iter = kzalloc(sizeof(*iter), GFP_KERNEL);
46107         if (!iter)
46108                 return -ENOMEM;
46109         reset_iter(iter, 0);
46110 diff -urNp linux-2.6.33/kernel/kgdb.c linux-2.6.33/kernel/kgdb.c
46111 --- linux-2.6.33/kernel/kgdb.c  2010-02-24 13:52:17.000000000 -0500
46112 +++ linux-2.6.33/kernel/kgdb.c  2010-03-07 12:23:36.137713527 -0500
46113 @@ -86,7 +86,7 @@ static int                    kgdb_io_module_registered;
46114  /* Guard for recursive entry */
46115  static int                     exception_level;
46116
46117 -static struct kgdb_io          *kgdb_io_ops;
46118 +static const struct kgdb_io    *kgdb_io_ops;
46119  static DEFINE_SPINLOCK(kgdb_registration_lock);
46120
46121  /* kgdb console driver is loaded */
46122 @@ -1664,7 +1664,7 @@ static void kgdb_initial_breakpoint(void
46123   *
46124   *     Register it with the KGDB core.
46125   */
46126 -int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
46127 +int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
46128  {
46129         int err;
46130
46131 @@ -1709,7 +1709,7 @@ EXPORT_SYMBOL_GPL(kgdb_register_io_modul
46132   *
46133   *     Unregister it with the KGDB core.
46134   */
46135 -void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
46136 +void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
46137  {
46138         BUG_ON(kgdb_connected);
46139
46140 diff -urNp linux-2.6.33/kernel/kmod.c linux-2.6.33/kernel/kmod.c
46141 --- linux-2.6.33/kernel/kmod.c  2010-02-24 13:52:17.000000000 -0500
46142 +++ linux-2.6.33/kernel/kmod.c  2010-03-07 12:23:36.137713527 -0500
46143 @@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
46144         if (ret)
46145                 return ret;
46146
46147 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
46148 +       /* we could do a tighter check here, but some distros
46149 +          are taking it upon themselves to remove CAP_SYS_MODULE
46150 +          from even root-running apps which cause modules to be
46151 +          auto-loaded
46152 +       */
46153 +       if (current_uid()) {
46154 +               gr_log_nonroot_mod_load(module_name);
46155 +               return -EPERM;
46156 +       }
46157 +#endif
46158 +
46159         /* If modprobe needs a service that is in a module, we get a recursive
46160          * loop.  Limit the number of running kmod threads to max_threads/2 or
46161          * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
46162 diff -urNp linux-2.6.33/kernel/kprobes.c linux-2.6.33/kernel/kprobes.c
46163 --- linux-2.6.33/kernel/kprobes.c       2010-02-24 13:52:17.000000000 -0500
46164 +++ linux-2.6.33/kernel/kprobes.c       2010-03-07 12:23:36.137713527 -0500
46165 @@ -186,7 +186,7 @@ static kprobe_opcode_t __kprobes *__get_
46166          * kernel image and loaded module images reside. This is required
46167          * so x86_64 can correctly handle the %rip-relative fixups.
46168          */
46169 -       kip->insns = module_alloc(PAGE_SIZE);
46170 +       kip->insns = module_alloc_exec(PAGE_SIZE);
46171         if (!kip->insns) {
46172                 kfree(kip);
46173                 return NULL;
46174 @@ -223,7 +223,7 @@ static int __kprobes collect_one_slot(st
46175                  */
46176                 if (!list_is_singular(&kprobe_insn_pages)) {
46177                         list_del(&kip->list);
46178 -                       module_free(NULL, kip->insns);
46179 +                       module_free_exec(NULL, kip->insns);
46180                         kfree(kip);
46181                 }
46182                 return 1;
46183 diff -urNp linux-2.6.33/kernel/lockdep.c linux-2.6.33/kernel/lockdep.c
46184 --- linux-2.6.33/kernel/lockdep.c       2010-02-24 13:52:17.000000000 -0500
46185 +++ linux-2.6.33/kernel/lockdep.c       2010-03-07 12:23:36.137713527 -0500
46186 @@ -586,6 +586,10 @@ static int static_obj(void *obj)
46187         int i;
46188  #endif
46189
46190 +#ifdef CONFIG_PAX_KERNEXEC
46191 +       start = ktla_ktva(start);
46192 +#endif
46193 +
46194         /*
46195          * static variable?
46196          */
46197 @@ -601,8 +605,7 @@ static int static_obj(void *obj)
46198          */
46199         for_each_possible_cpu(i) {
46200                 start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
46201 -               end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
46202 -                                       + per_cpu_offset(i);
46203 +               end   = start + PERCPU_ENOUGH_ROOM;
46204
46205                 if ((addr >= start) && (addr < end))
46206                         return 1;
46207 @@ -719,6 +722,7 @@ register_lock_class(struct lockdep_map *
46208         if (!static_obj(lock->key)) {
46209                 debug_locks_off();
46210                 printk("INFO: trying to register non-static key.\n");
46211 +               printk("lock:%pS key:%pS.\n", lock, lock->key);
46212                 printk("the code is fine but needs lockdep annotation.\n");
46213                 printk("turning off the locking correctness validator.\n");
46214                 dump_stack();
46215 diff -urNp linux-2.6.33/kernel/module.c linux-2.6.33/kernel/module.c
46216 --- linux-2.6.33/kernel/module.c        2010-02-24 13:52:17.000000000 -0500
46217 +++ linux-2.6.33/kernel/module.c        2010-03-07 12:23:36.141632987 -0500
46218 @@ -89,7 +89,8 @@ static DECLARE_WAIT_QUEUE_HEAD(module_wq
46219  static BLOCKING_NOTIFIER_HEAD(module_notify_list);
46220
46221  /* Bounds of module allocation, for speeding __module_address */
46222 -static unsigned long module_addr_min = -1UL, module_addr_max = 0;
46223 +static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
46224 +static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
46225
46226  int register_module_notifier(struct notifier_block * nb)
46227  {
46228 @@ -245,7 +246,7 @@ bool each_symbol(bool (*fn)(const struct
46229                 return true;
46230
46231         list_for_each_entry_rcu(mod, &modules, list) {
46232 -               struct symsearch arr[] = {
46233 +               struct symsearch modarr[] = {
46234                         { mod->syms, mod->syms + mod->num_syms, mod->crcs,
46235                           NOT_GPL_ONLY, false },
46236                         { mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
46237 @@ -267,7 +268,7 @@ bool each_symbol(bool (*fn)(const struct
46238  #endif
46239                 };
46240
46241 -               if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
46242 +               if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
46243                         return true;
46244         }
46245         return false;
46246 @@ -375,7 +376,7 @@ static void *percpu_modalloc(unsigned lo
46247  {
46248         void *ptr;
46249
46250 -       if (align > PAGE_SIZE) {
46251 +       if (align-1 >= PAGE_SIZE) {
46252                 printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
46253                        name, align, PAGE_SIZE);
46254                 align = PAGE_SIZE;
46255 @@ -1393,7 +1394,8 @@ static void free_module(struct module *m
46256         destroy_params(mod->kp, mod->num_kp);
46257
46258         /* This may be NULL, but that's OK */
46259 -       module_free(mod, mod->module_init);
46260 +       module_free(mod, mod->module_init_rw);
46261 +       module_free_exec(mod, mod->module_init_rx);
46262         kfree(mod->args);
46263         if (mod->percpu)
46264                 percpu_modfree(mod->percpu);
46265 @@ -1402,10 +1404,12 @@ static void free_module(struct module *m
46266                 percpu_modfree(mod->refptr);
46267  #endif
46268         /* Free lock-classes: */
46269 -       lockdep_free_key_range(mod->module_core, mod->core_size);
46270 +       lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
46271 +       lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
46272
46273         /* Finally, free the core (containing the module structure) */
46274 -       module_free(mod, mod->module_core);
46275 +       module_free_exec(mod, mod->module_core_rx);
46276 +       module_free(mod, mod->module_core_rw);
46277
46278  #ifdef CONFIG_MPU
46279         update_protections(current->mm);
46280 @@ -1499,7 +1503,9 @@ static int simplify_symbols(Elf_Shdr *se
46281                                               strtab + sym[i].st_name, mod);
46282                         /* Ok if resolved.  */
46283                         if (ksym) {
46284 +                               pax_open_kernel();
46285                                 sym[i].st_value = ksym->value;
46286 +                               pax_close_kernel();
46287                                 break;
46288                         }
46289
46290 @@ -1518,7 +1524,9 @@ static int simplify_symbols(Elf_Shdr *se
46291                                 secbase = (unsigned long)mod->percpu;
46292                         else
46293                                 secbase = sechdrs[sym[i].st_shndx].sh_addr;
46294 +                       pax_open_kernel();
46295                         sym[i].st_value += secbase;
46296 +                       pax_close_kernel();
46297                         break;
46298                 }
46299         }
46300 @@ -1579,11 +1587,12 @@ static void layout_sections(struct modul
46301                             || s->sh_entsize != ~0UL
46302                             || strstarts(secstrings + s->sh_name, ".init"))
46303                                 continue;
46304 -                       s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
46305 +                       if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
46306 +                               s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
46307 +                       else
46308 +                               s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
46309                         DEBUGP("\t%s\n", secstrings + s->sh_name);
46310                 }
46311 -               if (m == 0)
46312 -                       mod->core_text_size = mod->core_size;
46313         }
46314
46315         DEBUGP("Init section allocation order:\n");
46316 @@ -1596,12 +1605,13 @@ static void layout_sections(struct modul
46317                             || s->sh_entsize != ~0UL
46318                             || !strstarts(secstrings + s->sh_name, ".init"))
46319                                 continue;
46320 -                       s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
46321 -                                        | INIT_OFFSET_MASK);
46322 +                       if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
46323 +                               s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
46324 +                       else
46325 +                               s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
46326 +                       s->sh_entsize |= INIT_OFFSET_MASK;
46327                         DEBUGP("\t%s\n", secstrings + s->sh_name);
46328                 }
46329 -               if (m == 0)
46330 -                       mod->init_text_size = mod->init_size;
46331         }
46332  }
46333
46334 @@ -1705,9 +1715,8 @@ static int is_exported(const char *name,
46335
46336  /* As per nm */
46337  static char elf_type(const Elf_Sym *sym,
46338 -                    Elf_Shdr *sechdrs,
46339 -                    const char *secstrings,
46340 -                    struct module *mod)
46341 +                    const Elf_Shdr *sechdrs,
46342 +                    const char *secstrings)
46343  {
46344         if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
46345                 if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
46346 @@ -1782,7 +1791,7 @@ static unsigned long layout_symtab(struc
46347
46348         /* Put symbol section at end of init part of module. */
46349         symsect->sh_flags |= SHF_ALLOC;
46350 -       symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
46351 +       symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
46352                                          symindex) | INIT_OFFSET_MASK;
46353         DEBUGP("\t%s\n", secstrings + symsect->sh_name);
46354
46355 @@ -1799,19 +1808,19 @@ static unsigned long layout_symtab(struc
46356                 }
46357
46358         /* Append room for core symbols at end of core part. */
46359 -       symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
46360 -       mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
46361 +       symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
46362 +       mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
46363
46364         /* Put string table section at end of init part of module. */
46365         strsect->sh_flags |= SHF_ALLOC;
46366 -       strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
46367 +       strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
46368                                          strindex) | INIT_OFFSET_MASK;
46369         DEBUGP("\t%s\n", secstrings + strsect->sh_name);
46370
46371         /* Append room for core symbols' strings at end of core part. */
46372 -       *pstroffs = mod->core_size;
46373 +       *pstroffs = mod->core_size_rx;
46374         __set_bit(0, strmap);
46375 -       mod->core_size += bitmap_weight(strmap, strsect->sh_size);
46376 +       mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
46377
46378         return symoffs;
46379  }
46380 @@ -1835,12 +1844,14 @@ static void add_kallsyms(struct module *
46381         mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
46382         mod->strtab = (void *)sechdrs[strindex].sh_addr;
46383
46384 +       pax_open_kernel();
46385 +
46386         /* Set types up while we still have access to sections. */
46387         for (i = 0; i < mod->num_symtab; i++)
46388                 mod->symtab[i].st_info
46389 -                       = elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
46390 +                       = elf_type(&mod->symtab[i], sechdrs, secstrings);
46391
46392 -       mod->core_symtab = dst = mod->module_core + symoffs;
46393 +       mod->core_symtab = dst = mod->module_core_rx + symoffs;
46394         src = mod->symtab;
46395         *dst = *src;
46396         for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
46397 @@ -1852,10 +1863,12 @@ static void add_kallsyms(struct module *
46398         }
46399         mod->core_num_syms = ndst;
46400
46401 -       mod->core_strtab = s = mod->module_core + stroffs;
46402 +       mod->core_strtab = s = mod->module_core_rx + stroffs;
46403         for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
46404                 if (test_bit(i, strmap))
46405                         *++s = mod->strtab[i];
46406 +
46407 +       pax_close_kernel();
46408  }
46409  #else
46410  static inline unsigned long layout_symtab(struct module *mod,
46411 @@ -1892,16 +1905,30 @@ static void dynamic_debug_setup(struct _
46412  #endif
46413  }
46414
46415 -static void *module_alloc_update_bounds(unsigned long size)
46416 +static void *module_alloc_update_bounds_rw(unsigned long size)
46417  {
46418         void *ret = module_alloc(size);
46419
46420         if (ret) {
46421                 /* Update module bounds. */
46422 -               if ((unsigned long)ret < module_addr_min)
46423 -                       module_addr_min = (unsigned long)ret;
46424 -               if ((unsigned long)ret + size > module_addr_max)
46425 -                       module_addr_max = (unsigned long)ret + size;
46426 +               if ((unsigned long)ret < module_addr_min_rw)
46427 +                       module_addr_min_rw = (unsigned long)ret;
46428 +               if ((unsigned long)ret + size > module_addr_max_rw)
46429 +                       module_addr_max_rw = (unsigned long)ret + size;
46430 +       }
46431 +       return ret;
46432 +}
46433 +
46434 +static void *module_alloc_update_bounds_rx(unsigned long size)
46435 +{
46436 +       void *ret = module_alloc_exec(size);
46437 +
46438 +       if (ret) {
46439 +               /* Update module bounds. */
46440 +               if ((unsigned long)ret < module_addr_min_rx)
46441 +                       module_addr_min_rx = (unsigned long)ret;
46442 +               if ((unsigned long)ret + size > module_addr_max_rx)
46443 +                       module_addr_max_rx = (unsigned long)ret + size;
46444         }
46445         return ret;
46446  }
46447 @@ -2108,7 +2135,7 @@ static noinline struct module *load_modu
46448                                 secstrings, &stroffs, strmap);
46449
46450         /* Do the allocs. */
46451 -       ptr = module_alloc_update_bounds(mod->core_size);
46452 +       ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
46453         /*
46454          * The pointer to this block is stored in the module structure
46455          * which is inside the block. Just mark it as not being a
46456 @@ -2119,23 +2146,47 @@ static noinline struct module *load_modu
46457                 err = -ENOMEM;
46458                 goto free_percpu;
46459         }
46460 -       memset(ptr, 0, mod->core_size);
46461 -       mod->module_core = ptr;
46462 +       memset(ptr, 0, mod->core_size_rw);
46463 +       mod->module_core_rw = ptr;
46464
46465 -       ptr = module_alloc_update_bounds(mod->init_size);
46466 +       ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
46467         /*
46468          * The pointer to this block is stored in the module structure
46469          * which is inside the block. This block doesn't need to be
46470          * scanned as it contains data and code that will be freed
46471          * after the module is initialized.
46472          */
46473 -       kmemleak_ignore(ptr);
46474 -       if (!ptr && mod->init_size) {
46475 +       kmemleak_not_leak(ptr);
46476 +       if (!ptr && mod->init_size_rw) {
46477 +               err = -ENOMEM;
46478 +               goto free_core_rw;
46479 +       }
46480 +       memset(ptr, 0, mod->init_size_rw);
46481 +       mod->module_init_rw = ptr;
46482 +
46483 +       ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
46484 +       kmemleak_not_leak(ptr);
46485 +       if (!ptr) {
46486                 err = -ENOMEM;
46487 -               goto free_core;
46488 +               goto free_init_rw;
46489         }
46490 -       memset(ptr, 0, mod->init_size);
46491 -       mod->module_init = ptr;
46492 +
46493 +       pax_open_kernel();
46494 +       memset(ptr, 0, mod->core_size_rx);
46495 +       pax_close_kernel();
46496 +       mod->module_core_rx = ptr;
46497 +
46498 +       ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
46499 +       kmemleak_not_leak(ptr);
46500 +       if (!ptr && mod->init_size_rx) {
46501 +               err = -ENOMEM;
46502 +               goto free_core_rx;
46503 +       }
46504 +
46505 +       pax_open_kernel();
46506 +       memset(ptr, 0, mod->init_size_rx);
46507 +       pax_close_kernel();
46508 +       mod->module_init_rx = ptr;
46509
46510         /* Transfer each section which specifies SHF_ALLOC */
46511         DEBUGP("final section addresses:\n");
46512 @@ -2145,17 +2196,41 @@ static noinline struct module *load_modu
46513                 if (!(sechdrs[i].sh_flags & SHF_ALLOC))
46514                         continue;
46515
46516 -               if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
46517 -                       dest = mod->module_init
46518 -                               + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
46519 -               else
46520 -                       dest = mod->module_core + sechdrs[i].sh_entsize;
46521 +               if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
46522 +                       if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
46523 +                               dest = mod->module_init_rw
46524 +                                       + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
46525 +                       else
46526 +                               dest = mod->module_init_rx
46527 +                                       + (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
46528 +               } else {
46529 +                       if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
46530 +                               dest = mod->module_core_rw + sechdrs[i].sh_entsize;
46531 +                       else
46532 +                               dest = mod->module_core_rx + sechdrs[i].sh_entsize;
46533 +               }
46534 +
46535 +               if (sechdrs[i].sh_type != SHT_NOBITS) {
46536 +
46537 +#ifdef CONFIG_PAX_KERNEXEC
46538 +                       if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
46539 +                               pax_open_kernel();
46540 +                               memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
46541 +                               pax_close_kernel();
46542 +                       } else
46543 +#endif
46544
46545 -               if (sechdrs[i].sh_type != SHT_NOBITS)
46546 -                       memcpy(dest, (void *)sechdrs[i].sh_addr,
46547 -                              sechdrs[i].sh_size);
46548 +                       memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
46549 +               }
46550                 /* Update sh_addr to point to copy in image. */
46551 -               sechdrs[i].sh_addr = (unsigned long)dest;
46552 +
46553 +#ifdef CONFIG_PAX_KERNEXEC
46554 +               if (sechdrs[i].sh_flags & SHF_EXECINSTR)
46555 +                       sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
46556 +               else
46557 +#endif
46558 +
46559 +                       sechdrs[i].sh_addr = (unsigned long)dest;
46560                 DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
46561         }
46562         /* Module has been moved. */
46563 @@ -2167,7 +2242,7 @@ static noinline struct module *load_modu
46564                                       mod->name);
46565         if (!mod->refptr) {
46566                 err = -ENOMEM;
46567 -               goto free_init;
46568 +               goto free_init_rx;
46569         }
46570  #endif
46571         /* Now we've moved module, initialize linked lists, etc. */
46572 @@ -2282,8 +2357,8 @@ static noinline struct module *load_modu
46573
46574         /* Now do relocations. */
46575         for (i = 1; i < hdr->e_shnum; i++) {
46576 -               const char *strtab = (char *)sechdrs[strindex].sh_addr;
46577                 unsigned int info = sechdrs[i].sh_info;
46578 +               strtab = (char *)sechdrs[strindex].sh_addr;
46579
46580                 /* Not a valid relocation section? */
46581                 if (info >= hdr->e_shnum)
46582 @@ -2344,12 +2419,12 @@ static noinline struct module *load_modu
46583          * Do it before processing of module parameters, so the module
46584          * can provide parameter accessor functions of its own.
46585          */
46586 -       if (mod->module_init)
46587 -               flush_icache_range((unsigned long)mod->module_init,
46588 -                                  (unsigned long)mod->module_init
46589 -                                  + mod->init_size);
46590 -       flush_icache_range((unsigned long)mod->module_core,
46591 -                          (unsigned long)mod->module_core + mod->core_size);
46592 +       if (mod->module_init_rx)
46593 +               flush_icache_range((unsigned long)mod->module_init_rx,
46594 +                                  (unsigned long)mod->module_init_rx
46595 +                                  + mod->init_size_rx);
46596 +       flush_icache_range((unsigned long)mod->module_core_rx,
46597 +                          (unsigned long)mod->module_core_rx + mod->core_size_rx);
46598
46599         set_fs(old_fs);
46600
46601 @@ -2397,12 +2472,16 @@ static noinline struct module *load_modu
46602   free_unload:
46603         module_unload_free(mod);
46604  #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
46605 + free_init_rx:
46606         percpu_modfree(mod->refptr);
46607 - free_init:
46608  #endif
46609 -       module_free(mod, mod->module_init);
46610 - free_core:
46611 -       module_free(mod, mod->module_core);
46612 +       module_free_exec(mod, mod->module_init_rx);
46613 + free_core_rx:
46614 +       module_free_exec(mod, mod->module_core_rx);
46615 + free_init_rw:
46616 +       module_free(mod, mod->module_init_rw);
46617 + free_core_rw:
46618 +       module_free(mod, mod->module_core_rw);
46619         /* mod will be freed with core. Don't access it beyond this line! */
46620   free_percpu:
46621         if (percpu)
46622 @@ -2504,10 +2583,12 @@ SYSCALL_DEFINE3(init_module, void __user
46623         mod->symtab = mod->core_symtab;
46624         mod->strtab = mod->core_strtab;
46625  #endif
46626 -       module_free(mod, mod->module_init);
46627 -       mod->module_init = NULL;
46628 -       mod->init_size = 0;
46629 -       mod->init_text_size = 0;
46630 +       module_free(mod, mod->module_init_rw);
46631 +       module_free_exec(mod, mod->module_init_rx);
46632 +       mod->module_init_rw = NULL;
46633 +       mod->module_init_rx = NULL;
46634 +       mod->init_size_rw = 0;
46635 +       mod->init_size_rx = 0;
46636         mutex_unlock(&module_mutex);
46637
46638         return 0;
46639 @@ -2538,10 +2619,16 @@ static const char *get_ksymbol(struct mo
46640         unsigned long nextval;
46641
46642         /* At worse, next value is at end of module */
46643 -       if (within_module_init(addr, mod))
46644 -               nextval = (unsigned long)mod->module_init+mod->init_text_size;
46645 +       if (within_module_init_rx(addr, mod))
46646 +               nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
46647 +       else if (within_module_init_rw(addr, mod))
46648 +               nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
46649 +       else if (within_module_core_rx(addr, mod))
46650 +               nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
46651 +       else if (within_module_core_rw(addr, mod))
46652 +               nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
46653         else
46654 -               nextval = (unsigned long)mod->module_core+mod->core_text_size;
46655 +               return NULL;
46656
46657         /* Scan for closest preceeding symbol, and next symbol. (ELF
46658            starts real symbols at 1). */
46659 @@ -2787,7 +2874,7 @@ static int m_show(struct seq_file *m, vo
46660         char buf[8];
46661
46662         seq_printf(m, "%s %u",
46663 -                  mod->name, mod->init_size + mod->core_size);
46664 +                  mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
46665         print_unload_info(m, mod);
46666
46667         /* Informative for users. */
46668 @@ -2796,7 +2883,7 @@ static int m_show(struct seq_file *m, vo
46669                    mod->state == MODULE_STATE_COMING ? "Loading":
46670                    "Live");
46671         /* Used by oprofile and other similar tools. */
46672 -       seq_printf(m, " 0x%p", mod->module_core);
46673 +       seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
46674
46675         /* Taints info */
46676         if (mod->taints)
46677 @@ -2832,7 +2919,17 @@ static const struct file_operations proc
46678
46679  static int __init proc_modules_init(void)
46680  {
46681 +#ifndef CONFIG_GRKERNSEC_HIDESYM
46682 +#ifdef CONFIG_GRKERNSEC_PROC_USER
46683 +       proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
46684 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
46685 +       proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
46686 +#else
46687         proc_create("modules", 0, NULL, &proc_modules_operations);
46688 +#endif
46689 +#else
46690 +       proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
46691 +#endif
46692         return 0;
46693  }
46694  module_init(proc_modules_init);
46695 @@ -2891,12 +2988,12 @@ struct module *__module_address(unsigned
46696  {
46697         struct module *mod;
46698
46699 -       if (addr < module_addr_min || addr > module_addr_max)
46700 +       if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
46701 +           (addr < module_addr_min_rw || addr > module_addr_max_rw))
46702                 return NULL;
46703
46704         list_for_each_entry_rcu(mod, &modules, list)
46705 -               if (within_module_core(addr, mod)
46706 -                   || within_module_init(addr, mod))
46707 +               if (within_module_init(addr, mod) || within_module_core(addr, mod))
46708                         return mod;
46709         return NULL;
46710  }
46711 @@ -2930,11 +3027,20 @@ bool is_module_text_address(unsigned lon
46712   */
46713  struct module *__module_text_address(unsigned long addr)
46714  {
46715 -       struct module *mod = __module_address(addr);
46716 +       struct module *mod;
46717 +
46718 +#ifdef CONFIG_X86_32
46719 +       addr = ktla_ktva(addr);
46720 +#endif
46721 +
46722 +       if (addr < module_addr_min_rx || addr > module_addr_max_rx)
46723 +               return NULL;
46724 +
46725 +       mod = __module_address(addr);
46726 +
46727         if (mod) {
46728                 /* Make sure it's within the text section. */
46729 -               if (!within(addr, mod->module_init, mod->init_text_size)
46730 -                   && !within(addr, mod->module_core, mod->core_text_size))
46731 +               if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
46732                         mod = NULL;
46733         }
46734         return mod;
46735 diff -urNp linux-2.6.33/kernel/panic.c linux-2.6.33/kernel/panic.c
46736 --- linux-2.6.33/kernel/panic.c 2010-02-24 13:52:17.000000000 -0500
46737 +++ linux-2.6.33/kernel/panic.c 2010-03-07 12:23:36.141632987 -0500
46738 @@ -396,7 +396,8 @@ EXPORT_SYMBOL(warn_slowpath_null);
46739   */
46740  void __stack_chk_fail(void)
46741  {
46742 -       panic("stack-protector: Kernel stack is corrupted in: %p\n",
46743 +       dump_stack();
46744 +       panic("stack-protector: Kernel stack is corrupted in: %pS\n",
46745                 __builtin_return_address(0));
46746  }
46747  EXPORT_SYMBOL(__stack_chk_fail);
46748 diff -urNp linux-2.6.33/kernel/params.c linux-2.6.33/kernel/params.c
46749 --- linux-2.6.33/kernel/params.c        2010-02-24 13:52:17.000000000 -0500
46750 +++ linux-2.6.33/kernel/params.c        2010-03-07 12:23:36.141632987 -0500
46751 @@ -723,7 +723,7 @@ static ssize_t module_attr_store(struct
46752         return ret;
46753  }
46754
46755 -static struct sysfs_ops module_sysfs_ops = {
46756 +static const struct sysfs_ops module_sysfs_ops = {
46757         .show = module_attr_show,
46758         .store = module_attr_store,
46759  };
46760 @@ -737,7 +737,7 @@ static int uevent_filter(struct kset *ks
46761         return 0;
46762  }
46763
46764 -static struct kset_uevent_ops module_uevent_ops = {
46765 +static const struct kset_uevent_ops module_uevent_ops = {
46766         .filter = uevent_filter,
46767  };
46768
46769 diff -urNp linux-2.6.33/kernel/pid.c linux-2.6.33/kernel/pid.c
46770 --- linux-2.6.33/kernel/pid.c   2010-02-24 13:52:17.000000000 -0500
46771 +++ linux-2.6.33/kernel/pid.c   2010-03-07 12:23:36.141632987 -0500
46772 @@ -33,6 +33,7 @@
46773  #include <linux/rculist.h>
46774  #include <linux/bootmem.h>
46775  #include <linux/hash.h>
46776 +#include <linux/security.h>
46777  #include <linux/pid_namespace.h>
46778  #include <linux/init_task.h>
46779  #include <linux/syscalls.h>
46780 @@ -45,7 +46,7 @@ struct pid init_struct_pid = INIT_STRUCT
46781
46782  int pid_max = PID_MAX_DEFAULT;
46783
46784 -#define RESERVED_PIDS          300
46785 +#define RESERVED_PIDS          500
46786
46787  int pid_max_min = RESERVED_PIDS + 1;
46788  int pid_max_max = PID_MAX_LIMIT;
46789 @@ -380,7 +381,14 @@ EXPORT_SYMBOL(pid_task);
46790   */
46791  struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
46792  {
46793 -       return pid_task(find_pid_ns(vx_rmap_pid(nr), ns), PIDTYPE_PID);
46794 +       struct task_struct *task;
46795 +
46796 +       task = pid_task(find_pid_ns(vx_rmap_pid(nr), ns), PIDTYPE_PID);
46797 +
46798 +       if (gr_pid_is_chrooted(task))
46799 +               return NULL;
46800 +
46801 +       return task;
46802  }
46803  EXPORT_SYMBOL_GPL(find_task_by_pid_ns);
46804
46805 diff -urNp linux-2.6.33/kernel/posix-cpu-timers.c linux-2.6.33/kernel/posix-cpu-timers.c
46806 --- linux-2.6.33/kernel/posix-cpu-timers.c      2010-02-24 13:52:17.000000000 -0500
46807 +++ linux-2.6.33/kernel/posix-cpu-timers.c      2010-03-07 12:23:36.141632987 -0500
46808 @@ -6,6 +6,7 @@
46809  #include <linux/posix-timers.h>
46810  #include <linux/errno.h>
46811  #include <linux/math64.h>
46812 +#include <linux/security.h>
46813  #include <asm/uaccess.h>
46814  #include <linux/kernel_stat.h>
46815  #include <trace/events/timer.h>
46816 @@ -1043,6 +1044,7 @@ static void check_thread_timers(struct t
46817                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
46818                         return;
46819                 }
46820 +               gr_learn_resource(tsk, RLIMIT_RTTIME, tsk->rt.timeout, 1);
46821                 if (tsk->rt.timeout > DIV_ROUND_UP(*soft, USEC_PER_SEC/HZ)) {
46822                         /*
46823                          * At the soft limit, send a SIGXCPU every second.
46824 @@ -1205,6 +1207,7 @@ static void check_process_timers(struct
46825                         __group_send_sig_info(SIGKILL, SEND_SIG_PRIV, tsk);
46826                         return;
46827                 }
46828 +               gr_learn_resource(tsk, RLIMIT_CPU, psecs, 0);
46829                 if (psecs >= sig->rlim[RLIMIT_CPU].rlim_cur) {
46830                         /*
46831                          * At the soft limit, send a SIGXCPU every second.
46832 diff -urNp linux-2.6.33/kernel/power/hibernate.c linux-2.6.33/kernel/power/hibernate.c
46833 --- linux-2.6.33/kernel/power/hibernate.c       2010-02-24 13:52:17.000000000 -0500
46834 +++ linux-2.6.33/kernel/power/hibernate.c       2010-03-07 12:23:36.141632987 -0500
46835 @@ -49,14 +49,14 @@ enum {
46836
46837  static int hibernation_mode = HIBERNATION_SHUTDOWN;
46838
46839 -static struct platform_hibernation_ops *hibernation_ops;
46840 +static const struct platform_hibernation_ops *hibernation_ops;
46841
46842  /**
46843   * hibernation_set_ops - set the global hibernate operations
46844   * @ops: the hibernation operations to use in subsequent hibernation transitions
46845   */
46846
46847 -void hibernation_set_ops(struct platform_hibernation_ops *ops)
46848 +void hibernation_set_ops(const struct platform_hibernation_ops *ops)
46849  {
46850         if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
46851             && ops->prepare && ops->finish && ops->enter && ops->pre_restore
46852 diff -urNp linux-2.6.33/kernel/power/poweroff.c linux-2.6.33/kernel/power/poweroff.c
46853 --- linux-2.6.33/kernel/power/poweroff.c        2010-02-24 13:52:17.000000000 -0500
46854 +++ linux-2.6.33/kernel/power/poweroff.c        2010-03-07 12:23:36.141632987 -0500
46855 @@ -37,7 +37,7 @@ static struct sysrq_key_op    sysrq_powerof
46856         .enable_mask    = SYSRQ_ENABLE_BOOT,
46857  };
46858
46859 -static int pm_sysrq_init(void)
46860 +static int __init pm_sysrq_init(void)
46861  {
46862         register_sysrq_key('o', &sysrq_poweroff_op);
46863         return 0;
46864 diff -urNp linux-2.6.33/kernel/power/process.c linux-2.6.33/kernel/power/process.c
46865 --- linux-2.6.33/kernel/power/process.c 2010-02-24 13:52:17.000000000 -0500
46866 +++ linux-2.6.33/kernel/power/process.c 2010-03-07 12:23:36.141632987 -0500
46867 @@ -38,12 +38,15 @@ static int try_to_freeze_tasks(bool sig_
46868         struct timeval start, end;
46869         u64 elapsed_csecs64;
46870         unsigned int elapsed_csecs;
46871 +       bool timedout = false;
46872
46873         do_gettimeofday(&start);
46874
46875         end_time = jiffies + TIMEOUT;
46876         while (true) {
46877                 todo = 0;
46878 +               if (time_after(jiffies, end_time))
46879 +                       timedout = true;
46880                 read_lock(&tasklist_lock);
46881                 do_each_thread(g, p) {
46882                         if (frozen(p) || !freezeable(p))
46883 @@ -58,12 +61,16 @@ static int try_to_freeze_tasks(bool sig_
46884                          * It is "frozen enough".  If the task does wake
46885                          * up, it will immediately call try_to_freeze.
46886                          */
46887 -                       if (!task_is_stopped_or_traced(p) &&
46888 -                           !freezer_should_skip(p))
46889 +                       if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
46890                                 todo++;
46891 +                               if (timedout) {
46892 +                                       printk(KERN_ERR "Task refusing to freeze:\n");
46893 +                                       sched_show_task(p);
46894 +                               }
46895 +                       }
46896                 } while_each_thread(g, p);
46897                 read_unlock(&tasklist_lock);
46898 -               if (!todo || time_after(jiffies, end_time))
46899 +               if (!todo || timedout)
46900                         break;
46901
46902                 /*
46903 diff -urNp linux-2.6.33/kernel/power/suspend.c linux-2.6.33/kernel/power/suspend.c
46904 --- linux-2.6.33/kernel/power/suspend.c 2010-02-24 13:52:17.000000000 -0500
46905 +++ linux-2.6.33/kernel/power/suspend.c 2010-03-07 12:23:36.141632987 -0500
46906 @@ -23,13 +23,13 @@ const char *const pm_states[PM_SUSPEND_M
46907         [PM_SUSPEND_MEM]        = "mem",
46908  };
46909
46910 -static struct platform_suspend_ops *suspend_ops;
46911 +static const struct platform_suspend_ops *suspend_ops;
46912
46913  /**
46914   *     suspend_set_ops - Set the global suspend method table.
46915   *     @ops:   Pointer to ops structure.
46916   */
46917 -void suspend_set_ops(struct platform_suspend_ops *ops)
46918 +void suspend_set_ops(const struct platform_suspend_ops *ops)
46919  {
46920         mutex_lock(&pm_mutex);
46921         suspend_ops = ops;
46922 diff -urNp linux-2.6.33/kernel/printk.c linux-2.6.33/kernel/printk.c
46923 --- linux-2.6.33/kernel/printk.c        2010-02-24 13:52:17.000000000 -0500
46924 +++ linux-2.6.33/kernel/printk.c        2010-03-07 12:23:36.141632987 -0500
46925 @@ -280,6 +280,11 @@ int do_syslog(int type, char __user *buf
46926         char c;
46927         int error = 0;
46928
46929 +#ifdef CONFIG_GRKERNSEC_DMESG
46930 +       if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
46931 +               return -EPERM;
46932 +#endif
46933 +
46934         error = security_syslog(type);
46935         if (error)
46936                 return error;
46937 diff -urNp linux-2.6.33/kernel/ptrace.c linux-2.6.33/kernel/ptrace.c
46938 --- linux-2.6.33/kernel/ptrace.c        2010-02-24 13:52:17.000000000 -0500
46939 +++ linux-2.6.33/kernel/ptrace.c        2010-03-07 12:23:36.141632987 -0500
46940 @@ -141,7 +141,7 @@ int __ptrace_may_access(struct task_stru
46941              cred->gid != tcred->egid ||
46942              cred->gid != tcred->sgid ||
46943              cred->gid != tcred->gid) &&
46944 -           !capable(CAP_SYS_PTRACE)) {
46945 +           !capable_nolog(CAP_SYS_PTRACE)) {
46946                 rcu_read_unlock();
46947                 return -EPERM;
46948         }
46949 @@ -149,7 +149,7 @@ int __ptrace_may_access(struct task_stru
46950         smp_rmb();
46951         if (task->mm)
46952                 dumpable = get_dumpable(task->mm);
46953 -       if (!dumpable && !capable(CAP_SYS_PTRACE))
46954 +       if (!dumpable && !capable_nolog(CAP_SYS_PTRACE))
46955                 return -EPERM;
46956
46957         return security_ptrace_access_check(task, mode);
46958 @@ -199,7 +199,7 @@ int ptrace_attach(struct task_struct *ta
46959                 goto unlock_tasklist;
46960
46961         task->ptrace = PT_PTRACED;
46962 -       if (capable(CAP_SYS_PTRACE))
46963 +       if (capable_nolog(CAP_SYS_PTRACE))
46964                 task->ptrace |= PT_PTRACE_CAP;
46965
46966         __ptrace_link(task, current);
46967 @@ -362,7 +362,7 @@ int ptrace_readdata(struct task_struct *
46968                                 break;
46969                         return -EIO;
46970                 }
46971 -               if (copy_to_user(dst, buf, retval))
46972 +               if (retval > sizeof(buf) || copy_to_user(dst, buf, retval))
46973                         return -EFAULT;
46974                 copied += retval;
46975                 src += retval;
46976 @@ -532,18 +532,18 @@ int ptrace_request(struct task_struct *c
46977                 ret = ptrace_setoptions(child, data);
46978                 break;
46979         case PTRACE_GETEVENTMSG:
46980 -               ret = put_user(child->ptrace_message, (unsigned long __user *) data);
46981 +               ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
46982                 break;
46983
46984         case PTRACE_GETSIGINFO:
46985                 ret = ptrace_getsiginfo(child, &siginfo);
46986                 if (!ret)
46987 -                       ret = copy_siginfo_to_user((siginfo_t __user *) data,
46988 +                       ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
46989                                                    &siginfo);
46990                 break;
46991
46992         case PTRACE_SETSIGINFO:
46993 -               if (copy_from_user(&siginfo, (siginfo_t __user *) data,
46994 +               if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
46995                                    sizeof siginfo))
46996                         ret = -EFAULT;
46997                 else
46998 @@ -621,14 +621,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
46999                 goto out;
47000         }
47001
47002 +       if (gr_handle_ptrace(child, request)) {
47003 +               ret = -EPERM;
47004 +               goto out_put_task_struct;
47005 +       }
47006 +
47007         if (request == PTRACE_ATTACH) {
47008                 ret = ptrace_attach(child);
47009                 /*
47010                  * Some architectures need to do book-keeping after
47011                  * a ptrace attach.
47012                  */
47013 -               if (!ret)
47014 +               if (!ret) {
47015                         arch_ptrace_attach(child);
47016 +                       gr_audit_ptrace(child);
47017 +               }
47018                 goto out_put_task_struct;
47019         }
47020
47021 @@ -661,11 +661,11 @@ int generic_ptrace_peekdata(struct task_
47022         int copied;
47023
47024         copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
47025         if (copied != sizeof(tmp))
47026                 return -EIO;
47027 -       return put_user(tmp, (unsigned long __user *)data);
47028 +       return put_user(tmp, (__force unsigned long __user *)data);
47029  }
47030
47031  int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
47032  {
47033         int copied;
47034 diff -urNp linux-2.6.33/kernel/rcutree.c linux-2.6.33/kernel/rcutree.c
47035 --- linux-2.6.33/kernel/rcutree.c       2010-02-24 13:52:17.000000000 -0500
47036 +++ linux-2.6.33/kernel/rcutree.c       2010-03-07 12:23:36.141632987 -0500
47037 @@ -1315,7 +1315,7 @@ __rcu_process_callbacks(struct rcu_state
47038  /*
47039   * Do softirq processing for the current CPU.
47040   */
47041 -static void rcu_process_callbacks(struct softirq_action *unused)
47042 +static void rcu_process_callbacks(void)
47043  {
47044         /*
47045          * Memory references from any prior RCU read-side critical sections
47046 diff -urNp linux-2.6.33/kernel/relay.c linux-2.6.33/kernel/relay.c
47047 --- linux-2.6.33/kernel/relay.c 2010-02-24 13:52:17.000000000 -0500
47048 +++ linux-2.6.33/kernel/relay.c 2010-03-07 12:23:36.141632987 -0500
47049 @@ -1292,7 +1292,7 @@ static int subbuf_splice_actor(struct fi
47050                 return 0;
47051
47052         ret = *nonpad_ret = splice_to_pipe(pipe, &spd);
47053 -       if (ret < 0 || ret < total_len)
47054 +       if ((int)ret < 0 || ret < total_len)
47055                 return ret;
47056
47057          if (read_start + ret == nonpad_end)
47058 diff -urNp linux-2.6.33/kernel/resource.c linux-2.6.33/kernel/resource.c
47059 --- linux-2.6.33/kernel/resource.c      2010-02-24 13:52:17.000000000 -0500
47060 +++ linux-2.6.33/kernel/resource.c      2010-03-07 12:23:36.141632987 -0500
47061 @@ -132,8 +132,18 @@ static const struct file_operations proc
47062
47063  static int __init ioresources_init(void)
47064  {
47065 +#ifdef CONFIG_GRKERNSEC_PROC_ADD
47066 +#ifdef CONFIG_GRKERNSEC_PROC_USER
47067 +       proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
47068 +       proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
47069 +#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
47070 +       proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
47071 +       proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
47072 +#endif
47073 +#else
47074         proc_create("ioports", 0, NULL, &proc_ioports_operations);
47075         proc_create("iomem", 0, NULL, &proc_iomem_operations);
47076 +#endif
47077         return 0;
47078  }
47079  __initcall(ioresources_init);
47080 diff -urNp linux-2.6.33/kernel/sched.c linux-2.6.33/kernel/sched.c
47081 --- linux-2.6.33/kernel/sched.c 2010-02-24 13:52:17.000000000 -0500
47082 +++ linux-2.6.33/kernel/sched.c 2010-03-07 12:23:48.703416643 -0500
47083 @@ -4844,7 +4844,7 @@ out:
47084   * In CONFIG_NO_HZ case, the idle load balance owner will do the
47085   * rebalancing for all the cpus for whom scheduler ticks are stopped.
47086   */
47087 -static void run_rebalance_domains(struct softirq_action *h)
47088 +static void run_rebalance_domains(void)
47089  {
47090         int this_cpu = smp_processor_id();
47091         struct rq *this_rq = cpu_rq(this_cpu);
47092 @@ -6146,6 +6146,8 @@ int can_nice(const struct task_struct *p
47093         /* convert nice value [19,-20] to rlimit style value [1,40] */
47094         int nice_rlim = 20 - nice;
47095
47096 +       gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
47097 +
47098         return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
47099                 capable(CAP_SYS_NICE));
47100  }
47101 @@ -6179,7 +6181,7 @@ SYSCALL_DEFINE1(nice, int, increment)
47102         if (nice > 19)
47103                 nice = 19;
47104
47105 -       if (increment < 0 && !can_nice(current, nice))
47106 +       if (increment < 0 && (!can_nice(current, nice) || gr_handle_chroot_nice()))
47107                 return vx_flags(VXF_IGNEG_NICE, 0) ? 0 : -EPERM;
47108
47109         retval = security_task_setnice(current, nice);
47110 @@ -6321,6 +6323,8 @@ recheck:
47111                 if (rt_policy(policy)) {
47112                         unsigned long rlim_rtprio;
47113
47114 +                       gr_learn_resource(p, RLIMIT_RTPRIO, param->sched_priority, 1);
47115 +
47116                         if (!lock_task_sighand(p, &flags))
47117                                 return -ESRCH;
47118                         rlim_rtprio = p->signal->rlim[RLIMIT_RTPRIO].rlim_cur;
47119 diff -urNp linux-2.6.33/kernel/signal.c linux-2.6.33/kernel/signal.c
47120 --- linux-2.6.33/kernel/signal.c        2010-02-24 13:52:17.000000000 -0500
47121 +++ linux-2.6.33/kernel/signal.c        2010-03-07 12:23:36.145647031 -0500
47122 @@ -226,6 +226,9 @@ __sigqueue_alloc(int sig, struct task_st
47123         atomic_inc(&user->sigpending);
47124         rcu_read_unlock();
47125
47126 +       if (!override_rlimit)
47127 +               gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
47128 +
47129         if (override_rlimit ||
47130             atomic_read(&user->sigpending) <=
47131                         t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur) {
47132 @@ -659,6 +662,10 @@ static int check_kill_permission(int sig
47133                         sig, info, t, vx_task_xid(t), t->pid, current->xid);
47134                 return error;
47135         }
47136 +
47137 +       if (gr_handle_signal(t, sig))
47138 +               return -EPERM;
47139 +
47140  skip:
47141         return security_task_kill(t, info, sig, 0);
47142  }
47143 @@ -1006,7 +1013,7 @@ __group_send_sig_info(int sig, struct si
47144         return send_signal(sig, info, p, 1);
47145  }
47146
47147 -static int
47148 +int
47149  specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
47150  {
47151         return send_signal(sig, info, t, 0);
47152 @@ -1060,6 +1067,9 @@ force_sig_info(int sig, struct siginfo *
47153         ret = specific_send_sig_info(sig, info, t);
47154         spin_unlock_irqrestore(&t->sighand->siglock, flags);
47155
47156 +       gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
47157 +       gr_handle_crash(t, sig);
47158 +
47159         return ret;
47160  }
47161
47162 @@ -1113,8 +1123,11 @@ int group_send_sig_info(int sig, struct
47163  {
47164         int ret = check_kill_permission(sig, info, p);
47165
47166 -       if (!ret && sig)
47167 +       if (!ret && sig) {
47168                 ret = do_send_sig_info(sig, info, p, true);
47169 +               if (!ret)
47170 +                       gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
47171 +       }
47172
47173         return ret;
47174  }
47175 diff -urNp linux-2.6.33/kernel/smp.c linux-2.6.33/kernel/smp.c
47176 --- linux-2.6.33/kernel/smp.c   2010-02-24 13:52:17.000000000 -0500
47177 +++ linux-2.6.33/kernel/smp.c   2010-03-07 12:23:36.145647031 -0500
47178 @@ -498,22 +498,22 @@ int smp_call_function(void (*func)(void
47179  }
47180  EXPORT_SYMBOL(smp_call_function);
47181
47182 -void ipi_call_lock(void)
47183 +void ipi_call_lock(void) __acquires(call_function.lock)
47184  {
47185         raw_spin_lock(&call_function.lock);
47186  }
47187
47188 -void ipi_call_unlock(void)
47189 +void ipi_call_unlock(void) __releases(call_function.lock)
47190  {
47191         raw_spin_unlock(&call_function.lock);
47192  }
47193
47194 -void ipi_call_lock_irq(void)
47195 +void ipi_call_lock_irq(void) __acquires(call_function.lock)
47196  {
47197         raw_spin_lock_irq(&call_function.lock);
47198  }
47199
47200 -void ipi_call_unlock_irq(void)
47201 +void ipi_call_unlock_irq(void) __releases(call_function.lock)
47202  {
47203         raw_spin_unlock_irq(&call_function.lock);
47204  }
47205 diff -urNp linux-2.6.33/kernel/softirq.c linux-2.6.33/kernel/softirq.c
47206 --- linux-2.6.33/kernel/softirq.c       2010-02-24 13:52:17.000000000 -0500
47207 +++ linux-2.6.33/kernel/softirq.c       2010-03-07 12:23:36.145647031 -0500
47208 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
47209
47210  static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
47211
47212 -char *softirq_to_name[NR_SOFTIRQS] = {
47213 +const char * const softirq_to_name[NR_SOFTIRQS] = {
47214         "HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
47215         "TASKLET", "SCHED", "HRTIMER",  "RCU"
47216  };
47217 @@ -190,7 +190,7 @@ EXPORT_SYMBOL(local_bh_enable_ip);
47218
47219  asmlinkage void __do_softirq(void)
47220  {
47221 -       struct softirq_action *h;
47222 +       const struct softirq_action *h;
47223         __u32 pending;
47224         int max_restart = MAX_SOFTIRQ_RESTART;
47225         int cpu;
47226 @@ -216,7 +216,7 @@ restart:
47227                         kstat_incr_softirqs_this_cpu(h - softirq_vec);
47228
47229                         trace_softirq_entry(h, softirq_vec);
47230 -                       h->action(h);
47231 +                       h->action();
47232                         trace_softirq_exit(h, softirq_vec);
47233                         if (unlikely(prev_count != preempt_count())) {
47234                                 printk(KERN_ERR "huh, entered softirq %td %s %p"
47235 @@ -340,7 +340,7 @@ void raise_softirq(unsigned int nr)
47236         local_irq_restore(flags);
47237  }
47238
47239 -void open_softirq(int nr, void (*action)(struct softirq_action *))
47240 +void open_softirq(int nr, void (*action)(void))
47241  {
47242         softirq_vec[nr].action = action;
47243  }
47244 @@ -396,7 +396,7 @@ void __tasklet_hi_schedule_first(struct
47245
47246  EXPORT_SYMBOL(__tasklet_hi_schedule_first);
47247
47248 -static void tasklet_action(struct softirq_action *a)
47249 +static void tasklet_action(void)
47250  {
47251         struct tasklet_struct *list;
47252
47253 @@ -431,7 +431,7 @@ static void tasklet_action(struct softir
47254         }
47255  }
47256
47257 -static void tasklet_hi_action(struct softirq_action *a)
47258 +static void tasklet_hi_action(void)
47259  {
47260         struct tasklet_struct *list;
47261
47262 diff -urNp linux-2.6.33/kernel/sys.c linux-2.6.33/kernel/sys.c
47263 --- linux-2.6.33/kernel/sys.c   2010-02-24 13:52:17.000000000 -0500
47264 +++ linux-2.6.33/kernel/sys.c   2010-03-07 12:23:36.145647031 -0500
47265 @@ -132,6 +132,12 @@ static int set_one_prio(struct task_stru
47266                 error = -EACCES;
47267                 goto out;
47268         }
47269 +
47270 +       if (gr_handle_chroot_setpriority(p, niceval)) {
47271 +               error = -EACCES;
47272 +               goto out;
47273 +       }
47274 +
47275         no_nice = security_task_setnice(p, niceval);
47276         if (no_nice) {
47277                 error = no_nice;
47278 @@ -513,6 +519,9 @@ SYSCALL_DEFINE2(setregid, gid_t, rgid, g
47279                         goto error;
47280         }
47281
47282 +       if (gr_check_group_change(new->gid, new->egid, -1))
47283 +               goto error;
47284 +
47285         if (rgid != (gid_t) -1 ||
47286             (egid != (gid_t) -1 && egid != old->gid))
47287                 new->sgid = new->egid;
47288 @@ -546,6 +555,10 @@ SYSCALL_DEFINE1(setgid, gid_t, gid)
47289                 goto error;
47290
47291         retval = -EPERM;
47292 +
47293 +       if (gr_check_group_change(gid, gid, gid))
47294 +               goto error;
47295 +
47296         if (capable(CAP_SETGID))
47297                 new->gid = new->egid = new->sgid = new->fsgid = gid;
47298         else if (gid == old->gid || gid == old->sgid)
47299 @@ -636,6 +649,9 @@ SYSCALL_DEFINE2(setreuid, uid_t, ruid, u
47300                         goto error;
47301         }
47302
47303 +       if (gr_check_user_change(new->uid, new->euid, -1))
47304 +               goto error;
47305 +
47306         if (new->uid != old->uid) {
47307                 retval = set_user(new);
47308                 if (retval < 0)
47309 @@ -684,6 +700,12 @@ SYSCALL_DEFINE1(setuid, uid_t, uid)
47310                 goto error;
47311
47312         retval = -EPERM;
47313 +
47314 +       if (gr_check_crash_uid(uid))
47315 +               goto error;
47316 +       if (gr_check_user_change(uid, uid, uid))
47317 +               goto error;
47318 +
47319         if (capable(CAP_SETUID)) {
47320                 new->suid = new->uid = uid;
47321                 if (uid != old->uid) {
47322 @@ -741,6 +763,9 @@ SYSCALL_DEFINE3(setresuid, uid_t, ruid,
47323                         goto error;
47324         }
47325
47326 +       if (gr_check_user_change(ruid, euid, -1))
47327 +               goto error;
47328 +
47329         if (ruid != (uid_t) -1) {
47330                 new->uid = ruid;
47331                 if (ruid != old->uid) {
47332 @@ -809,6 +834,9 @@ SYSCALL_DEFINE3(setresgid, gid_t, rgid,
47333                         goto error;
47334         }
47335
47336 +       if (gr_check_group_change(rgid, egid, -1))
47337 +               goto error;
47338 +
47339         if (rgid != (gid_t) -1)
47340                 new->gid = rgid;
47341         if (egid != (gid_t) -1)
47342 @@ -858,6 +886,9 @@ SYSCALL_DEFINE1(setfsuid, uid_t, uid)
47343         if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
47344                 goto error;
47345
47346 +       if (gr_check_user_change(-1, -1, uid))
47347 +               goto error;
47348 +
47349         if (uid == old->uid  || uid == old->euid  ||
47350             uid == old->suid || uid == old->fsuid ||
47351             capable(CAP_SETUID)) {
47352 @@ -898,6 +929,9 @@ SYSCALL_DEFINE1(setfsgid, gid_t, gid)
47353         if (gid == old->gid  || gid == old->egid  ||
47354             gid == old->sgid || gid == old->fsgid ||
47355             capable(CAP_SETGID)) {
47356 +               if (gr_check_group_change(-1, -1, gid))
47357 +                       goto error;
47358 +
47359                 if (gid != old_fsgid) {
47360                         new->fsgid = gid;
47361                         goto change_okay;
47362 @@ -1460,7 +1494,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsi
47363                         error = get_dumpable(me->mm);
47364                         break;
47365                 case PR_SET_DUMPABLE:
47366 -                       if (arg2 < 0 || arg2 > 1) {
47367 +                       if (arg2 > 1) {
47368                                 error = -EINVAL;
47369                                 break;
47370                         }
47371 diff -urNp linux-2.6.33/kernel/sysctl.c linux-2.6.33/kernel/sysctl.c
47372 --- linux-2.6.33/kernel/sysctl.c        2010-02-24 13:52:17.000000000 -0500
47373 +++ linux-2.6.33/kernel/sysctl.c        2010-03-07 12:23:36.145647031 -0500
47374 @@ -62,6 +62,13 @@
47375
47376
47377  #if defined(CONFIG_SYSCTL)
47378 +#include <linux/grsecurity.h>
47379 +#include <linux/grinternal.h>
47380 +
47381 +extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
47382 +extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
47383 +                               const int op);
47384 +extern int gr_handle_chroot_sysctl(const int op);
47385
47386  /* External variables not in a header file. */
47387  extern int C_A_D;
47388 @@ -169,6 +176,7 @@ static int proc_do_cad_pid(struct ctl_ta
47389  static int proc_taint(struct ctl_table *table, int write,
47390                                void __user *buffer, size_t *lenp, loff_t *ppos);
47391  #endif
47392 +extern ctl_table grsecurity_table[];
47393
47394  static struct ctl_table root_table[];
47395  static struct ctl_table_root sysctl_table_root;
47396 @@ -201,6 +209,20 @@ extern struct ctl_table epoll_table[];
47397  int sysctl_legacy_va_layout;
47398  #endif
47399
47400 +#ifdef CONFIG_PAX_SOFTMODE
47401 +static ctl_table pax_table[] = {
47402 +       {
47403 +               .procname       = "softmode",
47404 +               .data           = &pax_softmode,
47405 +               .maxlen         = sizeof(unsigned int),
47406 +               .mode           = 0600,
47407 +               .proc_handler   = &proc_dointvec,
47408 +       },
47409 +
47410 +       { }
47411 +};
47412 +#endif
47413 +
47414  extern int prove_locking;
47415  extern int lock_stat;
47416
47417 @@ -251,6 +273,22 @@ static int max_sched_shares_ratelimit =
47418  #endif
47419
47420  static struct ctl_table kern_table[] = {
47421 +#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
47422 +       {
47423 +               .procname       = "grsecurity",
47424 +               .mode           = 0500,
47425 +               .child          = grsecurity_table,
47426 +       },
47427 +#endif
47428 +
47429 +#ifdef CONFIG_PAX_SOFTMODE
47430 +       {
47431 +               .procname       = "pax",
47432 +               .mode           = 0500,
47433 +               .child          = pax_table,
47434 +       },
47435 +#endif
47436 +
47437         {
47438                 .procname       = "sched_child_runs_first",
47439                 .data           = &sysctl_sched_child_runs_first,
47440 @@ -1629,6 +1667,16 @@ int sysctl_perm(struct ctl_table_root *r
47441         int error;
47442         int mode;
47443
47444 +       if (table->parent != NULL && table->parent->procname != NULL &&
47445 +          table->procname != NULL &&
47446 +           gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
47447 +               return -EACCES;
47448 +       if (gr_handle_chroot_sysctl(op))
47449 +               return -EACCES;
47450 +       error = gr_handle_sysctl(table, op);
47451 +       if (error)
47452 +               return error;
47453 +
47454         error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
47455         if (error)
47456                 return error;
47457 @@ -2137,6 +2185,8 @@ static int __do_proc_dointvec(void *tbl_
47458                         len = strlen(buf);
47459                         if (len > left)
47460                                 len = left;
47461 +                       if (len > sizeof(buf))
47462 +                               len = sizeof(buf);
47463                         if(copy_to_user(s, buf, len))
47464                                 return -EFAULT;
47465                         left -= len;
47466 @@ -2362,6 +2412,8 @@ static int __do_proc_doulongvec_minmax(v
47467                         len = strlen(buf);
47468                         if (len > left)
47469                                 len = left;
47470 +                       if (len > sizeof(buf))
47471 +                               len = sizeof(buf);
47472                         if(copy_to_user(s, buf, len))
47473                                 return -EFAULT;
47474                         left -= len;
47475 diff -urNp linux-2.6.33/kernel/taskstats.c linux-2.6.33/kernel/taskstats.c
47476 --- linux-2.6.33/kernel/taskstats.c     2010-02-24 13:52:17.000000000 -0500
47477 +++ linux-2.6.33/kernel/taskstats.c     2010-03-07 12:23:36.145647031 -0500
47478 @@ -26,9 +26,12 @@
47479  #include <linux/cgroup.h>
47480  #include <linux/fs.h>
47481  #include <linux/file.h>
47482 +#include <linux/grsecurity.h>
47483  #include <net/genetlink.h>
47484  #include <asm/atomic.h>
47485
47486 +extern int gr_is_taskstats_denied(int pid);
47487 +
47488  /*
47489   * Maximum length of a cpumask that can be specified in
47490   * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
47491 @@ -433,6 +436,9 @@ static int taskstats_user_cmd(struct sk_
47492         size_t size;
47493         cpumask_var_t mask;
47494
47495 +       if (gr_is_taskstats_denied(current->pid))
47496 +               return -EACCES;
47497 +
47498         if (!alloc_cpumask_var(&mask, GFP_KERNEL))
47499                 return -ENOMEM;
47500
47501 diff -urNp linux-2.6.33/kernel/time/tick-broadcast.c linux-2.6.33/kernel/time/tick-broadcast.c
47502 --- linux-2.6.33/kernel/time/tick-broadcast.c   2010-02-24 13:52:17.000000000 -0500
47503 +++ linux-2.6.33/kernel/time/tick-broadcast.c   2010-03-07 12:23:36.145647031 -0500
47504 @@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
47505                  * then clear the broadcast bit.
47506                  */
47507                 if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
47508 -                       int cpu = smp_processor_id();
47509 +                       cpu = smp_processor_id();
47510
47511                         cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
47512                         tick_broadcast_clear_oneshot(cpu);
47513 diff -urNp linux-2.6.33/kernel/time.c linux-2.6.33/kernel/time.c
47514 --- linux-2.6.33/kernel/time.c  2010-02-24 13:52:17.000000000 -0500
47515 +++ linux-2.6.33/kernel/time.c  2010-03-07 12:23:36.149712570 -0500
47516 @@ -94,6 +94,9 @@ SYSCALL_DEFINE1(stime, time_t __user *,
47517                 return err;
47518
47519         vx_settimeofday(&tv);
47520 +
47521 +       gr_log_timechange();
47522 +
47523         return 0;
47524  }
47525
47526 @@ -202,6 +205,8 @@ SYSCALL_DEFINE2(settimeofday, struct tim
47527                         return -EFAULT;
47528         }
47529
47530 +       gr_log_timechange();
47531 +
47532         return do_sys_settimeofday(tv ? &new_ts : NULL, tz ? &new_tz : NULL);
47533  }
47534
47535 @@ -240,7 +245,7 @@ EXPORT_SYMBOL(current_fs_time);
47536   * Avoid unnecessary multiplications/divisions in the
47537   * two most common HZ cases:
47538   */
47539 -unsigned int inline jiffies_to_msecs(const unsigned long j)
47540 +inline unsigned int jiffies_to_msecs(const unsigned long j)
47541  {
47542  #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
47543         return (MSEC_PER_SEC / HZ) * j;
47544 @@ -256,7 +261,7 @@ unsigned int inline jiffies_to_msecs(con
47545  }
47546  EXPORT_SYMBOL(jiffies_to_msecs);
47547
47548 -unsigned int inline jiffies_to_usecs(const unsigned long j)
47549 +inline unsigned int jiffies_to_usecs(const unsigned long j)
47550  {
47551  #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
47552         return (USEC_PER_SEC / HZ) * j;
47553 diff -urNp linux-2.6.33/kernel/timer.c linux-2.6.33/kernel/timer.c
47554 --- linux-2.6.33/kernel/timer.c 2010-02-24 13:52:17.000000000 -0500
47555 +++ linux-2.6.33/kernel/timer.c 2010-03-07 12:23:36.149712570 -0500
47556 @@ -1206,7 +1206,7 @@ void update_process_times(int user_tick)
47557  /*
47558   * This function runs timers and the timer-tq in bottom half context.
47559   */
47560 -static void run_timer_softirq(struct softirq_action *h)
47561 +static void run_timer_softirq(void)
47562  {
47563         struct tvec_base *base = __get_cpu_var(tvec_bases);
47564
47565 diff -urNp linux-2.6.33/kernel/trace/ftrace.c linux-2.6.33/kernel/trace/ftrace.c
47566 --- linux-2.6.33/kernel/trace/ftrace.c  2010-02-24 13:52:17.000000000 -0500
47567 +++ linux-2.6.33/kernel/trace/ftrace.c  2010-03-07 12:23:36.149712570 -0500
47568 @@ -1102,13 +1102,18 @@ ftrace_code_disable(struct module *mod,
47569
47570         ip = rec->ip;
47571
47572 +       ret = ftrace_arch_code_modify_prepare();
47573 +       FTRACE_WARN_ON(ret);
47574 +       if (ret)
47575 +               return 0;
47576 +
47577         ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
47578 +       FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
47579         if (ret) {
47580                 ftrace_bug(ret, ip);
47581                 rec->flags |= FTRACE_FL_FAILED;
47582 -               return 0;
47583         }
47584 -       return 1;
47585 +       return ret ? 0 : 1;
47586  }
47587
47588  /*
47589 diff -urNp linux-2.6.33/kernel/trace/Kconfig linux-2.6.33/kernel/trace/Kconfig
47590 --- linux-2.6.33/kernel/trace/Kconfig   2010-02-24 13:52:17.000000000 -0500
47591 +++ linux-2.6.33/kernel/trace/Kconfig   2010-03-07 12:23:36.149712570 -0500
47592 @@ -124,6 +124,7 @@ if FTRACE
47593  config FUNCTION_TRACER
47594         bool "Kernel Function Tracer"
47595         depends on HAVE_FUNCTION_TRACER
47596 +       depends on !PAX_KERNEXEC
47597         select FRAME_POINTER
47598         select KALLSYMS
47599         select GENERIC_TRACER
47600 @@ -362,6 +363,7 @@ config PROFILE_KSYM_TRACER
47601  config STACK_TRACER
47602         bool "Trace max stack"
47603         depends on HAVE_FUNCTION_TRACER
47604 +       depends on !PAX_KERNEXEC
47605         select FUNCTION_TRACER
47606         select STACKTRACE
47607         select KALLSYMS
47608 diff -urNp linux-2.6.33/kernel/trace/trace.c linux-2.6.33/kernel/trace/trace.c
47609 --- linux-2.6.33/kernel/trace/trace.c   2010-02-24 13:52:17.000000000 -0500
47610 +++ linux-2.6.33/kernel/trace/trace.c   2010-03-07 12:23:36.149712570 -0500
47611 @@ -3820,10 +3820,9 @@ static const struct file_operations trac
47612  };
47613  #endif
47614
47615 -static struct dentry *d_tracer;
47616 -
47617  struct dentry *tracing_init_dentry(void)
47618  {
47619 +       static struct dentry *d_tracer;
47620         static int once;
47621
47622         if (d_tracer)
47623 @@ -3843,10 +3842,9 @@ struct dentry *tracing_init_dentry(void)
47624         return d_tracer;
47625  }
47626
47627 -static struct dentry *d_percpu;
47628 -
47629  struct dentry *tracing_dentry_percpu(void)
47630  {
47631 +       static struct dentry *d_percpu;
47632         static int once;
47633         struct dentry *d_tracer;
47634
47635 diff -urNp linux-2.6.33/kernel/trace/trace_output.c linux-2.6.33/kernel/trace/trace_output.c
47636 --- linux-2.6.33/kernel/trace/trace_output.c    2010-02-24 13:52:17.000000000 -0500
47637 +++ linux-2.6.33/kernel/trace/trace_output.c    2010-03-07 12:23:36.149712570 -0500
47638 @@ -280,7 +280,7 @@ int trace_seq_path(struct trace_seq *s,
47639
47640         p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
47641         if (!IS_ERR(p)) {
47642 -               p = mangle_path(s->buffer + s->len, p, "\n");
47643 +               p = mangle_path(s->buffer + s->len, p, "\n\\");
47644                 if (p) {
47645                         s->len = p - s->buffer;
47646                         return 1;
47647 diff -urNp linux-2.6.33/kernel/trace/trace_stack.c linux-2.6.33/kernel/trace/trace_stack.c
47648 --- linux-2.6.33/kernel/trace/trace_stack.c     2010-02-24 13:52:17.000000000 -0500
47649 +++ linux-2.6.33/kernel/trace/trace_stack.c     2010-03-07 12:23:36.149712570 -0500
47650 @@ -50,7 +50,7 @@ static inline void check_stack(void)
47651                 return;
47652
47653         /* we do not handle interrupt stacks yet */
47654 -       if (!object_is_on_stack(&this_size))
47655 +       if (!object_starts_on_stack(&this_size))
47656                 return;
47657
47658         local_irq_save(flags);
47659 diff -urNp linux-2.6.33/lib/bug.c linux-2.6.33/lib/bug.c
47660 --- linux-2.6.33/lib/bug.c      2010-02-24 13:52:17.000000000 -0500
47661 +++ linux-2.6.33/lib/bug.c      2010-03-07 12:23:36.149712570 -0500
47662 @@ -135,6 +135,8 @@ enum bug_trap_type report_bug(unsigned l
47663                 return BUG_TRAP_TYPE_NONE;
47664
47665         bug = find_bug(bugaddr);
47666 +       if (!bug)
47667 +               return BUG_TRAP_TYPE_NONE;
47668
47669         printk(KERN_EMERG "------------[ cut here ]------------\n");
47670
47671 diff -urNp linux-2.6.33/lib/debugobjects.c linux-2.6.33/lib/debugobjects.c
47672 --- linux-2.6.33/lib/debugobjects.c     2010-02-24 13:52:17.000000000 -0500
47673 +++ linux-2.6.33/lib/debugobjects.c     2010-03-07 12:23:36.149712570 -0500
47674 @@ -277,7 +277,7 @@ static void debug_object_is_on_stack(voi
47675         if (limit > 4)
47676                 return;
47677
47678 -       is_on_stack = object_is_on_stack(addr);
47679 +       is_on_stack = object_starts_on_stack(addr);
47680         if (is_on_stack == onstack)
47681                 return;
47682
47683 diff -urNp linux-2.6.33/lib/dma-debug.c linux-2.6.33/lib/dma-debug.c
47684 --- linux-2.6.33/lib/dma-debug.c        2010-02-24 13:52:17.000000000 -0500
47685 +++ linux-2.6.33/lib/dma-debug.c        2010-03-07 12:23:36.149712570 -0500
47686 @@ -861,7 +861,7 @@ out:
47687
47688  static void check_for_stack(struct device *dev, void *addr)
47689  {
47690 -       if (object_is_on_stack(addr))
47691 +       if (object_starts_on_stack(addr))
47692                 err_printk(dev, NULL, "DMA-API: device driver maps memory from"
47693                                 "stack [addr=%p]\n", addr);
47694  }
47695 diff -urNp linux-2.6.33/lib/inflate.c linux-2.6.33/lib/inflate.c
47696 --- linux-2.6.33/lib/inflate.c  2010-02-24 13:52:17.000000000 -0500
47697 +++ linux-2.6.33/lib/inflate.c  2010-03-07 12:23:36.149712570 -0500
47698 @@ -266,7 +266,7 @@ static void free(void *where)
47699                 malloc_ptr = free_mem_ptr;
47700  }
47701  #else
47702 -#define malloc(a) kmalloc(a, GFP_KERNEL)
47703 +#define malloc(a) kmalloc((a), GFP_KERNEL)
47704  #define free(a) kfree(a)
47705  #endif
47706
47707 diff -urNp linux-2.6.33/lib/Kconfig.debug linux-2.6.33/lib/Kconfig.debug
47708 --- linux-2.6.33/lib/Kconfig.debug      2010-02-24 13:52:17.000000000 -0500
47709 +++ linux-2.6.33/lib/Kconfig.debug      2010-03-07 12:23:36.149712570 -0500
47710 @@ -914,7 +914,7 @@ config LATENCYTOP
47711         select STACKTRACE
47712         select SCHEDSTATS
47713         select SCHED_DEBUG
47714 -       depends on HAVE_LATENCYTOP_SUPPORT
47715 +       depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
47716         help
47717           Enable this option if you want to use the LatencyTOP tool
47718           to find out which userspace is blocking on what kernel operations.
47719 diff -urNp linux-2.6.33/lib/kobject.c linux-2.6.33/lib/kobject.c
47720 --- linux-2.6.33/lib/kobject.c  2010-02-24 13:52:17.000000000 -0500
47721 +++ linux-2.6.33/lib/kobject.c  2010-03-07 12:23:36.149712570 -0500
47722 @@ -700,7 +700,7 @@ static ssize_t kobj_attr_store(struct ko
47723         return ret;
47724  }
47725
47726 -struct sysfs_ops kobj_sysfs_ops = {
47727 +const struct sysfs_ops kobj_sysfs_ops = {
47728         .show   = kobj_attr_show,
47729         .store  = kobj_attr_store,
47730  };
47731 @@ -789,7 +789,7 @@ static struct kobj_type kset_ktype = {
47732   * If the kset was not able to be created, NULL will be returned.
47733   */
47734  static struct kset *kset_create(const char *name,
47735 -                               struct kset_uevent_ops *uevent_ops,
47736 +                               const struct kset_uevent_ops *uevent_ops,
47737                                 struct kobject *parent_kobj)
47738  {
47739         struct kset *kset;
47740 @@ -832,7 +832,7 @@ static struct kset *kset_create(const ch
47741   * If the kset was not able to be created, NULL will be returned.
47742   */
47743  struct kset *kset_create_and_add(const char *name,
47744 -                                struct kset_uevent_ops *uevent_ops,
47745 +                                const struct kset_uevent_ops *uevent_ops,
47746                                  struct kobject *parent_kobj)
47747  {
47748         struct kset *kset;
47749 diff -urNp linux-2.6.33/lib/kobject_uevent.c linux-2.6.33/lib/kobject_uevent.c
47750 --- linux-2.6.33/lib/kobject_uevent.c   2010-02-24 13:52:17.000000000 -0500
47751 +++ linux-2.6.33/lib/kobject_uevent.c   2010-03-07 12:23:36.153640756 -0500
47752 @@ -95,7 +95,7 @@ int kobject_uevent_env(struct kobject *k
47753         const char *subsystem;
47754         struct kobject *top_kobj;
47755         struct kset *kset;
47756 -       struct kset_uevent_ops *uevent_ops;
47757 +       const struct kset_uevent_ops *uevent_ops;
47758         u64 seq;
47759         int i = 0;
47760         int retval = 0;
47761 diff -urNp linux-2.6.33/lib/parser.c linux-2.6.33/lib/parser.c
47762 --- linux-2.6.33/lib/parser.c   2010-02-24 13:52:17.000000000 -0500
47763 +++ linux-2.6.33/lib/parser.c   2010-03-07 12:23:36.153640756 -0500
47764 @@ -129,7 +129,7 @@ static int match_number(substring_t *s,
47765         char *buf;
47766         int ret;
47767
47768 -       buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
47769 +       buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
47770         if (!buf)
47771                 return -ENOMEM;
47772         memcpy(buf, s->from, s->to - s->from);
47773 diff -urNp linux-2.6.33/lib/radix-tree.c linux-2.6.33/lib/radix-tree.c
47774 --- linux-2.6.33/lib/radix-tree.c       2010-02-24 13:52:17.000000000 -0500
47775 +++ linux-2.6.33/lib/radix-tree.c       2010-03-07 12:23:36.153640756 -0500
47776 @@ -81,7 +81,7 @@ struct radix_tree_preload {
47777         int nr;
47778         struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
47779  };
47780 -static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
47781 +static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
47782
47783  static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
47784  {
47785 diff -urNp linux-2.6.33/lib/random32.c linux-2.6.33/lib/random32.c
47786 --- linux-2.6.33/lib/random32.c 2010-02-24 13:52:17.000000000 -0500
47787 +++ linux-2.6.33/lib/random32.c 2010-03-07 12:23:36.153640756 -0500
47788 @@ -61,7 +61,7 @@ static u32 __random32(struct rnd_state *
47789   */
47790  static inline u32 __seed(u32 x, u32 m)
47791  {
47792 -       return (x < m) ? x + m : x;
47793 +       return (x <= m) ? x + m + 1 : x;
47794  }
47795
47796  /**
47797 diff -urNp linux-2.6.33/localversion-grsec linux-2.6.33/localversion-grsec
47798 --- linux-2.6.33/localversion-grsec     1969-12-31 19:00:00.000000000 -0500
47799 +++ linux-2.6.33/localversion-grsec     2010-03-07 12:23:36.153640756 -0500
47800 @@ -0,0 +1 @@
47801 +-grsec
47802 diff -urNp linux-2.6.33/Makefile linux-2.6.33/Makefile
47803 --- linux-2.6.33/Makefile       2010-02-24 13:52:17.000000000 -0500
47804 +++ linux-2.6.33/Makefile       2010-03-07 12:23:36.153640756 -0500
47805 @@ -227,8 +227,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
47806
47807  HOSTCC       = gcc
47808  HOSTCXX      = g++
47809 -HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
47810 -HOSTCXXFLAGS = -O2
47811 +HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
47812 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
47813
47814  # Decide whether to build built-in, modular, or both.
47815  # Normally, just do built-in.
47816 @@ -650,7 +650,7 @@ export mod_strip_cmd
47817
47818
47819  ifeq ($(KBUILD_EXTMOD),)
47820 -core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/
47821 +core-y         += kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
47822
47823  vmlinux-dirs   := $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
47824                      $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
47825 diff -urNp linux-2.6.33/mm/filemap.c linux-2.6.33/mm/filemap.c
47826 --- linux-2.6.33/mm/filemap.c   2010-02-24 13:52:17.000000000 -0500
47827 +++ linux-2.6.33/mm/filemap.c   2010-03-07 12:23:36.153640756 -0500
47828 @@ -1601,7 +1601,7 @@ int generic_file_mmap(struct file * file
47829         struct address_space *mapping = file->f_mapping;
47830
47831         if (!mapping->a_ops->readpage)
47832 -               return -ENOEXEC;
47833 +               return -ENODEV;
47834         file_accessed(file);
47835         vma->vm_ops = &generic_file_vm_ops;
47836         vma->vm_flags |= VM_CAN_NONLINEAR;
47837 @@ -1997,6 +1997,7 @@ inline int generic_write_checks(struct f
47838                          *pos = i_size_read(inode);
47839
47840                 if (limit != RLIM_INFINITY) {
47841 +                       gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
47842                         if (*pos >= limit) {
47843                                 send_sig(SIGXFSZ, current, 0);
47844                                 return -EFBIG;
47845 diff -urNp linux-2.6.33/mm/fremap.c linux-2.6.33/mm/fremap.c
47846 --- linux-2.6.33/mm/fremap.c    2010-02-24 13:52:17.000000000 -0500
47847 +++ linux-2.6.33/mm/fremap.c    2010-03-07 12:23:36.153640756 -0500
47848 @@ -153,6 +153,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
47849   retry:
47850         vma = find_vma(mm, start);
47851
47852 +#ifdef CONFIG_PAX_SEGMEXEC
47853 +       if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
47854 +               goto out;
47855 +#endif
47856 +
47857         /*
47858          * Make sure the vma is shared, that it supports prefaulting,
47859          * and that the remapped range is valid and fully within
47860 diff -urNp linux-2.6.33/mm/highmem.c linux-2.6.33/mm/highmem.c
47861 --- linux-2.6.33/mm/highmem.c   2010-02-24 13:52:17.000000000 -0500
47862 +++ linux-2.6.33/mm/highmem.c   2010-03-07 12:23:36.153640756 -0500
47863 @@ -116,9 +116,10 @@ static void flush_all_zero_pkmaps(void)
47864                  * So no dangers, even with speculative execution.
47865                  */
47866                 page = pte_page(pkmap_page_table[i]);
47867 +               pax_open_kernel();
47868                 pte_clear(&init_mm, (unsigned long)page_address(page),
47869                           &pkmap_page_table[i]);
47870 -
47871 +               pax_close_kernel();
47872                 set_page_address(page, NULL);
47873                 need_flush = 1;
47874         }
47875 @@ -177,9 +178,11 @@ start:
47876                 }
47877         }
47878         vaddr = PKMAP_ADDR(last_pkmap_nr);
47879 +
47880 +       pax_open_kernel();
47881         set_pte_at(&init_mm, vaddr,
47882                    &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
47883 -
47884 +       pax_close_kernel();
47885         pkmap_count[last_pkmap_nr] = 1;
47886         set_page_address(page, (void *)vaddr);
47887
47888 diff -urNp linux-2.6.33/mm/hugetlb.c linux-2.6.33/mm/hugetlb.c
47889 --- linux-2.6.33/mm/hugetlb.c   2010-02-24 13:52:17.000000000 -0500
47890 +++ linux-2.6.33/mm/hugetlb.c   2010-03-07 12:23:36.153640756 -0500
47891 @@ -2267,6 +2267,26 @@ static int unmap_ref_private(struct mm_s
47892         return 1;
47893  }
47894
47895 +#ifdef CONFIG_PAX_SEGMEXEC
47896 +static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
47897 +{
47898 +       struct mm_struct *mm = vma->vm_mm;
47899 +       struct vm_area_struct *vma_m;
47900 +       unsigned long address_m;
47901 +       pte_t *ptep_m;
47902 +
47903 +       vma_m = pax_find_mirror_vma(vma);
47904 +       if (!vma_m)
47905 +               return;
47906 +
47907 +       BUG_ON(address >= SEGMEXEC_TASK_SIZE);
47908 +       address_m = address + SEGMEXEC_TASK_SIZE;
47909 +       ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
47910 +       get_page(page_m);
47911 +       set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
47912 +}
47913 +#endif
47914 +
47915  static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
47916                         unsigned long address, pte_t *ptep, pte_t pte,
47917                         struct page *pagecache_page)
47918 @@ -2347,6 +2367,11 @@ retry_avoidcopy:
47919                 huge_ptep_clear_flush(vma, address, ptep);
47920                 set_huge_pte_at(mm, address, ptep,
47921                                 make_huge_pte(vma, new_page, 1));
47922 +
47923 +#ifdef CONFIG_PAX_SEGMEXEC
47924 +               pax_mirror_huge_pte(vma, address, new_page);
47925 +#endif
47926 +
47927                 /* Make the old page be freed below */
47928                 new_page = old_page;
47929         }
47930 @@ -2476,6 +2501,10 @@ retry:
47931                                 && (vma->vm_flags & VM_SHARED)));
47932         set_huge_pte_at(mm, address, ptep, new_pte);
47933
47934 +#ifdef CONFIG_PAX_SEGMEXEC
47935 +       pax_mirror_huge_pte(vma, address, page);
47936 +#endif
47937 +
47938         if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
47939                 /* Optimization, do the COW without a second fault */
47940                 ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
47941 @@ -2504,6 +2533,28 @@ int hugetlb_fault(struct mm_struct *mm,
47942         static DEFINE_MUTEX(hugetlb_instantiation_mutex);
47943         struct hstate *h = hstate_vma(vma);
47944
47945 +#ifdef CONFIG_PAX_SEGMEXEC
47946 +       struct vm_area_struct *vma_m;
47947 +
47948 +       vma_m = pax_find_mirror_vma(vma);
47949 +       if (vma_m) {
47950 +               unsigned long address_m;
47951 +
47952 +               if (vma->vm_start > vma_m->vm_start) {
47953 +                       address_m = address;
47954 +                       address -= SEGMEXEC_TASK_SIZE;
47955 +                       vma = vma_m;
47956 +                       h = hstate_vma(vma);
47957 +               } else
47958 +                       address_m = address + SEGMEXEC_TASK_SIZE;
47959 +
47960 +               if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
47961 +                       return VM_FAULT_OOM;
47962 +               address_m &= HPAGE_MASK;
47963 +               unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
47964 +       }
47965 +#endif
47966 +
47967         ptep = huge_pte_alloc(mm, address, huge_page_size(h));
47968         if (!ptep)
47969                 return VM_FAULT_OOM;
47970 diff -urNp linux-2.6.33/mm/Kconfig linux-2.6.33/mm/Kconfig
47971 --- linux-2.6.33/mm/Kconfig     2010-02-24 13:52:17.000000000 -0500
47972 +++ linux-2.6.33/mm/Kconfig     2010-03-07 12:23:36.153640756 -0500
47973 @@ -222,7 +222,7 @@ config KSM
47974  config DEFAULT_MMAP_MIN_ADDR
47975          int "Low address space to protect from user allocation"
47976         depends on MMU
47977 -        default 4096
47978 +        default 65536
47979          help
47980           This is the portion of low virtual memory which should be protected
47981           from userspace allocation.  Keeping a user from writing to low pages
47982 diff -urNp linux-2.6.33/mm/maccess.c linux-2.6.33/mm/maccess.c
47983 --- linux-2.6.33/mm/maccess.c   2010-02-24 13:52:17.000000000 -0500
47984 +++ linux-2.6.33/mm/maccess.c   2010-03-07 12:23:36.153640756 -0500
47985 @@ -15,10 +15,10 @@
47986   * happens, handle that and return -EFAULT.
47987   */
47988
47989 -long __weak probe_kernel_read(void *dst, void *src, size_t size)
47990 +long __weak probe_kernel_read(void *dst, const void *src, size_t size)
47991      __attribute__((alias("__probe_kernel_read")));
47992
47993 -long __probe_kernel_read(void *dst, void *src, size_t size)
47994 +long __probe_kernel_read(void *dst, const void *src, size_t size)
47995  {
47996         long ret;
47997         mm_segment_t old_fs = get_fs();
47998 @@ -43,10 +43,10 @@ EXPORT_SYMBOL_GPL(probe_kernel_read);
47999   * Safely write to address @dst from the buffer at @src.  If a kernel fault
48000   * happens, handle that and return -EFAULT.
48001   */
48002 -long __weak probe_kernel_write(void *dst, void *src, size_t size)
48003 +long __weak probe_kernel_write(void *dst, const void *src, size_t size)
48004      __attribute__((alias("__probe_kernel_write")));
48005
48006 -long __probe_kernel_write(void *dst, void *src, size_t size)
48007 +long __probe_kernel_write(void *dst, const void *src, size_t size)
48008  {
48009         long ret;
48010         mm_segment_t old_fs = get_fs();
48011 diff -urNp linux-2.6.33/mm/madvise.c linux-2.6.33/mm/madvise.c
48012 --- linux-2.6.33/mm/madvise.c   2010-02-24 13:52:17.000000000 -0500
48013 +++ linux-2.6.33/mm/madvise.c   2010-03-07 12:23:36.153640756 -0500
48014 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
48015         pgoff_t pgoff;
48016         unsigned long new_flags = vma->vm_flags;
48017
48018 +#ifdef CONFIG_PAX_SEGMEXEC
48019 +       struct vm_area_struct *vma_m;
48020 +#endif
48021 +
48022         switch (behavior) {
48023         case MADV_NORMAL:
48024                 new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
48025 @@ -104,6 +108,13 @@ success:
48026         /*
48027          * vm_flags is protected by the mmap_sem held in write mode.
48028          */
48029 +
48030 +#ifdef CONFIG_PAX_SEGMEXEC
48031 +       vma_m = pax_find_mirror_vma(vma);
48032 +       if (vma_m)
48033 +               vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
48034 +#endif
48035 +
48036         vma->vm_flags = new_flags;
48037
48038  out:
48039 @@ -162,6 +173,11 @@ static long madvise_dontneed(struct vm_a
48040                              struct vm_area_struct ** prev,
48041                              unsigned long start, unsigned long end)
48042  {
48043 +
48044 +#ifdef CONFIG_PAX_SEGMEXEC
48045 +       struct vm_area_struct *vma_m;
48046 +#endif
48047 +
48048         *prev = vma;
48049         if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
48050                 return -EINVAL;
48051 @@ -174,6 +190,21 @@ static long madvise_dontneed(struct vm_a
48052                 zap_page_range(vma, start, end - start, &details);
48053         } else
48054                 zap_page_range(vma, start, end - start, NULL);
48055 +
48056 +#ifdef CONFIG_PAX_SEGMEXEC
48057 +       vma_m = pax_find_mirror_vma(vma);
48058 +       if (vma_m) {
48059 +               if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
48060 +                       struct zap_details details = {
48061 +                               .nonlinear_vma = vma_m,
48062 +                               .last_index = ULONG_MAX,
48063 +                       };
48064 +                       zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
48065 +               } else
48066 +                       zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
48067 +       }
48068 +#endif
48069 +
48070         return 0;
48071  }
48072
48073 @@ -366,6 +397,16 @@ SYSCALL_DEFINE3(madvise, unsigned long,
48074         if (end < start)
48075                 goto out;
48076
48077 +#ifdef CONFIG_PAX_SEGMEXEC
48078 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
48079 +               if (end > SEGMEXEC_TASK_SIZE)
48080 +                       goto out;
48081 +       } else
48082 +#endif
48083 +
48084 +       if (end > TASK_SIZE)
48085 +               goto out;
48086 +
48087         error = 0;
48088         if (end == start)
48089                 goto out;
48090 diff -urNp linux-2.6.33/mm/memory.c linux-2.6.33/mm/memory.c
48091 --- linux-2.6.33/mm/memory.c    2010-02-24 13:52:17.000000000 -0500
48092 +++ linux-2.6.33/mm/memory.c    2010-03-07 12:23:36.153640756 -0500
48093 @@ -48,6 +48,7 @@
48094  #include <linux/ksm.h>
48095  #include <linux/rmap.h>
48096  #include <linux/module.h>
48097 +#include <linux/security.h>
48098  #include <linux/delayacct.h>
48099  #include <linux/init.h>
48100  #include <linux/writeback.h>
48101 @@ -1266,10 +1267,10 @@ int __get_user_pages(struct task_struct
48102                         (VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
48103         i = 0;
48104
48105 -       do {
48106 +       while (nr_pages) {
48107                 struct vm_area_struct *vma;
48108
48109 -               vma = find_extend_vma(mm, start);
48110 +               vma = find_vma(mm, start);
48111                 if (!vma && in_gate_area(tsk, start)) {
48112                         unsigned long pg = start & PAGE_MASK;
48113                         struct vm_area_struct *gate_vma = get_gate_vma(tsk);
48114 @@ -1311,7 +1312,7 @@ int __get_user_pages(struct task_struct
48115                         continue;
48116                 }
48117
48118 -               if (!vma ||
48119 +               if (!vma || start < vma->vm_start ||
48120                     (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
48121                     !(vm_flags & vma->vm_flags))
48122                         return i ? : -EFAULT;
48123 @@ -1386,7 +1387,7 @@ int __get_user_pages(struct task_struct
48124                         start += PAGE_SIZE;
48125                         nr_pages--;
48126                 } while (nr_pages && start < vma->vm_end);
48127 -       } while (nr_pages);
48128 +       }
48129         return i;
48130  }
48131
48132 @@ -1982,6 +1983,186 @@ static inline void cow_user_page(struct
48133                 copy_user_highpage(dst, src, va, vma);
48134  }
48135
48136 +#ifdef CONFIG_PAX_SEGMEXEC
48137 +static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
48138 +{
48139 +       struct mm_struct *mm = vma->vm_mm;
48140 +       spinlock_t *ptl;
48141 +       pte_t *pte, entry;
48142 +
48143 +       pte = pte_offset_map_lock(mm, pmd, address, &ptl);
48144 +       entry = *pte;
48145 +       if (!pte_present(entry)) {
48146 +               if (!pte_none(entry)) {
48147 +                       BUG_ON(pte_file(entry));
48148 +                       free_swap_and_cache(pte_to_swp_entry(entry));
48149 +                       pte_clear_not_present_full(mm, address, pte, 0);
48150 +               }
48151 +       } else {
48152 +               struct page *page;
48153 +
48154 +               flush_cache_page(vma, address, pte_pfn(entry));
48155 +               entry = ptep_clear_flush(vma, address, pte);
48156 +               BUG_ON(pte_dirty(entry));
48157 +               page = vm_normal_page(vma, address, entry);
48158 +               if (page) {
48159 +                       update_hiwater_rss(mm);
48160 +                       if (PageAnon(page))
48161 +                               dec_mm_counter(mm, anon_rss);
48162 +                       else
48163 +                               dec_mm_counter(mm, file_rss);
48164 +                       page_remove_rmap(page);
48165 +                       page_cache_release(page);
48166 +               }
48167 +       }
48168 +       pte_unmap_unlock(pte, ptl);
48169 +}
48170 +
48171 +/* PaX: if vma is mirrored, synchronize the mirror's PTE
48172 + *
48173 + * the ptl of the lower mapped page is held on entry and is not released on exit
48174 + * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
48175 + */
48176 +static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
48177 +{
48178 +       struct mm_struct *mm = vma->vm_mm;
48179 +       unsigned long address_m;
48180 +       spinlock_t *ptl_m;
48181 +       struct vm_area_struct *vma_m;
48182 +       pmd_t *pmd_m;
48183 +       pte_t *pte_m, entry_m;
48184 +
48185 +       BUG_ON(!page_m || !PageAnon(page_m));
48186 +
48187 +       vma_m = pax_find_mirror_vma(vma);
48188 +       if (!vma_m)
48189 +               return;
48190 +
48191 +       BUG_ON(!PageLocked(page_m));
48192 +       BUG_ON(address >= SEGMEXEC_TASK_SIZE);
48193 +       address_m = address + SEGMEXEC_TASK_SIZE;
48194 +       pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
48195 +       pte_m = pte_offset_map_nested(pmd_m, address_m);
48196 +       ptl_m = pte_lockptr(mm, pmd_m);
48197 +       if (ptl != ptl_m) {
48198 +               spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
48199 +               if (!pte_none(*pte_m))
48200 +                       goto out;
48201 +       }
48202 +
48203 +       entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
48204 +       page_cache_get(page_m);
48205 +       page_add_anon_rmap(page_m, vma_m, address_m);
48206 +       inc_mm_counter(mm, anon_rss);
48207 +       set_pte_at(mm, address_m, pte_m, entry_m);
48208 +       update_mmu_cache(vma_m, address_m, entry_m);
48209 +out:
48210 +       if (ptl != ptl_m)
48211 +               spin_unlock(ptl_m);
48212 +       pte_unmap_nested(pte_m);
48213 +       unlock_page(page_m);
48214 +}
48215 +
48216 +void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
48217 +{
48218 +       struct mm_struct *mm = vma->vm_mm;
48219 +       unsigned long address_m;
48220 +       spinlock_t *ptl_m;
48221 +       struct vm_area_struct *vma_m;
48222 +       pmd_t *pmd_m;
48223 +       pte_t *pte_m, entry_m;
48224 +
48225 +       BUG_ON(!page_m || PageAnon(page_m));
48226 +
48227 +       vma_m = pax_find_mirror_vma(vma);
48228 +       if (!vma_m)
48229 +               return;
48230 +
48231 +       BUG_ON(address >= SEGMEXEC_TASK_SIZE);
48232 +       address_m = address + SEGMEXEC_TASK_SIZE;
48233 +       pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
48234 +       pte_m = pte_offset_map_nested(pmd_m, address_m);
48235 +       ptl_m = pte_lockptr(mm, pmd_m);
48236 +       if (ptl != ptl_m) {
48237 +               spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
48238 +               if (!pte_none(*pte_m))
48239 +                       goto out;
48240 +       }
48241 +
48242 +       entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
48243 +       page_cache_get(page_m);
48244 +       page_add_file_rmap(page_m);
48245 +       inc_mm_counter(mm, file_rss);
48246 +       set_pte_at(mm, address_m, pte_m, entry_m);
48247 +       update_mmu_cache(vma_m, address_m, entry_m);
48248 +out:
48249 +       if (ptl != ptl_m)
48250 +               spin_unlock(ptl_m);
48251 +       pte_unmap_nested(pte_m);
48252 +}
48253 +
48254 +static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
48255 +{
48256 +       struct mm_struct *mm = vma->vm_mm;
48257 +       unsigned long address_m;
48258 +       spinlock_t *ptl_m;
48259 +       struct vm_area_struct *vma_m;
48260 +       pmd_t *pmd_m;
48261 +       pte_t *pte_m, entry_m;
48262 +
48263 +       vma_m = pax_find_mirror_vma(vma);
48264 +       if (!vma_m)
48265 +               return;
48266 +
48267 +       BUG_ON(address >= SEGMEXEC_TASK_SIZE);
48268 +       address_m = address + SEGMEXEC_TASK_SIZE;
48269 +       pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
48270 +       pte_m = pte_offset_map_nested(pmd_m, address_m);
48271 +       ptl_m = pte_lockptr(mm, pmd_m);
48272 +       if (ptl != ptl_m) {
48273 +               spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
48274 +               if (!pte_none(*pte_m))
48275 +                       goto out;
48276 +       }
48277 +
48278 +       entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
48279 +       set_pte_at(mm, address_m, pte_m, entry_m);
48280 +out:
48281 +       if (ptl != ptl_m)
48282 +               spin_unlock(ptl_m);
48283 +       pte_unmap_nested(pte_m);
48284 +}
48285 +
48286 +static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
48287 +{
48288 +       struct page *page_m;
48289 +       pte_t entry;
48290 +
48291 +       if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
48292 +               goto out;
48293 +
48294 +       entry = *pte;
48295 +       page_m  = vm_normal_page(vma, address, entry);
48296 +       if (!page_m)
48297 +               pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
48298 +       else if (PageAnon(page_m)) {
48299 +               if (pax_find_mirror_vma(vma)) {
48300 +                       pte_unmap_unlock(pte, ptl);
48301 +                       lock_page(page_m);
48302 +                       pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
48303 +                       if (pte_same(entry, *pte))
48304 +                               pax_mirror_anon_pte(vma, address, page_m, ptl);
48305 +                       else
48306 +                               unlock_page(page_m);
48307 +               }
48308 +       } else
48309 +               pax_mirror_file_pte(vma, address, page_m, ptl);
48310 +
48311 +out:
48312 +       pte_unmap_unlock(pte, ptl);
48313 +}
48314 +#endif
48315 +
48316  /*
48317   * This routine handles present pages, when users try to write
48318   * to a shared page. It is done by copying the page to a new address
48319 @@ -2161,6 +2342,12 @@ gotten:
48320          */
48321         page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
48322         if (likely(pte_same(*page_table, orig_pte))) {
48323 +
48324 +#ifdef CONFIG_PAX_SEGMEXEC
48325 +               if (pax_find_mirror_vma(vma))
48326 +                       BUG_ON(!trylock_page(new_page));
48327 +#endif
48328 +
48329                 if (old_page) {
48330                         if (!PageAnon(old_page)) {
48331                                 dec_mm_counter(mm, file_rss);
48332 @@ -2212,6 +2399,10 @@ gotten:
48333                         page_remove_rmap(old_page);
48334                 }
48335
48336 +#ifdef CONFIG_PAX_SEGMEXEC
48337 +               pax_mirror_anon_pte(vma, address, new_page, ptl);
48338 +#endif
48339 +
48340                 /* Free the old page.. */
48341                 new_page = old_page;
48342                 ret |= VM_FAULT_WRITE;
48343 @@ -2619,6 +2810,11 @@ static int do_swap_page(struct mm_struct
48344         swap_free(entry);
48345         if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
48346                 try_to_free_swap(page);
48347 +
48348 +#ifdef CONFIG_PAX_SEGMEXEC
48349 +       if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
48350 +#endif
48351 +
48352         unlock_page(page);
48353
48354         if (flags & FAULT_FLAG_WRITE) {
48355 @@ -2630,6 +2826,11 @@ static int do_swap_page(struct mm_struct
48356
48357         /* No need to invalidate - it was non-present before */
48358         update_mmu_cache(vma, address, pte);
48359 +
48360 +#ifdef CONFIG_PAX_SEGMEXEC
48361 +       pax_mirror_anon_pte(vma, address, page, ptl);
48362 +#endif
48363 +
48364  unlock:
48365         pte_unmap_unlock(page_table, ptl);
48366  out:
48367 @@ -2653,7 +2854,7 @@ static int do_anonymous_page(struct mm_s
48368                 unsigned long address, pte_t *page_table, pmd_t *pmd,
48369                 unsigned int flags)
48370  {
48371 -       struct page *page;
48372 +       struct page *page = NULL;
48373         spinlock_t *ptl;
48374         pte_t entry;
48375
48376 @@ -2688,6 +2889,11 @@ static int do_anonymous_page(struct mm_s
48377         if (!pte_none(*page_table))
48378                 goto release;
48379
48380 +#ifdef CONFIG_PAX_SEGMEXEC
48381 +       if (pax_find_mirror_vma(vma))
48382 +               BUG_ON(!trylock_page(page));
48383 +#endif
48384 +
48385         inc_mm_counter(mm, anon_rss);
48386         page_add_new_anon_rmap(page, vma, address);
48387  setpte:
48388 @@ -2695,6 +2901,12 @@ setpte:
48389
48390         /* No need to invalidate - it was non-present before */
48391         update_mmu_cache(vma, address, entry);
48392 +
48393 +#ifdef CONFIG_PAX_SEGMEXEC
48394 +       if (page)
48395 +               pax_mirror_anon_pte(vma, address, page, ptl);
48396 +#endif
48397 +
48398  unlock:
48399         pte_unmap_unlock(page_table, ptl);
48400         return 0;
48401 @@ -2837,6 +3049,12 @@ static int __do_fault(struct mm_struct *
48402          */
48403         /* Only go through if we didn't race with anybody else... */
48404         if (likely(pte_same(*page_table, orig_pte))) {
48405 +
48406 +#ifdef CONFIG_PAX_SEGMEXEC
48407 +               if (anon && pax_find_mirror_vma(vma))
48408 +                       BUG_ON(!trylock_page(page));
48409 +#endif
48410 +
48411                 flush_icache_page(vma, page);
48412                 entry = mk_pte(page, vma->vm_page_prot);
48413                 if (flags & FAULT_FLAG_WRITE)
48414 @@ -2856,6 +3074,14 @@ static int __do_fault(struct mm_struct *
48415
48416                 /* no need to invalidate: a not-present page won't be cached */
48417                 update_mmu_cache(vma, address, entry);
48418 +
48419 +#ifdef CONFIG_PAX_SEGMEXEC
48420 +               if (anon)
48421 +                       pax_mirror_anon_pte(vma, address, page, ptl);
48422 +               else
48423 +                       pax_mirror_file_pte(vma, address, page, ptl);
48424 +#endif
48425 +
48426         } else {
48427                 if (charged)
48428                         mem_cgroup_uncharge_page(page);
48429 @@ -3003,6 +3229,12 @@ static inline int handle_pte_fault(struc
48430                 if (flags & FAULT_FLAG_WRITE)
48431                         flush_tlb_page(vma, address);
48432         }
48433 +
48434 +#ifdef CONFIG_PAX_SEGMEXEC
48435 +       pax_mirror_pte(vma, address, pte, pmd, ptl);
48436 +       return 0;
48437 +#endif
48438 +
48439  unlock:
48440         pte_unmap_unlock(pte, ptl);
48441         return 0;
48442 @@ -3019,6 +3251,10 @@ int handle_mm_fault(struct mm_struct *mm
48443         pmd_t *pmd;
48444         pte_t *pte;
48445
48446 +#ifdef CONFIG_PAX_SEGMEXEC
48447 +       struct vm_area_struct *vma_m;
48448 +#endif
48449 +
48450         __set_current_state(TASK_RUNNING);
48451
48452         count_vm_event(PGFAULT);
48453 @@ -3026,6 +3262,34 @@ int handle_mm_fault(struct mm_struct *mm
48454         if (unlikely(is_vm_hugetlb_page(vma)))
48455                 return hugetlb_fault(mm, vma, address, flags);
48456
48457 +#ifdef CONFIG_PAX_SEGMEXEC
48458 +       vma_m = pax_find_mirror_vma(vma);
48459 +       if (vma_m) {
48460 +               unsigned long address_m;
48461 +               pgd_t *pgd_m;
48462 +               pud_t *pud_m;
48463 +               pmd_t *pmd_m;
48464 +
48465 +               if (vma->vm_start > vma_m->vm_start) {
48466 +                       address_m = address;
48467 +                       address -= SEGMEXEC_TASK_SIZE;
48468 +                       vma = vma_m;
48469 +               } else
48470 +                       address_m = address + SEGMEXEC_TASK_SIZE;
48471 +
48472 +               pgd_m = pgd_offset(mm, address_m);
48473 +               pud_m = pud_alloc(mm, pgd_m, address_m);
48474 +               if (!pud_m)
48475 +                       return VM_FAULT_OOM;
48476 +               pmd_m = pmd_alloc(mm, pud_m, address_m);
48477 +               if (!pmd_m)
48478 +                       return VM_FAULT_OOM;
48479 +               if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
48480 +                       return VM_FAULT_OOM;
48481 +               pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
48482 +       }
48483 +#endif
48484 +
48485         pgd = pgd_offset(mm, address);
48486         pud = pud_alloc(mm, pgd, address);
48487         if (!pud)
48488 @@ -3123,7 +3387,7 @@ static int __init gate_vma_init(void)
48489         gate_vma.vm_start = FIXADDR_USER_START;
48490         gate_vma.vm_end = FIXADDR_USER_END;
48491         gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
48492 -       gate_vma.vm_page_prot = __P101;
48493 +       gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
48494         /*
48495          * Make sure the vDSO gets into every core dump.
48496          * Dumping its contents makes post-mortem fully interpretable later
48497 diff -urNp linux-2.6.33/mm/memory-failure.c linux-2.6.33/mm/memory-failure.c
48498 --- linux-2.6.33/mm/memory-failure.c    2010-02-24 13:52:17.000000000 -0500
48499 +++ linux-2.6.33/mm/memory-failure.c    2010-03-07 12:23:36.153640756 -0500
48500 @@ -50,7 +50,7 @@ int sysctl_memory_failure_early_kill __r
48501
48502  int sysctl_memory_failure_recovery __read_mostly = 1;
48503
48504 -atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
48505 +atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
48506
48507  #if defined(CONFIG_HWPOISON_INJECT) || defined(CONFIG_HWPOISON_INJECT_MODULE)
48508
48509 @@ -935,7 +935,7 @@ int __memory_failure(unsigned long pfn,
48510                 return 0;
48511         }
48512
48513 -       atomic_long_add(1, &mce_bad_pages);
48514 +       atomic_long_add_unchecked(1, &mce_bad_pages);
48515
48516         /*
48517          * We need/can do nothing about count=0 pages.
48518 diff -urNp linux-2.6.33/mm/mempolicy.c linux-2.6.33/mm/mempolicy.c
48519 --- linux-2.6.33/mm/mempolicy.c 2010-02-24 13:52:17.000000000 -0500
48520 +++ linux-2.6.33/mm/mempolicy.c 2010-03-07 12:23:36.157715101 -0500
48521 @@ -569,6 +569,10 @@ static int mbind_range(struct vm_area_st
48522         struct vm_area_struct *next;
48523         int err;
48524
48525 +#ifdef CONFIG_PAX_SEGMEXEC
48526 +       struct vm_area_struct *vma_m;
48527 +#endif
48528 +
48529         err = 0;
48530         for (; vma && vma->vm_start < end; vma = next) {
48531                 next = vma->vm_next;
48532 @@ -580,6 +584,16 @@ static int mbind_range(struct vm_area_st
48533                         err = policy_vma(vma, new);
48534                 if (err)
48535                         break;
48536 +
48537 +#ifdef CONFIG_PAX_SEGMEXEC
48538 +               vma_m = pax_find_mirror_vma(vma);
48539 +               if (vma_m) {
48540 +                       err = policy_vma(vma_m, new);
48541 +                       if (err)
48542 +                               break;
48543 +               }
48544 +#endif
48545 +
48546         }
48547         return err;
48548  }
48549 @@ -1000,6 +1014,17 @@ static long do_mbind(unsigned long start
48550
48551         if (end < start)
48552                 return -EINVAL;
48553 +
48554 +#ifdef CONFIG_PAX_SEGMEXEC
48555 +       if (mm->pax_flags & MF_PAX_SEGMEXEC) {
48556 +               if (end > SEGMEXEC_TASK_SIZE)
48557 +                       return -EINVAL;
48558 +       } else
48559 +#endif
48560 +
48561 +       if (end > TASK_SIZE)
48562 +               return -EINVAL;
48563 +
48564         if (end == start)
48565                 return 0;
48566
48567 @@ -1205,6 +1230,14 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
48568         if (!mm)
48569                 return -EINVAL;
48570
48571 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48572 +       if (mm != current->mm &&
48573 +           (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
48574 +               err = -EPERM;
48575 +               goto out;
48576 +       }
48577 +#endif
48578 +
48579         /*
48580          * Check if this process has the right to modify the specified
48581          * process. The right exists if the process has administrative
48582 @@ -1214,8 +1247,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pi
48583         rcu_read_lock();
48584         tcred = __task_cred(task);
48585         if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
48586 -           cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
48587 -           !capable(CAP_SYS_NICE)) {
48588 +           cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
48589                 rcu_read_unlock();
48590                 err = -EPERM;
48591                 goto out;
48592 @@ -2431,7 +2463,7 @@ int show_numa_map(struct seq_file *m, vo
48593
48594         if (file) {
48595                 seq_printf(m, " file=");
48596 -               seq_path(m, &file->f_path, "\n\t= ");
48597 +               seq_path(m, &file->f_path, "\n\t\\= ");
48598         } else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
48599                 seq_printf(m, " heap");
48600         } else if (vma->vm_start <= mm->start_stack &&
48601 diff -urNp linux-2.6.33/mm/migrate.c linux-2.6.33/mm/migrate.c
48602 --- linux-2.6.33/mm/migrate.c   2010-02-24 13:52:17.000000000 -0500
48603 +++ linux-2.6.33/mm/migrate.c   2010-03-07 12:23:36.157715101 -0500
48604 @@ -1059,6 +1059,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
48605         if (!mm)
48606                 return -EINVAL;
48607
48608 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
48609 +       if (mm != current->mm &&
48610 +           (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
48611 +               err = -EPERM;
48612 +               goto out;
48613 +       }
48614 +#endif
48615 +
48616         /*
48617          * Check if this process has the right to modify the specified
48618          * process. The right exists if the process has administrative
48619 @@ -1068,8 +1076,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid,
48620         rcu_read_lock();
48621         tcred = __task_cred(task);
48622         if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
48623 -           cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
48624 -           !capable(CAP_SYS_NICE)) {
48625 +           cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
48626                 rcu_read_unlock();
48627                 err = -EPERM;
48628                 goto out;
48629 diff -urNp linux-2.6.33/mm/mlock.c linux-2.6.33/mm/mlock.c
48630 --- linux-2.6.33/mm/mlock.c     2010-02-24 13:52:17.000000000 -0500
48631 +++ linux-2.6.33/mm/mlock.c     2010-03-07 12:23:36.157715101 -0500
48632 @@ -13,6 +13,7 @@
48633  #include <linux/pagemap.h>
48634  #include <linux/mempolicy.h>
48635  #include <linux/syscalls.h>
48636 +#include <linux/security.h>
48637  #include <linux/sched.h>
48638  #include <linux/module.h>
48639  #include <linux/rmap.h>
48640 @@ -432,6 +433,17 @@ static int do_mlock(unsigned long start,
48641                 return -EINVAL;
48642         if (end == start)
48643                 return 0;
48644 +
48645 +#ifdef CONFIG_PAX_SEGMEXEC
48646 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
48647 +               if (end > SEGMEXEC_TASK_SIZE)
48648 +                       return -EINVAL;
48649 +       } else
48650 +#endif
48651 +
48652 +       if (end > TASK_SIZE)
48653 +               return -EINVAL;
48654 +
48655         vma = find_vma_prev(current->mm, start, &prev);
48656         if (!vma || vma->vm_start > start)
48657                 return -ENOMEM;
48658 @@ -491,6 +503,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
48659         ret = -ENOMEM;
48660         if (!vx_vmlocked_avail(current->mm, current->mm->total_vm))
48661                 goto out;
48662 +       gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
48663         if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
48664             capable(CAP_IPC_LOCK))
48665                 ret = do_mlockall(flags);
48666 @@ -512,10 +525,10 @@ SYSCALL_DEFINE2(munlock, unsigned long,
48667  static int do_mlockall(int flags)
48668  {
48669         struct vm_area_struct * vma, * prev = NULL;
48670 -       unsigned int def_flags = 0;
48671 +       unsigned int def_flags = current->mm->def_flags & ~VM_LOCKED;
48672
48673         if (flags & MCL_FUTURE)
48674 -               def_flags = VM_LOCKED;
48675 +               def_flags |= VM_LOCKED;
48676         current->mm->def_flags = def_flags;
48677         if (flags == MCL_FUTURE)
48678                 goto out;
48679 @@ -523,6 +536,12 @@ static int do_mlockall(int flags)
48680         for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
48681                 unsigned int newflags;
48682
48683 +#ifdef CONFIG_PAX_SEGMEXEC
48684 +               if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
48685 +                       break;
48686 +#endif
48687 +
48688 +               BUG_ON(vma->vm_end > TASK_SIZE);
48689                 newflags = vma->vm_flags | VM_LOCKED;
48690                 if (!(flags & MCL_CURRENT))
48691                         newflags &= ~VM_LOCKED;
48692 @@ -554,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
48693         lock_limit >>= PAGE_SHIFT;
48694
48695         ret = -ENOMEM;
48696 +       gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm, 1);
48697         if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
48698             capable(CAP_IPC_LOCK))
48699                 ret = do_mlockall(flags);
48700 diff -urNp linux-2.6.33/mm/mmap.c linux-2.6.33/mm/mmap.c
48701 --- linux-2.6.33/mm/mmap.c      2010-02-24 13:52:17.000000000 -0500
48702 +++ linux-2.6.33/mm/mmap.c      2010-03-07 12:23:36.157715101 -0500
48703 @@ -44,6 +44,16 @@
48704  #define arch_rebalance_pgtables(addr, len)             (addr)
48705  #endif
48706
48707 +static inline void verify_mm_writelocked(struct mm_struct *mm)
48708 +{
48709 +#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
48710 +       if (unlikely(down_read_trylock(&mm->mmap_sem))) {
48711 +               up_read(&mm->mmap_sem);
48712 +               BUG();
48713 +       }
48714 +#endif
48715 +}
48716 +
48717  static void unmap_region(struct mm_struct *mm,
48718                 struct vm_area_struct *vma, struct vm_area_struct *prev,
48719                 unsigned long start, unsigned long end);
48720 @@ -69,16 +79,25 @@ static void unmap_region(struct mm_struc
48721   *             x: (no) no      x: (no) yes     x: (no) yes     x: (yes) yes
48722   *
48723   */
48724 -pgprot_t protection_map[16] = {
48725 +pgprot_t protection_map[16] __read_only = {
48726         __P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
48727         __S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
48728  };
48729
48730  pgprot_t vm_get_page_prot(unsigned long vm_flags)
48731  {
48732 -       return __pgprot(pgprot_val(protection_map[vm_flags &
48733 +       pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
48734                                 (VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
48735                         pgprot_val(arch_vm_get_page_prot(vm_flags)));
48736 +
48737 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
48738 +       if (!(__supported_pte_mask & _PAGE_NX) &&
48739 +           (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
48740 +           (vm_flags & (VM_READ | VM_WRITE)))
48741 +               prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
48742 +#endif
48743 +
48744 +       return prot;
48745  }
48746  EXPORT_SYMBOL(vm_get_page_prot);
48747
48748 @@ -230,6 +249,7 @@ static struct vm_area_struct *remove_vma
48749         struct vm_area_struct *next = vma->vm_next;
48750
48751         might_sleep();
48752 +       BUG_ON(vma->vm_mirror);
48753         if (vma->vm_ops && vma->vm_ops->close)
48754                 vma->vm_ops->close(vma);
48755         if (vma->vm_file) {
48756 @@ -266,6 +286,7 @@ SYSCALL_DEFINE1(brk, unsigned long, brk)
48757          * not page aligned -Ram Gupta
48758          */
48759         rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
48760 +       gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
48761         if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
48762                         (mm->end_data - mm->start_data) > rlim)
48763                 goto out;
48764 @@ -693,6 +714,12 @@ static int
48765  can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
48766         struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
48767  {
48768 +
48769 +#ifdef CONFIG_PAX_SEGMEXEC
48770 +       if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
48771 +               return 0;
48772 +#endif
48773 +
48774         if (is_mergeable_vma(vma, file, vm_flags) &&
48775             is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
48776                 if (vma->vm_pgoff == vm_pgoff)
48777 @@ -712,6 +739,12 @@ static int
48778  can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
48779         struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
48780  {
48781 +
48782 +#ifdef CONFIG_PAX_SEGMEXEC
48783 +       if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
48784 +               return 0;
48785 +#endif
48786 +
48787         if (is_mergeable_vma(vma, file, vm_flags) &&
48788             is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
48789                 pgoff_t vm_pglen;
48790 @@ -754,12 +787,19 @@ can_vma_merge_after(struct vm_area_struc
48791  struct vm_area_struct *vma_merge(struct mm_struct *mm,
48792                         struct vm_area_struct *prev, unsigned long addr,
48793                         unsigned long end, unsigned long vm_flags,
48794 -                       struct anon_vma *anon_vma, struct file *file,
48795 +                       struct anon_vma *anon_vma, struct file *file,
48796                         pgoff_t pgoff, struct mempolicy *policy)
48797  {
48798         pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
48799         struct vm_area_struct *area, *next;
48800
48801 +#ifdef CONFIG_PAX_SEGMEXEC
48802 +       unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
48803 +       struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
48804 +
48805 +       BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
48806 +#endif
48807 +
48808         /*
48809          * We later require that vma->vm_flags == vm_flags,
48810          * so this tests vma->vm_flags & VM_SPECIAL, too.
48811 @@ -775,6 +815,15 @@ struct vm_area_struct *vma_merge(struct
48812         if (next && next->vm_end == end)                /* cases 6, 7, 8 */
48813                 next = next->vm_next;
48814
48815 +#ifdef CONFIG_PAX_SEGMEXEC
48816 +       if (prev)
48817 +               prev_m = pax_find_mirror_vma(prev);
48818 +       if (area)
48819 +               area_m = pax_find_mirror_vma(area);
48820 +       if (next)
48821 +               next_m = pax_find_mirror_vma(next);
48822 +#endif
48823 +
48824         /*
48825          * Can it merge with the predecessor?
48826          */
48827 @@ -794,9 +843,24 @@ struct vm_area_struct *vma_merge(struct
48828                                                         /* cases 1, 6 */
48829                         vma_adjust(prev, prev->vm_start,
48830                                 next->vm_end, prev->vm_pgoff, NULL);
48831 -               } else                                  /* cases 2, 5, 7 */
48832 +
48833 +#ifdef CONFIG_PAX_SEGMEXEC
48834 +                       if (prev_m)
48835 +                               vma_adjust(prev_m, prev_m->vm_start,
48836 +                                       next_m->vm_end, prev_m->vm_pgoff, NULL);
48837 +#endif
48838 +
48839 +               } else {                                /* cases 2, 5, 7 */
48840                         vma_adjust(prev, prev->vm_start,
48841                                 end, prev->vm_pgoff, NULL);
48842 +
48843 +#ifdef CONFIG_PAX_SEGMEXEC
48844 +                       if (prev_m)
48845 +                               vma_adjust(prev_m, prev_m->vm_start,
48846 +                                       end_m, prev_m->vm_pgoff, NULL);
48847 +#endif
48848 +
48849 +               }
48850                 return prev;
48851         }
48852
48853 @@ -807,12 +871,27 @@ struct vm_area_struct *vma_merge(struct
48854                         mpol_equal(policy, vma_policy(next)) &&
48855                         can_vma_merge_before(next, vm_flags,
48856                                         anon_vma, file, pgoff+pglen)) {
48857 -               if (prev && addr < prev->vm_end)        /* case 4 */
48858 +               if (prev && addr < prev->vm_end) {      /* case 4 */
48859                         vma_adjust(prev, prev->vm_start,
48860                                 addr, prev->vm_pgoff, NULL);
48861 -               else                                    /* cases 3, 8 */
48862 +
48863 +#ifdef CONFIG_PAX_SEGMEXEC
48864 +                       if (prev_m)
48865 +                               vma_adjust(prev_m, prev_m->vm_start,
48866 +                                       addr_m, prev_m->vm_pgoff, NULL);
48867 +#endif
48868 +
48869 +               } else {                                /* cases 3, 8 */
48870                         vma_adjust(area, addr, next->vm_end,
48871                                 next->vm_pgoff - pglen, NULL);
48872 +
48873 +#ifdef CONFIG_PAX_SEGMEXEC
48874 +                       if (area_m)
48875 +                               vma_adjust(area_m, addr_m, next_m->vm_end,
48876 +                                       next_m->vm_pgoff - pglen, NULL);
48877 +#endif
48878 +
48879 +               }
48880                 return area;
48881         }
48882
48883 @@ -887,14 +966,11 @@ none:
48884  void vm_stat_account(struct mm_struct *mm, unsigned long flags,
48885                                                 struct file *file, long pages)
48886  {
48887 -       const unsigned long stack_flags
48888 -               = VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
48889 -
48890         if (file) {
48891                 mm->shared_vm += pages;
48892                 if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
48893                         mm->exec_vm += pages;
48894 -       } else if (flags & stack_flags)
48895 +       } else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
48896                 mm->stack_vm += pages;
48897         if (flags & (VM_RESERVED|VM_IO))
48898                 mm->reserved_vm += pages;
48899 @@ -921,7 +997,7 @@ unsigned long do_mmap_pgoff(struct file
48900          * (the exception is when the underlying filesystem is noexec
48901          *  mounted, in which case we dont add PROT_EXEC.)
48902          */
48903 -       if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
48904 +       if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
48905                 if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
48906                         prot |= PROT_EXEC;
48907
48908 @@ -947,7 +1023,7 @@ unsigned long do_mmap_pgoff(struct file
48909         /* Obtain the address to map to. we verify (or select) it and ensure
48910          * that it represents a valid section of the address space.
48911          */
48912 -       addr = get_unmapped_area(file, addr, len, pgoff, flags);
48913 +       addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
48914         if (addr & ~PAGE_MASK)
48915                 return addr;
48916
48917 @@ -958,6 +1034,26 @@ unsigned long do_mmap_pgoff(struct file
48918         vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
48919                         mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
48920
48921 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
48922 +       if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
48923 +
48924 +#ifdef CONFIG_PAX_MPROTECT
48925 +               if (mm->pax_flags & MF_PAX_MPROTECT) {
48926 +                       if ((prot & (PROT_WRITE | PROT_EXEC)) != PROT_EXEC)
48927 +                               vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
48928 +                       else
48929 +                               vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
48930 +               }
48931 +#endif
48932 +
48933 +       }
48934 +#endif
48935 +
48936 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
48937 +       if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
48938 +               vm_flags &= ~VM_PAGEEXEC;
48939 +#endif
48940 +
48941         if (flags & MAP_LOCKED)
48942                 if (!can_do_mlock())
48943                         return -EPERM;
48944 @@ -969,6 +1065,7 @@ unsigned long do_mmap_pgoff(struct file
48945                 locked += mm->locked_vm;
48946                 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
48947                 lock_limit >>= PAGE_SHIFT;
48948 +               gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
48949                 if (locked > lock_limit && !capable(CAP_IPC_LOCK))
48950                         return -EAGAIN;
48951         }
48952 @@ -1039,6 +1136,9 @@ unsigned long do_mmap_pgoff(struct file
48953         if (error)
48954                 return error;
48955
48956 +       if (!gr_acl_handle_mmap(file, prot))
48957 +               return -EACCES;
48958 +
48959         return mmap_region(file, addr, len, flags, vm_flags, pgoff);
48960  }
48961  EXPORT_SYMBOL(do_mmap_pgoff);
48962 @@ -1091,10 +1191,10 @@ out:
48963   */
48964  int vma_wants_writenotify(struct vm_area_struct *vma)
48965  {
48966 -       unsigned int vm_flags = vma->vm_flags;
48967 +       unsigned long vm_flags = vma->vm_flags;
48968
48969         /* If it was private or non-writable, the write bit is already clear */
48970 -       if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
48971 +       if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
48972                 return 0;
48973
48974         /* The backer wishes to know when pages are first written to? */
48975 @@ -1143,14 +1243,24 @@ unsigned long mmap_region(struct file *f
48976         unsigned long charged = 0;
48977         struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
48978
48979 +#ifdef CONFIG_PAX_SEGMEXEC
48980 +       struct vm_area_struct *vma_m = NULL;
48981 +#endif
48982 +
48983 +       /*
48984 +        * mm->mmap_sem is required to protect against another thread
48985 +        * changing the mappings in case we sleep.
48986 +        */
48987 +       verify_mm_writelocked(mm);
48988 +
48989         /* Clear old maps */
48990         error = -ENOMEM;
48991 -munmap_back:
48992         vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
48993         if (vma && vma->vm_start < addr + len) {
48994                 if (do_munmap(mm, addr, len))
48995                         return -ENOMEM;
48996 -               goto munmap_back;
48997 +               vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
48998 +               BUG_ON(vma && vma->vm_start < addr + len);
48999         }
49000
49001         /* Check against address space limit. */
49002 @@ -1199,6 +1309,16 @@ munmap_back:
49003                 goto unacct_error;
49004         }
49005
49006 +#ifdef CONFIG_PAX_SEGMEXEC
49007 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
49008 +               vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
49009 +               if (!vma_m) {
49010 +                       error = -ENOMEM;
49011 +                       goto free_vma;
49012 +               }
49013 +       }
49014 +#endif
49015 +
49016         vma->vm_mm = mm;
49017         vma->vm_start = addr;
49018         vma->vm_end = addr + len;
49019 @@ -1221,6 +1341,19 @@ munmap_back:
49020                 error = file->f_op->mmap(file, vma);
49021                 if (error)
49022                         goto unmap_and_free_vma;
49023 +
49024 +#ifdef CONFIG_PAX_SEGMEXEC
49025 +               if (vma_m && (vm_flags & VM_EXECUTABLE))
49026 +                       added_exe_file_vma(mm);
49027 +#endif
49028 +
49029 +#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
49030 +               if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
49031 +                       vma->vm_flags |= VM_PAGEEXEC;
49032 +                       vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
49033 +               }
49034 +#endif
49035 +
49036                 if (vm_flags & VM_EXECUTABLE)
49037                         added_exe_file_vma(mm);
49038
49039 @@ -1256,6 +1389,11 @@ munmap_back:
49040         vma_link(mm, vma, prev, rb_link, rb_parent);
49041         file = vma->vm_file;
49042
49043 +#ifdef CONFIG_PAX_SEGMEXEC
49044 +       if (vma_m)
49045 +               pax_mirror_vma(vma_m, vma);
49046 +#endif
49047 +
49048         /* Once vma denies write, undo our temporary denial count */
49049         if (correct_wcount)
49050                 atomic_inc(&inode->i_writecount);
49051 @@ -1264,6 +1402,7 @@ out:
49052
49053         mm->total_vm += len >> PAGE_SHIFT;
49054         vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
49055 +       track_exec_limit(mm, addr, addr + len, vm_flags);
49056         if (vm_flags & VM_LOCKED) {
49057                 /*
49058                  * makes pages present; downgrades, drops, reacquires mmap_sem
49059 @@ -1286,6 +1425,12 @@ unmap_and_free_vma:
49060         unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
49061         charged = 0;
49062  free_vma:
49063 +
49064 +#ifdef CONFIG_PAX_SEGMEXEC
49065 +       if (vma_m)
49066 +               kmem_cache_free(vm_area_cachep, vma_m);
49067 +#endif
49068 +
49069         kmem_cache_free(vm_area_cachep, vma);
49070  unacct_error:
49071         if (charged)
49072 @@ -1319,6 +1464,10 @@ arch_get_unmapped_area(struct file *filp
49073         if (flags & MAP_FIXED)
49074                 return addr;
49075
49076 +#ifdef CONFIG_PAX_RANDMMAP
49077 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
49078 +#endif
49079 +
49080         if (addr) {
49081                 addr = PAGE_ALIGN(addr);
49082                 vma = find_vma(mm, addr);
49083 @@ -1327,10 +1476,10 @@ arch_get_unmapped_area(struct file *filp
49084                         return addr;
49085         }
49086         if (len > mm->cached_hole_size) {
49087 -               start_addr = addr = mm->free_area_cache;
49088 +               start_addr = addr = mm->free_area_cache;
49089         } else {
49090 -               start_addr = addr = TASK_UNMAPPED_BASE;
49091 -               mm->cached_hole_size = 0;
49092 +               start_addr = addr = mm->mmap_base;
49093 +               mm->cached_hole_size = 0;
49094         }
49095
49096  full_search:
49097 @@ -1341,9 +1490,8 @@ full_search:
49098                          * Start a new search - just in case we missed
49099                          * some holes.
49100                          */
49101 -                       if (start_addr != TASK_UNMAPPED_BASE) {
49102 -                               addr = TASK_UNMAPPED_BASE;
49103 -                               start_addr = addr;
49104 +                       if (start_addr != mm->mmap_base) {
49105 +                               start_addr = addr = mm->mmap_base;
49106                                 mm->cached_hole_size = 0;
49107                                 goto full_search;
49108                         }
49109 @@ -1365,10 +1513,16 @@ full_search:
49110
49111  void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
49112  {
49113 +
49114 +#ifdef CONFIG_PAX_SEGMEXEC
49115 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
49116 +               return;
49117 +#endif
49118 +
49119         /*
49120          * Is this a new hole at the lowest possible address?
49121          */
49122 -       if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
49123 +       if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
49124                 mm->free_area_cache = addr;
49125                 mm->cached_hole_size = ~0UL;
49126         }
49127 @@ -1386,7 +1540,7 @@ arch_get_unmapped_area_topdown(struct fi
49128  {
49129         struct vm_area_struct *vma;
49130         struct mm_struct *mm = current->mm;
49131 -       unsigned long addr = addr0;
49132 +       unsigned long base = mm->mmap_base, addr = addr0;
49133
49134         /* requested length too big for entire address space */
49135         if (len > TASK_SIZE)
49136 @@ -1395,6 +1549,10 @@ arch_get_unmapped_area_topdown(struct fi
49137         if (flags & MAP_FIXED)
49138                 return addr;
49139
49140 +#ifdef CONFIG_PAX_RANDMMAP
49141 +       if (!(mm->pax_flags & MF_PAX_RANDMMAP))
49142 +#endif
49143 +
49144         /* requesting a specific address */
49145         if (addr) {
49146                 addr = PAGE_ALIGN(addr);
49147 @@ -1452,13 +1610,21 @@ bottomup:
49148          * can happen with large stack limits and large mmap()
49149          * allocations.
49150          */
49151 +       mm->mmap_base = TASK_UNMAPPED_BASE;
49152 +
49153 +#ifdef CONFIG_PAX_RANDMMAP
49154 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
49155 +               mm->mmap_base += mm->delta_mmap;
49156 +#endif
49157 +
49158 +       mm->free_area_cache = mm->mmap_base;
49159         mm->cached_hole_size = ~0UL;
49160 -       mm->free_area_cache = TASK_UNMAPPED_BASE;
49161         addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
49162         /*
49163          * Restore the topdown base:
49164          */
49165 -       mm->free_area_cache = mm->mmap_base;
49166 +       mm->mmap_base = base;
49167 +       mm->free_area_cache = base;
49168         mm->cached_hole_size = ~0UL;
49169
49170         return addr;
49171 @@ -1467,6 +1633,12 @@ bottomup:
49172
49173  void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
49174  {
49175 +
49176 +#ifdef CONFIG_PAX_SEGMEXEC
49177 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
49178 +               return;
49179 +#endif
49180 +
49181         /*
49182          * Is this a new hole at the highest possible address?
49183          */
49184 @@ -1474,8 +1646,10 @@ void arch_unmap_area_topdown(struct mm_s
49185                 mm->free_area_cache = addr;
49186
49187         /* dont allow allocations above current base */
49188 -       if (mm->free_area_cache > mm->mmap_base)
49189 +       if (mm->free_area_cache > mm->mmap_base) {
49190                 mm->free_area_cache = mm->mmap_base;
49191 +               mm->cached_hole_size = ~0UL;
49192 +       }
49193  }
49194
49195  unsigned long
49196 @@ -1583,6 +1757,27 @@ out:
49197         return prev ? prev->vm_next : vma;
49198  }
49199
49200 +#ifdef CONFIG_PAX_SEGMEXEC
49201 +struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
49202 +{
49203 +       struct vm_area_struct *vma_m;
49204 +
49205 +       BUG_ON(!vma || vma->vm_start >= vma->vm_end);
49206 +       if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
49207 +               BUG_ON(vma->vm_mirror);
49208 +               return NULL;
49209 +       }
49210 +       BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
49211 +       vma_m = vma->vm_mirror;
49212 +       BUG_ON(!vma_m || vma_m->vm_mirror != vma);
49213 +       BUG_ON(vma->vm_file != vma_m->vm_file);
49214 +       BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
49215 +       BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
49216 +       BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED));
49217 +       return vma_m;
49218 +}
49219 +#endif
49220 +
49221  /*
49222   * Verify that the stack growth is acceptable and
49223   * update accounting. This is shared with both the
49224 @@ -1599,6 +1794,7 @@ static int acct_stack_growth(struct vm_a
49225                 return -ENOMEM;
49226
49227         /* Stack limit test */
49228 +       gr_learn_resource(current, RLIMIT_STACK, size, 1);
49229         if (size > rlim[RLIMIT_STACK].rlim_cur)
49230                 return -ENOMEM;
49231
49232 @@ -1608,6 +1804,7 @@ static int acct_stack_growth(struct vm_a
49233                 unsigned long limit;
49234                 locked = mm->locked_vm + grow;
49235                 limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
49236 +               gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
49237                 if (locked > limit && !capable(CAP_IPC_LOCK))
49238                         return -ENOMEM;
49239         }
49240 @@ -1643,35 +1840,40 @@ static
49241  #endif
49242  int expand_upwards(struct vm_area_struct *vma, unsigned long address)
49243  {
49244 -       int error;
49245 +       int error, locknext;
49246
49247         if (!(vma->vm_flags & VM_GROWSUP))
49248                 return -EFAULT;
49249
49250 +       /* Also guard against wrapping around to address 0. */
49251 +       if (address < PAGE_ALIGN(address+1))
49252 +               address = PAGE_ALIGN(address+1);
49253 +       else
49254 +               return -ENOMEM;
49255 +
49256         /*
49257          * We must make sure the anon_vma is allocated
49258          * so that the anon_vma locking is not a noop.
49259          */
49260         if (unlikely(anon_vma_prepare(vma)))
49261                 return -ENOMEM;
49262 +       locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
49263 +       if (locknext && unlikely(anon_vma_prepare(vma->vm_next)))
49264 +               return -ENOMEM;
49265         anon_vma_lock(vma);
49266 +       if (locknext)
49267 +               anon_vma_lock(vma->vm_next);
49268
49269         /*
49270          * vma->vm_start/vm_end cannot change under us because the caller
49271          * is required to hold the mmap_sem in read mode.  We need the
49272 -        * anon_vma lock to serialize against concurrent expand_stacks.
49273 -        * Also guard against wrapping around to address 0.
49274 +        * anon_vma locks to serialize against concurrent expand_stacks
49275 +        * and expand_upwards.
49276          */
49277 -       if (address < PAGE_ALIGN(address+4))
49278 -               address = PAGE_ALIGN(address+4);
49279 -       else {
49280 -               anon_vma_unlock(vma);
49281 -               return -ENOMEM;
49282 -       }
49283         error = 0;
49284
49285         /* Somebody else might have raced and expanded it already */
49286 -       if (address > vma->vm_end) {
49287 +       if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
49288                 unsigned long size, grow;
49289
49290                 size = address - vma->vm_start;
49291 @@ -1681,6 +1883,8 @@ int expand_upwards(struct vm_area_struct
49292                 if (!error)
49293                         vma->vm_end = address;
49294         }
49295 +       if (locknext)
49296 +               anon_vma_unlock(vma->vm_next);
49297         anon_vma_unlock(vma);
49298         return error;
49299  }
49300 @@ -1692,7 +1896,8 @@ int expand_upwards(struct vm_area_struct
49301  static int expand_downwards(struct vm_area_struct *vma,
49302                                    unsigned long address)
49303  {
49304 -       int error;
49305 +       int error, lockprev = 0;
49306 +       struct vm_area_struct *prev = NULL;
49307
49308         /*
49309          * We must make sure the anon_vma is allocated
49310 @@ -1706,6 +1911,15 @@ static int expand_downwards(struct vm_ar
49311         if (error)
49312                 return error;
49313
49314 +#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
49315 +       find_vma_prev(vma->vm_mm, address, &prev);
49316 +       lockprev = prev && (prev->vm_flags & VM_GROWSUP);
49317 +#endif
49318 +       if (lockprev && unlikely(anon_vma_prepare(prev)))
49319 +               return -ENOMEM;
49320 +       if (lockprev)
49321 +               anon_vma_lock(prev);
49322 +
49323         anon_vma_lock(vma);
49324
49325         /*
49326 @@ -1715,9 +1929,15 @@ static int expand_downwards(struct vm_ar
49327          */
49328
49329         /* Somebody else might have raced and expanded it already */
49330 -       if (address < vma->vm_start) {
49331 +       if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
49332                 unsigned long size, grow;
49333
49334 +#ifdef CONFIG_PAX_SEGMEXEC
49335 +               struct vm_area_struct *vma_m;
49336 +
49337 +               vma_m = pax_find_mirror_vma(vma);
49338 +#endif
49339 +
49340                 size = vma->vm_end - address;
49341                 grow = (vma->vm_start - address) >> PAGE_SHIFT;
49342
49343 @@ -1725,9 +1945,20 @@ static int expand_downwards(struct vm_ar
49344                 if (!error) {
49345                         vma->vm_start = address;
49346                         vma->vm_pgoff -= grow;
49347 +                       track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
49348 +
49349 +#ifdef CONFIG_PAX_SEGMEXEC
49350 +                       if (vma_m) {
49351 +                               vma_m->vm_start -= grow << PAGE_SHIFT;
49352 +                               vma_m->vm_pgoff -= grow;
49353 +                       }
49354 +#endif
49355 +
49356                 }
49357         }
49358         anon_vma_unlock(vma);
49359 +       if (lockprev)
49360 +               anon_vma_unlock(prev);
49361         return error;
49362  }
49363
49364 @@ -1803,6 +2034,13 @@ static void remove_vma_list(struct mm_st
49365         do {
49366                 long nrpages = vma_pages(vma);
49367
49368 +#ifdef CONFIG_PAX_SEGMEXEC
49369 +               if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
49370 +                       vma = remove_vma(vma);
49371 +                       continue;
49372 +               }
49373 +#endif
49374 +
49375                 mm->total_vm -= nrpages;
49376                 vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
49377                 vma = remove_vma(vma);
49378 @@ -1847,6 +2085,16 @@ detach_vmas_to_be_unmapped(struct mm_str
49379
49380         insertion_point = (prev ? &prev->vm_next : &mm->mmap);
49381         do {
49382 +
49383 +#ifdef CONFIG_PAX_SEGMEXEC
49384 +               if (vma->vm_mirror) {
49385 +                       BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
49386 +                       vma->vm_mirror->vm_mirror = NULL;
49387 +                       vma->vm_mirror->vm_flags &= ~VM_EXEC;
49388 +                       vma->vm_mirror = NULL;
49389 +               }
49390 +#endif
49391 +
49392                 rb_erase(&vma->vm_rb, &mm->mm_rb);
49393                 mm->map_count--;
49394                 tail_vma = vma;
49395 @@ -1872,14 +2120,33 @@ static int __split_vma(struct mm_struct
49396         struct mempolicy *pol;
49397         struct vm_area_struct *new;
49398
49399 +#ifdef CONFIG_PAX_SEGMEXEC
49400 +       struct vm_area_struct *vma_m, *new_m = NULL;
49401 +       unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
49402 +#endif
49403 +
49404         if (is_vm_hugetlb_page(vma) && (addr &
49405                                         ~(huge_page_mask(hstate_vma(vma)))))
49406                 return -EINVAL;
49407
49408 +#ifdef CONFIG_PAX_SEGMEXEC
49409 +       vma_m = pax_find_mirror_vma(vma);
49410 +#endif
49411 +
49412         new = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
49413         if (!new)
49414                 return -ENOMEM;
49415
49416 +#ifdef CONFIG_PAX_SEGMEXEC
49417 +       if (vma_m) {
49418 +               new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
49419 +               if (!new_m) {
49420 +                       kmem_cache_free(vm_area_cachep, new);
49421 +                       return -ENOMEM;
49422 +               }
49423 +       }
49424 +#endif
49425 +
49426         /* most fields are the same, copy all, and then fixup */
49427         *new = *vma;
49428
49429 @@ -1890,8 +2157,29 @@ static int __split_vma(struct mm_struct
49430                 new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
49431         }
49432
49433 +#ifdef CONFIG_PAX_SEGMEXEC
49434 +       if (vma_m) {
49435 +               *new_m = *vma_m;
49436 +               new_m->vm_mirror = new;
49437 +               new->vm_mirror = new_m;
49438 +
49439 +               if (new_below)
49440 +                       new_m->vm_end = addr_m;
49441 +               else {
49442 +                       new_m->vm_start = addr_m;
49443 +                       new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
49444 +               }
49445 +       }
49446 +#endif
49447 +
49448         pol = mpol_dup(vma_policy(vma));
49449         if (IS_ERR(pol)) {
49450 +
49451 +#ifdef CONFIG_PAX_SEGMEXEC
49452 +               if (new_m)
49453 +                       kmem_cache_free(vm_area_cachep, new_m);
49454 +#endif
49455 +
49456                 kmem_cache_free(vm_area_cachep, new);
49457                 return PTR_ERR(pol);
49458         }
49459 @@ -1912,6 +2200,28 @@ static int __split_vma(struct mm_struct
49460         else
49461                 vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
49462
49463 +#ifdef CONFIG_PAX_SEGMEXEC
49464 +       if (vma_m) {
49465 +               mpol_get(pol);
49466 +               vma_set_policy(new_m, pol);
49467 +
49468 +               if (new_m->vm_file) {
49469 +                       get_file(new_m->vm_file);
49470 +                       if (vma_m->vm_flags & VM_EXECUTABLE)
49471 +                               added_exe_file_vma(mm);
49472 +               }
49473 +
49474 +               if (new_m->vm_ops && new_m->vm_ops->open)
49475 +                       new_m->vm_ops->open(new_m);
49476 +
49477 +               if (new_below)
49478 +                       vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
49479 +                               ((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
49480 +               else
49481 +                       vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
49482 +       }
49483 +#endif
49484 +
49485         return 0;
49486  }
49487
49488 @@ -1922,6 +2232,15 @@ static int __split_vma(struct mm_struct
49489  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
49490               unsigned long addr, int new_below)
49491  {
49492 +
49493 +#ifdef CONFIG_PAX_SEGMEXEC
49494 +       if (mm->pax_flags & MF_PAX_SEGMEXEC) {
49495 +               BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
49496 +               if (mm->map_count >= sysctl_max_map_count-1)
49497 +                       return -ENOMEM;
49498 +       } else
49499 +#endif
49500 +
49501         if (mm->map_count >= sysctl_max_map_count)
49502                 return -ENOMEM;
49503
49504 @@ -1933,11 +2252,30 @@ int split_vma(struct mm_struct *mm, stru
49505   * work.  This now handles partial unmappings.
49506   * Jeremy Fitzhardinge <jeremy@goop.org>
49507   */
49508 +#ifdef CONFIG_PAX_SEGMEXEC
49509  int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
49510  {
49511 +       int ret = __do_munmap(mm, start, len);
49512 +       if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
49513 +               return ret;
49514 +
49515 +       return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
49516 +}
49517 +
49518 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
49519 +#else
49520 +int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
49521 +#endif
49522 +{
49523         unsigned long end;
49524         struct vm_area_struct *vma, *prev, *last;
49525
49526 +       /*
49527 +        * mm->mmap_sem is required to protect against another thread
49528 +        * changing the mappings in case we sleep.
49529 +        */
49530 +       verify_mm_writelocked(mm);
49531 +
49532         if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
49533                 return -EINVAL;
49534
49535 @@ -2011,6 +2349,8 @@ int do_munmap(struct mm_struct *mm, unsi
49536         /* Fix up all other VM information */
49537         remove_vma_list(mm, vma);
49538
49539 +       track_exec_limit(mm, start, end, 0UL);
49540 +
49541         return 0;
49542  }
49543
49544 @@ -2023,22 +2363,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
49545
49546         profile_munmap(addr);
49547
49548 +#ifdef CONFIG_PAX_SEGMEXEC
49549 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
49550 +           (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
49551 +               return -EINVAL;
49552 +#endif
49553 +
49554         down_write(&mm->mmap_sem);
49555         ret = do_munmap(mm, addr, len);
49556         up_write(&mm->mmap_sem);
49557         return ret;
49558  }
49559
49560 -static inline void verify_mm_writelocked(struct mm_struct *mm)
49561 -{
49562 -#ifdef CONFIG_DEBUG_VM
49563 -       if (unlikely(down_read_trylock(&mm->mmap_sem))) {
49564 -               WARN_ON(1);
49565 -               up_read(&mm->mmap_sem);
49566 -       }
49567 -#endif
49568 -}
49569 -
49570  /*
49571   *  this is really a simplified "do_mmap".  it only handles
49572   *  anonymous maps.  eventually we may be able to do some
49573 @@ -2052,6 +2388,11 @@ unsigned long do_brk(unsigned long addr,
49574         struct rb_node ** rb_link, * rb_parent;
49575         pgoff_t pgoff = addr >> PAGE_SHIFT;
49576         int error;
49577 +       unsigned long charged;
49578 +
49579 +#ifdef CONFIG_PAX_SEGMEXEC
49580 +       struct vm_area_struct *vma_m = NULL;
49581 +#endif
49582
49583         len = PAGE_ALIGN(len);
49584         if (!len)
49585 @@ -2063,16 +2404,30 @@ unsigned long do_brk(unsigned long addr,
49586
49587         flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
49588
49589 +#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
49590 +       if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
49591 +               flags &= ~VM_EXEC;
49592 +
49593 +#ifdef CONFIG_PAX_MPROTECT
49594 +               if (mm->pax_flags & MF_PAX_MPROTECT)
49595 +                       flags &= ~VM_MAYEXEC;
49596 +#endif
49597 +
49598 +       }
49599 +#endif
49600 +
49601         error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
49602         if (error & ~PAGE_MASK)
49603                 return error;
49604
49605 +       charged = len >> PAGE_SHIFT;
49606 +
49607         /*
49608          * mlock MCL_FUTURE?
49609          */
49610         if (mm->def_flags & VM_LOCKED) {
49611                 unsigned long locked, lock_limit;
49612 -               locked = len >> PAGE_SHIFT;
49613 +               locked = charged;
49614                 locked += mm->locked_vm;
49615                 lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
49616                 lock_limit >>= PAGE_SHIFT;
49617 @@ -2089,22 +2444,22 @@ unsigned long do_brk(unsigned long addr,
49618         /*
49619          * Clear old maps.  this also does some error checking for us
49620          */
49621 - munmap_back:
49622         vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
49623         if (vma && vma->vm_start < addr + len) {
49624                 if (do_munmap(mm, addr, len))
49625                         return -ENOMEM;
49626 -               goto munmap_back;
49627 +               vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
49628 +               BUG_ON(vma && vma->vm_start < addr + len);
49629         }
49630
49631         /* Check against address space limits *after* clearing old maps... */
49632 -       if (!may_expand_vm(mm, len >> PAGE_SHIFT))
49633 +       if (!may_expand_vm(mm, charged))
49634                 return -ENOMEM;
49635
49636         if (mm->map_count > sysctl_max_map_count)
49637                 return -ENOMEM;
49638
49639 -       if (security_vm_enough_memory(len >> PAGE_SHIFT))
49640 +       if (security_vm_enough_memory(charged))
49641                 return -ENOMEM;
49642
49643         /* Can we just expand an old private anonymous mapping? */
49644 @@ -2118,10 +2473,21 @@ unsigned long do_brk(unsigned long addr,
49645          */
49646         vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
49647         if (!vma) {
49648 -               vm_unacct_memory(len >> PAGE_SHIFT);
49649 +               vm_unacct_memory(charged);
49650                 return -ENOMEM;
49651         }
49652
49653 +#ifdef CONFIG_PAX_SEGMEXEC
49654 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (flags & VM_EXEC)) {
49655 +               vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
49656 +               if (!vma_m) {
49657 +                       kmem_cache_free(vm_area_cachep, vma);
49658 +                       vm_unacct_memory(charged);
49659 +                       return -ENOMEM;
49660 +               }
49661 +       }
49662 +#endif
49663 +
49664         vma->vm_mm = mm;
49665         vma->vm_start = addr;
49666         vma->vm_end = addr + len;
49667 @@ -2130,11 +2496,12 @@ unsigned long do_brk(unsigned long addr,
49668         vma->vm_page_prot = vm_get_page_prot(flags);
49669         vma_link(mm, vma, prev, rb_link, rb_parent);
49670  out:
49671 -       mm->total_vm += len >> PAGE_SHIFT;
49672 +       mm->total_vm += charged;
49673         if (flags & VM_LOCKED) {
49674                 if (!mlock_vma_pages_range(vma, addr, addr + len))
49675 -                       mm->locked_vm += (len >> PAGE_SHIFT);
49676 +                       mm->locked_vm += charged;
49677         }
49678 +       track_exec_limit(mm, addr, addr + len, flags);
49679         return addr;
49680  }
49681
49682 @@ -2181,8 +2548,10 @@ void exit_mmap(struct mm_struct *mm)
49683          * Walk the list again, actually closing and freeing it,
49684          * with preemption enabled, without holding any MM locks.
49685          */
49686 -       while (vma)
49687 +       while (vma) {
49688 +               vma->vm_mirror = NULL;
49689                 vma = remove_vma(vma);
49690 +       }
49691
49692         BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
49693  }
49694 @@ -2196,6 +2565,10 @@ int insert_vm_struct(struct mm_struct *
49695         struct vm_area_struct * __vma, * prev;
49696         struct rb_node ** rb_link, * rb_parent;
49697
49698 +#ifdef CONFIG_PAX_SEGMEXEC
49699 +       struct vm_area_struct *vma_m = NULL;
49700 +#endif
49701 +
49702         /*
49703          * The vm_pgoff of a purely anonymous vma should be irrelevant
49704          * until its first write fault, when page's anon_vma and index
49705 @@ -2218,7 +2591,22 @@ int insert_vm_struct(struct mm_struct *
49706         if ((vma->vm_flags & VM_ACCOUNT) &&
49707              security_vm_enough_memory_mm(mm, vma_pages(vma)))
49708                 return -ENOMEM;
49709 +
49710 +#ifdef CONFIG_PAX_SEGMEXEC
49711 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
49712 +               vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
49713 +               if (!vma_m)
49714 +                       return -ENOMEM;
49715 +       }
49716 +#endif
49717 +
49718         vma_link(mm, vma, prev, rb_link, rb_parent);
49719 +
49720 +#ifdef CONFIG_PAX_SEGMEXEC
49721 +       if (vma_m)
49722 +               pax_mirror_vma(vma_m, vma);
49723 +#endif
49724 +
49725         return 0;
49726  }
49727
49728 @@ -2236,6 +2624,8 @@ struct vm_area_struct *copy_vma(struct v
49729         struct rb_node **rb_link, *rb_parent;
49730         struct mempolicy *pol;
49731
49732 +       BUG_ON(vma->vm_mirror);
49733 +
49734         /*
49735          * If anonymous vma has not yet been faulted, update new pgoff
49736          * to match new location, to increase its chance of merging.
49737 @@ -2279,6 +2669,35 @@ struct vm_area_struct *copy_vma(struct v
49738         return new_vma;
49739  }
49740
49741 +#ifdef CONFIG_PAX_SEGMEXEC
49742 +void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
49743 +{
49744 +       struct vm_area_struct *prev_m;
49745 +       struct rb_node **rb_link_m, *rb_parent_m;
49746 +       struct mempolicy *pol_m;
49747 +
49748 +       BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
49749 +       BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
49750 +       BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
49751 +       *vma_m = *vma;
49752 +       pol_m = vma_policy(vma_m);
49753 +       mpol_get(pol_m);
49754 +       vma_set_policy(vma_m, pol_m);
49755 +       vma_m->vm_start += SEGMEXEC_TASK_SIZE;
49756 +       vma_m->vm_end += SEGMEXEC_TASK_SIZE;
49757 +       vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
49758 +       vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
49759 +       if (vma_m->vm_file)
49760 +               get_file(vma_m->vm_file);
49761 +       if (vma_m->vm_ops && vma_m->vm_ops->open)
49762 +               vma_m->vm_ops->open(vma_m);
49763 +       find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
49764 +       vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
49765 +       vma_m->vm_mirror = vma;
49766 +       vma->vm_mirror = vma_m;
49767 +}
49768 +#endif
49769 +
49770  /*
49771   * Return true if the calling process may expand its vm space by the passed
49772   * number of pages
49773 @@ -2289,7 +2708,7 @@ int may_expand_vm(struct mm_struct *mm,
49774         unsigned long lim;
49775
49776         lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
49777 -
49778 +       gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
49779         if (cur + npages > lim)
49780                 return 0;
49781         return 1;
49782 @@ -2358,6 +2777,15 @@ int install_special_mapping(struct mm_st
49783         vma->vm_start = addr;
49784         vma->vm_end = addr + len;
49785
49786 +#ifdef CONFIG_PAX_MPROTECT
49787 +       if (mm->pax_flags & MF_PAX_MPROTECT) {
49788 +               if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
49789 +                       vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
49790 +               else
49791 +                       vm_flags &= ~(VM_WRITE | VM_MAYWRITE);
49792 +       }
49793 +#endif
49794 +
49795         vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
49796         vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
49797
49798 diff -urNp linux-2.6.33/mm/mprotect.c linux-2.6.33/mm/mprotect.c
49799 --- linux-2.6.33/mm/mprotect.c  2010-02-24 13:52:17.000000000 -0500
49800 +++ linux-2.6.33/mm/mprotect.c  2010-03-07 12:23:36.161647154 -0500
49801 @@ -24,10 +24,16 @@
49802  #include <linux/mmu_notifier.h>
49803  #include <linux/migrate.h>
49804  #include <linux/perf_event.h>
49805 +
49806 +#ifdef CONFIG_PAX_MPROTECT
49807 +#include <linux/elf.h>
49808 +#endif
49809 +
49810  #include <asm/uaccess.h>
49811  #include <asm/pgtable.h>
49812  #include <asm/cacheflush.h>
49813  #include <asm/tlbflush.h>
49814 +#include <asm/mmu_context.h>
49815
49816  #ifndef pgprot_modify
49817  static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
49818 @@ -132,6 +138,48 @@ static void change_protection(struct vm_
49819         flush_tlb_range(vma, start, end);
49820  }
49821
49822 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
49823 +/* called while holding the mmap semaphor for writing except stack expansion */
49824 +void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
49825 +{
49826 +       unsigned long oldlimit, newlimit = 0UL;
49827 +
49828 +       if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || (__supported_pte_mask & _PAGE_NX))
49829 +               return;
49830 +
49831 +       spin_lock(&mm->page_table_lock);
49832 +       oldlimit = mm->context.user_cs_limit;
49833 +       if ((prot & VM_EXEC) && oldlimit < end)
49834 +               /* USER_CS limit moved up */
49835 +               newlimit = end;
49836 +       else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
49837 +               /* USER_CS limit moved down */
49838 +               newlimit = start;
49839 +
49840 +       if (newlimit) {
49841 +               mm->context.user_cs_limit = newlimit;
49842 +
49843 +#ifdef CONFIG_SMP
49844 +               wmb();
49845 +               cpus_clear(mm->context.cpu_user_cs_mask);
49846 +               cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
49847 +#endif
49848 +
49849 +               set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
49850 +       }
49851 +       spin_unlock(&mm->page_table_lock);
49852 +       if (newlimit == end) {
49853 +               struct vm_area_struct *vma = find_vma(mm, oldlimit);
49854 +
49855 +               for (; vma && vma->vm_start < end; vma = vma->vm_next)
49856 +                       if (is_vm_hugetlb_page(vma))
49857 +                               hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
49858 +                       else
49859 +                               change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
49860 +       }
49861 +}
49862 +#endif
49863 +
49864  int
49865  mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
49866         unsigned long start, unsigned long end, unsigned long newflags)
49867 @@ -144,6 +192,14 @@ mprotect_fixup(struct vm_area_struct *vm
49868         int error;
49869         int dirty_accountable = 0;
49870
49871 +#ifdef CONFIG_PAX_SEGMEXEC
49872 +       struct vm_area_struct *vma_m = NULL;
49873 +       unsigned long start_m, end_m;
49874 +
49875 +       start_m = start + SEGMEXEC_TASK_SIZE;
49876 +       end_m = end + SEGMEXEC_TASK_SIZE;
49877 +#endif
49878 +
49879         if (newflags == oldflags) {
49880                 *pprev = vma;
49881                 return 0;
49882 @@ -165,6 +221,38 @@ mprotect_fixup(struct vm_area_struct *vm
49883                 }
49884         }
49885
49886 +#ifdef CONFIG_PAX_SEGMEXEC
49887 +       if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
49888 +               if (start != vma->vm_start) {
49889 +                       error = split_vma(mm, vma, start, 1);
49890 +                       if (error)
49891 +                               goto fail;
49892 +                       BUG_ON(!*pprev || (*pprev)->vm_next == vma);
49893 +                       *pprev = (*pprev)->vm_next;
49894 +               }
49895 +
49896 +               if (end != vma->vm_end) {
49897 +                       error = split_vma(mm, vma, end, 0);
49898 +                       if (error)
49899 +                               goto fail;
49900 +               }
49901 +
49902 +               if (pax_find_mirror_vma(vma)) {
49903 +                       error = __do_munmap(mm, start_m, end_m - start_m);
49904 +                       if (error)
49905 +                               goto fail;
49906 +               } else {
49907 +                       vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
49908 +                       if (!vma_m) {
49909 +                               error = -ENOMEM;
49910 +                               goto fail;
49911 +                       }
49912 +                       vma->vm_flags = newflags;
49913 +                       pax_mirror_vma(vma_m, vma);
49914 +               }
49915 +       }
49916 +#endif
49917 +
49918         /*
49919          * First try to merge with previous and/or next vma.
49920          */
49921 @@ -196,8 +284,14 @@ success:
49922          * held in write mode.
49923          */
49924         vma->vm_flags = newflags;
49925 +
49926 +#ifdef CONFIG_PAX_MPROTECT
49927 +       if (mm->binfmt && mm->binfmt->handle_mprotect)
49928 +               mm->binfmt->handle_mprotect(vma, newflags);
49929 +#endif
49930 +
49931         vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
49932 -                                         vm_get_page_prot(newflags));
49933 +                                         vm_get_page_prot(vma->vm_flags));
49934
49935         if (vma_wants_writenotify(vma)) {
49936                 vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
49937 @@ -238,6 +332,17 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
49938         end = start + len;
49939         if (end <= start)
49940                 return -ENOMEM;
49941 +
49942 +#ifdef CONFIG_PAX_SEGMEXEC
49943 +       if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
49944 +               if (end > SEGMEXEC_TASK_SIZE)
49945 +                       return -EINVAL;
49946 +       } else
49947 +#endif
49948 +
49949 +       if (end > TASK_SIZE)
49950 +               return -EINVAL;
49951 +
49952         if (!arch_validate_prot(prot))
49953                 return -EINVAL;
49954
49955 @@ -245,7 +350,7 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
49956         /*
49957          * Does the application expect PROT_READ to imply PROT_EXEC:
49958          */
49959 -       if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
49960 +       if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
49961                 prot |= PROT_EXEC;
49962
49963         vm_flags = calc_vm_prot_bits(prot);
49964 @@ -277,6 +382,16 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
49965         if (start > vma->vm_start)
49966                 prev = vma;
49967
49968 +       if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
49969 +               error = -EACCES;
49970 +               goto out;
49971 +       }
49972 +
49973 +#ifdef CONFIG_PAX_MPROTECT
49974 +       if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
49975 +               current->mm->binfmt->handle_mprotect(vma, vm_flags);
49976 +#endif
49977 +
49978         for (nstart = start ; ; ) {
49979                 unsigned long newflags;
49980
49981 @@ -301,6 +416,9 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
49982                 if (error)
49983                         goto out;
49984                 perf_event_mmap(vma);
49985 +
49986 +               track_exec_limit(current->mm, nstart, tmp, vm_flags);
49987 +
49988                 nstart = tmp;
49989
49990                 if (nstart < prev->vm_end)
49991 diff -urNp linux-2.6.33/mm/mremap.c linux-2.6.33/mm/mremap.c
49992 --- linux-2.6.33/mm/mremap.c    2010-02-24 13:52:17.000000000 -0500
49993 +++ linux-2.6.33/mm/mremap.c    2010-03-07 12:23:36.161647154 -0500
49994 @@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
49995                         continue;
49996                 pte = ptep_clear_flush(vma, old_addr, old_pte);
49997                 pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
49998 +
49999 +#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
50000 +               if (!(__supported_pte_mask & _PAGE_NX) && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
50001 +                       pte = pte_exprotect(pte);
50002 +#endif
50003 +
50004                 set_pte_at(mm, new_addr, new_pte, pte);
50005         }
50006
50007 @@ -273,6 +279,11 @@ static struct vm_area_struct *vma_to_res
50008         if (is_vm_hugetlb_page(vma))
50009                 goto Einval;
50010
50011 +#ifdef CONFIG_PAX_SEGMEXEC
50012 +       if (pax_find_mirror_vma(vma))
50013 +               goto Einval;
50014 +#endif
50015 +
50016         /* We can't remap across vm area boundaries */
50017         if (old_len > vma->vm_end - addr)
50018                 goto Efault;
50019 @@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned
50020         unsigned long ret = -EINVAL;
50021         unsigned long charged = 0;
50022         unsigned long map_flags;
50023 +       unsigned long pax_task_size = TASK_SIZE;
50024
50025         if (new_addr & ~PAGE_MASK)
50026                 goto out;
50027
50028 -       if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
50029 +#ifdef CONFIG_PAX_SEGMEXEC
50030 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
50031 +               pax_task_size = SEGMEXEC_TASK_SIZE;
50032 +#endif
50033 +
50034 +       if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
50035                 goto out;
50036
50037         /* Check if the location we're moving into overlaps the
50038          * old location at all, and fail if it does.
50039          */
50040 -       if ((new_addr <= addr) && (new_addr+new_len) > addr)
50041 -               goto out;
50042 -
50043 -       if ((addr <= new_addr) && (addr+old_len) > new_addr)
50044 +       if (addr + old_len > new_addr && new_addr + new_len > addr)
50045                 goto out;
50046
50047         ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
50048 @@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
50049         struct vm_area_struct *vma;
50050         unsigned long ret = -EINVAL;
50051         unsigned long charged = 0;
50052 +       unsigned long pax_task_size = TASK_SIZE;
50053
50054         if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
50055                 goto out;
50056 @@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
50057         if (!new_len)
50058                 goto out;
50059
50060 +#ifdef CONFIG_PAX_SEGMEXEC
50061 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
50062 +               pax_task_size = SEGMEXEC_TASK_SIZE;
50063 +#endif
50064 +
50065 +       if (new_len > pax_task_size || addr > pax_task_size-new_len ||
50066 +           old_len > pax_task_size || addr > pax_task_size-old_len)
50067 +               goto out;
50068 +
50069         if (flags & MREMAP_FIXED) {
50070                 if (flags & MREMAP_MAYMOVE)
50071                         ret = mremap_to(addr, old_len, new_addr, new_len);
50072 @@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
50073                                                    addr + new_len);
50074                         }
50075                         ret = addr;
50076 +                       track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
50077                         goto out;
50078                 }
50079         }
50080 @@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
50081                 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
50082                 if (ret)
50083                         goto out;
50084 +
50085 +               map_flags = vma->vm_flags;
50086                 ret = move_vma(vma, addr, old_len, new_len, new_addr);
50087 +               if (!(ret & ~PAGE_MASK)) {
50088 +                       track_exec_limit(current->mm, addr, addr + old_len, 0UL);
50089 +                       track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
50090 +               }
50091         }
50092  out:
50093         if (ret & ~PAGE_MASK)
50094 diff -urNp linux-2.6.33/mm/nommu.c linux-2.6.33/mm/nommu.c
50095 --- linux-2.6.33/mm/nommu.c     2010-02-24 13:52:17.000000000 -0500
50096 +++ linux-2.6.33/mm/nommu.c     2010-03-07 12:23:36.161647154 -0500
50097 @@ -759,15 +759,6 @@ struct vm_area_struct *find_vma(struct m
50098  EXPORT_SYMBOL(find_vma);
50099
50100  /*
50101 - * find a VMA
50102 - * - we don't extend stack VMAs under NOMMU conditions
50103 - */
50104 -struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
50105 -{
50106 -       return find_vma(mm, addr);
50107 -}
50108 -
50109 -/*
50110   * expand a stack to a given address
50111   * - not supported under NOMMU conditions
50112   */
50113 diff -urNp linux-2.6.33/mm/page_alloc.c linux-2.6.33/mm/page_alloc.c
50114 --- linux-2.6.33/mm/page_alloc.c        2010-02-24 13:52:17.000000000 -0500
50115 +++ linux-2.6.33/mm/page_alloc.c        2010-03-07 12:23:36.161647154 -0500
50116 @@ -583,6 +583,10 @@ static void __free_pages_ok(struct page
50117         int bad = 0;
50118         int wasMlocked = __TestClearPageMlocked(page);
50119
50120 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
50121 +       unsigned long index = 1UL << order;
50122 +#endif
50123 +
50124         kmemcheck_free_shadow(page, order);
50125
50126         for (i = 0 ; i < (1 << order) ; ++i)
50127 @@ -595,6 +599,12 @@ static void __free_pages_ok(struct page
50128                 debug_check_no_obj_freed(page_address(page),
50129                                            PAGE_SIZE << order);
50130         }
50131 +
50132 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
50133 +       for (; index; --index)
50134 +               sanitize_highpage(page + index - 1);
50135 +#endif
50136 +
50137         arch_free_page(page, order);
50138         kernel_map_pages(page, 1 << order, 0);
50139
50140 @@ -698,8 +708,10 @@ static int prep_new_page(struct page *pa
50141         arch_alloc_page(page, order);
50142         kernel_map_pages(page, 1 << order, 1);
50143
50144 +#ifndef CONFIG_PAX_MEMORY_SANITIZE
50145         if (gfp_flags & __GFP_ZERO)
50146                 prep_zero_page(page, order, gfp_flags);
50147 +#endif
50148
50149         if (order && (gfp_flags & __GFP_COMP))
50150                 prep_compound_page(page, order);
50151 @@ -1093,6 +1105,11 @@ static void free_hot_cold_page(struct pa
50152                 debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
50153                 debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
50154         }
50155 +
50156 +#ifdef CONFIG_PAX_MEMORY_SANITIZE
50157 +       sanitize_highpage(page);
50158 +#endif
50159 +
50160         arch_free_page(page, 0);
50161         kernel_map_pages(page, 1, 0);
50162
50163 diff -urNp linux-2.6.33/mm/percpu.c linux-2.6.33/mm/percpu.c
50164 --- linux-2.6.33/mm/percpu.c    2010-02-24 13:52:17.000000000 -0500
50165 +++ linux-2.6.33/mm/percpu.c    2010-03-07 12:23:36.161647154 -0500
50166 @@ -114,7 +114,7 @@ static unsigned int pcpu_first_unit_cpu
50167  static unsigned int pcpu_last_unit_cpu __read_mostly;
50168
50169  /* the address of the first chunk which starts with the kernel static area */
50170 -void *pcpu_base_addr __read_mostly;
50171 +void *pcpu_base_addr __read_only;
50172  EXPORT_SYMBOL_GPL(pcpu_base_addr);
50173
50174  static const int *pcpu_unit_map __read_mostly;         /* cpu -> unit */
50175 diff -urNp linux-2.6.33/mm/rmap.c linux-2.6.33/mm/rmap.c
50176 --- linux-2.6.33/mm/rmap.c      2010-02-24 13:52:17.000000000 -0500
50177 +++ linux-2.6.33/mm/rmap.c      2010-03-07 12:23:36.161647154 -0500
50178 @@ -109,6 +109,10 @@ int anon_vma_prepare(struct vm_area_stru
50179                 struct mm_struct *mm = vma->vm_mm;
50180                 struct anon_vma *allocated;
50181
50182 +#ifdef CONFIG_PAX_SEGMEXEC
50183 +               struct vm_area_struct *vma_m;
50184 +#endif
50185 +
50186                 anon_vma = find_mergeable_anon_vma(vma);
50187                 allocated = NULL;
50188                 if (!anon_vma) {
50189 @@ -122,6 +126,15 @@ int anon_vma_prepare(struct vm_area_stru
50190                 /* page_table_lock to protect against threads */
50191                 spin_lock(&mm->page_table_lock);
50192                 if (likely(!vma->anon_vma)) {
50193 +
50194 +#ifdef CONFIG_PAX_SEGMEXEC
50195 +                       vma_m = pax_find_mirror_vma(vma);
50196 +                       if (vma_m) {
50197 +                               vma_m->anon_vma = anon_vma;
50198 +                               __anon_vma_link(vma_m);
50199 +                       }
50200 +#endif
50201 +
50202                         vma->anon_vma = anon_vma;
50203                         list_add_tail(&vma->anon_vma_node, &anon_vma->head);
50204                         allocated = NULL;
50205 diff -urNp linux-2.6.33/mm/shmem.c linux-2.6.33/mm/shmem.c
50206 --- linux-2.6.33/mm/shmem.c     2010-02-24 13:52:17.000000000 -0500
50207 +++ linux-2.6.33/mm/shmem.c     2010-03-07 12:23:36.161647154 -0500
50208 @@ -30,7 +30,7 @@
50209  #include <linux/module.h>
50210  #include <linux/swap.h>
50211
50212 -static struct vfsmount *shm_mnt;
50213 +struct vfsmount *shm_mnt;
50214
50215  #ifdef CONFIG_SHMEM
50216  /*
50217 diff -urNp linux-2.6.33/mm/slab.c linux-2.6.33/mm/slab.c
50218 --- linux-2.6.33/mm/slab.c      2010-02-24 13:52:17.000000000 -0500
50219 +++ linux-2.6.33/mm/slab.c      2010-03-07 12:23:36.161647154 -0500
50220 @@ -308,7 +308,7 @@ struct kmem_list3 {
50221   * Need this for bootstrapping a per node allocator.
50222   */
50223  #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
50224 -struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
50225 +struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
50226  #define        CACHE_CACHE 0
50227  #define        SIZE_AC MAX_NUMNODES
50228  #define        SIZE_L3 (2 * MAX_NUMNODES)
50229 @@ -558,7 +558,7 @@ static inline void *index_to_obj(struct
50230   *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
50231   */
50232  static inline unsigned int obj_to_index(const struct kmem_cache *cache,
50233 -                                       const struct slab *slab, void *obj)
50234 +                                       const struct slab *slab, const void *obj)
50235  {
50236         u32 offset = (obj - slab->s_mem);
50237         return reciprocal_divide(offset, cache->reciprocal_buffer_size);
50238 @@ -584,14 +584,14 @@ struct cache_names {
50239  static struct cache_names __initdata cache_names[] = {
50240  #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
50241  #include <linux/kmalloc_sizes.h>
50242 -       {NULL,}
50243 +       {NULL, NULL}
50244  #undef CACHE
50245  };
50246
50247  static struct arraycache_init initarray_cache __initdata =
50248 -    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
50249 +    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
50250  static struct arraycache_init initarray_generic =
50251 -    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
50252 +    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
50253
50254  /* internal cache of cache description objs */
50255  static struct kmem_cache cache_cache = {
50256 @@ -4106,7 +4106,7 @@ out:
50257         schedule_delayed_work(work, round_jiffies_relative(REAPTIMEOUT_CPUC));
50258  }
50259
50260 -#ifdef CONFIG_SLABINFO
50261 +#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
50262
50263  static void print_slabinfo_header(struct seq_file *m)
50264  {
50265 @@ -4504,6 +4504,51 @@ static int __init slab_proc_init(void)
50266  module_init(slab_proc_init);
50267  #endif
50268
50269 +void check_object_size(const void *ptr, unsigned long n, bool to)
50270 +{
50271 +
50272 +#ifdef CONFIG_PAX_USERCOPY
50273 +       struct kmem_cache *cachep;
50274 +       struct slab *slabp;
50275 +       struct page *page;
50276 +       unsigned int objnr;
50277 +       unsigned long offset;
50278 +
50279 +       if (!n)
50280 +               return;
50281 +
50282 +       if (ZERO_OR_NULL_PTR(ptr))
50283 +               goto report;
50284 +
50285 +       if (!virt_addr_valid(ptr))
50286 +               return;
50287 +
50288 +       page = virt_to_head_page(ptr);
50289 +
50290 +       if (!PageSlab(page)) {
50291 +               if (object_is_on_stack(ptr, n) == -1)
50292 +                       goto report;
50293 +               return;
50294 +       }
50295 +
50296 +       cachep = page_get_cache(page);
50297 +       slabp = page_get_slab(page);
50298 +       objnr = obj_to_index(cachep, slabp, ptr);
50299 +       BUG_ON(objnr >= cachep->num);
50300 +       offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
50301 +       if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
50302 +               return;
50303 +
50304 +report:
50305 +       if (to)
50306 +               pax_report_leak_to_user(ptr, n);
50307 +       else
50308 +               pax_report_overflow_from_user(ptr, n);
50309 +#endif
50310 +
50311 +}
50312 +EXPORT_SYMBOL(check_object_size);
50313 +
50314  /**
50315   * ksize - get the actual amount of memory allocated for a given object
50316   * @objp: Pointer to the object
50317 diff -urNp linux-2.6.33/mm/slob.c linux-2.6.33/mm/slob.c
50318 --- linux-2.6.33/mm/slob.c      2010-02-24 13:52:17.000000000 -0500
50319 +++ linux-2.6.33/mm/slob.c      2010-03-07 12:23:36.165648287 -0500
50320 @@ -29,7 +29,7 @@
50321   * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
50322   * alloc_pages() directly, allocating compound pages so the page order
50323   * does not have to be separately tracked, and also stores the exact
50324 - * allocation size in page->private so that it can be used to accurately
50325 + * allocation size in slob_page->size so that it can be used to accurately
50326   * provide ksize(). These objects are detected in kfree() because slob_page()
50327   * is false for them.
50328   *
50329 @@ -58,6 +58,7 @@
50330   */
50331
50332  #include <linux/kernel.h>
50333 +#include <linux/sched.h>
50334  #include <linux/slab.h>
50335  #include <linux/mm.h>
50336  #include <linux/swap.h> /* struct reclaim_state */
50337 @@ -100,7 +101,8 @@ struct slob_page {
50338                         unsigned long flags;    /* mandatory */
50339                         atomic_t _count;        /* mandatory */
50340                         slobidx_t units;        /* free units left in page */
50341 -                       unsigned long pad[2];
50342 +                       unsigned long pad[1];
50343 +                       unsigned long size;     /* size when >=PAGE_SIZE */
50344                         slob_t *free;           /* first free slob_t in page */
50345                         struct list_head list;  /* linked list of free pages */
50346                 };
50347 @@ -133,7 +135,7 @@ static LIST_HEAD(free_slob_large);
50348   */
50349  static inline int is_slob_page(struct slob_page *sp)
50350  {
50351 -       return PageSlab((struct page *)sp);
50352 +       return PageSlab((struct page *)sp) && !sp->size;
50353  }
50354
50355  static inline void set_slob_page(struct slob_page *sp)
50356 @@ -148,7 +150,7 @@ static inline void clear_slob_page(struc
50357
50358  static inline struct slob_page *slob_page(const void *addr)
50359  {
50360 -       return (struct slob_page *)virt_to_page(addr);
50361 +       return (struct slob_page *)virt_to_head_page(addr);
50362  }
50363
50364  /*
50365 @@ -208,7 +210,7 @@ static void set_slob(slob_t *s, slobidx_
50366  /*
50367   * Return the size of a slob block.
50368   */
50369 -static slobidx_t slob_units(slob_t *s)
50370 +static slobidx_t slob_units(const slob_t *s)
50371  {
50372         if (s->units > 0)
50373                 return s->units;
50374 @@ -218,7 +220,7 @@ static slobidx_t slob_units(slob_t *s)
50375  /*
50376   * Return the next free slob block pointer after this one.
50377   */
50378 -static slob_t *slob_next(slob_t *s)
50379 +static slob_t *slob_next(const slob_t *s)
50380  {
50381         slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
50382         slobidx_t next;
50383 @@ -233,7 +235,7 @@ static slob_t *slob_next(slob_t *s)
50384  /*
50385   * Returns true if s is the last free block in its page.
50386   */
50387 -static int slob_last(slob_t *s)
50388 +static int slob_last(const slob_t *s)
50389  {
50390         return !((unsigned long)slob_next(s) & ~PAGE_MASK);
50391  }
50392 @@ -252,6 +254,7 @@ static void *slob_new_pages(gfp_t gfp, i
50393         if (!page)
50394                 return NULL;
50395
50396 +       set_slob_page(page);
50397         return page_address(page);
50398  }
50399
50400 @@ -368,11 +371,11 @@ static void *slob_alloc(size_t size, gfp
50401                 if (!b)
50402                         return NULL;
50403                 sp = slob_page(b);
50404 -               set_slob_page(sp);
50405
50406                 spin_lock_irqsave(&slob_lock, flags);
50407                 sp->units = SLOB_UNITS(PAGE_SIZE);
50408                 sp->free = b;
50409 +               sp->size = 0;
50410                 INIT_LIST_HEAD(&sp->list);
50411                 set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
50412                 set_slob_page_free(sp, slob_list);
50413 @@ -475,10 +478,9 @@ out:
50414  #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
50415  #endif
50416
50417 -void *__kmalloc_node(size_t size, gfp_t gfp, int node)
50418 +static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
50419  {
50420 -       unsigned int *m;
50421 -       int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
50422 +       slob_t *m;
50423         void *ret;
50424
50425         lockdep_trace_alloc(gfp);
50426 @@ -491,7 +493,10 @@ void *__kmalloc_node(size_t size, gfp_t
50427
50428                 if (!m)
50429                         return NULL;
50430 -               *m = size;
50431 +               BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
50432 +               BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
50433 +               m[0].units = size;
50434 +               m[1].units = align;
50435                 ret = (void *)m + align;
50436
50437                 trace_kmalloc_node(_RET_IP_, ret,
50438 @@ -501,9 +506,9 @@ void *__kmalloc_node(size_t size, gfp_t
50439
50440                 ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
50441                 if (ret) {
50442 -                       struct page *page;
50443 -                       page = virt_to_page(ret);
50444 -                       page->private = size;
50445 +                       struct slob_page *sp;
50446 +                       sp = slob_page(ret);
50447 +                       sp->size = size;
50448                 }
50449
50450                 trace_kmalloc_node(_RET_IP_, ret,
50451 @@ -513,6 +518,13 @@ void *__kmalloc_node(size_t size, gfp_t
50452         kmemleak_alloc(ret, size, 1, gfp);
50453         return ret;
50454  }
50455 +
50456 +void *__kmalloc_node(size_t size, gfp_t gfp, int node)
50457 +{
50458 +       int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
50459 +
50460 +       return __kmalloc_node_align(size, gfp, node, align);
50461 +}
50462  EXPORT_SYMBOL(__kmalloc_node);
50463
50464  void kfree(const void *block)
50465 @@ -528,13 +540,84 @@ void kfree(const void *block)
50466         sp = slob_page(block);
50467         if (is_slob_page(sp)) {
50468                 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
50469 -               unsigned int *m = (unsigned int *)(block - align);
50470 -               slob_free(m, *m + align);
50471 -       } else
50472 +               slob_t *m = (slob_t *)(block - align);
50473 +               slob_free(m, m[0].units + align);
50474 +       } else {
50475 +               clear_slob_page(sp);
50476 +               free_slob_page(sp);
50477 +               sp->size = 0;
50478                 put_page(&sp->page);
50479 +       }
50480  }
50481  EXPORT_SYMBOL(kfree);
50482
50483 +void check_object_size(const void *ptr, unsigned long n, bool to)
50484 +{
50485 +
50486 +#ifdef CONFIG_PAX_USERCOPY
50487 +       struct slob_page *sp;
50488 +       const slob_t *free;
50489 +       const void *base;
50490 +
50491 +       if (!n)
50492 +               return;
50493 +
50494 +       if (ZERO_OR_NULL_PTR(ptr))
50495 +               goto report;
50496 +
50497 +       if (!virt_addr_valid(ptr))
50498 +               return;
50499 +
50500 +       sp = slob_page(ptr);
50501 +       if (!PageSlab((struct page*)sp)) {
50502 +               if (object_is_on_stack(ptr, n) == -1)
50503 +                       goto report;
50504 +               return;
50505 +       }
50506 +
50507 +       if (sp->size) {
50508 +               base = page_address(&sp->page);
50509 +               if (base <= ptr && n <= sp->size - (ptr - base))
50510 +                       return;
50511 +               goto report;
50512 +       }
50513 +
50514 +       /* some tricky double walking to find the chunk */
50515 +       base = (void *)((unsigned long)ptr & PAGE_MASK);
50516 +       free = sp->free;
50517 +
50518 +       while (!slob_last(free) && (void *)free <= ptr) {
50519 +               base = free + slob_units(free);
50520 +               free = slob_next(free);
50521 +       }
50522 +
50523 +       while (base < (void *)free) {
50524 +               slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
50525 +               int size = SLOB_UNIT * SLOB_UNITS(m + align);
50526 +               int offset;
50527 +
50528 +               if (ptr < base + align)
50529 +                       goto report;
50530 +
50531 +               offset = ptr - base - align;
50532 +               if (offset < m) {
50533 +                       if (n <= m - offset)
50534 +                               return;
50535 +                       goto report;
50536 +               }
50537 +               base += size;
50538 +       }
50539 +
50540 +report:
50541 +       if (to)
50542 +               pax_report_leak_to_user(ptr, n);
50543 +       else
50544 +               pax_report_overflow_from_user(ptr, n);
50545 +#endif
50546 +
50547 +}
50548 +EXPORT_SYMBOL(check_object_size);
50549 +
50550  /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
50551  size_t ksize(const void *block)
50552  {
50553 @@ -547,10 +630,10 @@ size_t ksize(const void *block)
50554         sp = slob_page(block);
50555         if (is_slob_page(sp)) {
50556                 int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
50557 -               unsigned int *m = (unsigned int *)(block - align);
50558 -               return SLOB_UNITS(*m) * SLOB_UNIT;
50559 +               slob_t *m = (slob_t *)(block - align);
50560 +               return SLOB_UNITS(m[0].units) * SLOB_UNIT;
50561         } else
50562 -               return sp->page.private;
50563 +               return sp->size;
50564  }
50565  EXPORT_SYMBOL(ksize);
50566
50567 @@ -605,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
50568  {
50569         void *b;
50570
50571 +#ifdef CONFIG_PAX_USERCOPY
50572 +       b = __kmalloc_node_align(c->size, flags, node, c->align);
50573 +#else
50574         if (c->size < PAGE_SIZE) {
50575                 b = slob_alloc(c->size, flags, c->align, node);
50576                 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
50577                                             SLOB_UNITS(c->size) * SLOB_UNIT,
50578                                             flags, node);
50579         } else {
50580 +               struct slob_page *sp;
50581 +
50582                 b = slob_new_pages(flags, get_order(c->size), node);
50583 +               sp = slob_page(b);
50584 +               sp->size = c->size;
50585                 trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
50586                                             PAGE_SIZE << get_order(c->size),
50587                                             flags, node);
50588         }
50589 +#endif
50590
50591         if (c->ctor)
50592                 c->ctor(b);
50593 @@ -627,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
50594
50595  static void __kmem_cache_free(void *b, int size)
50596  {
50597 -       if (size < PAGE_SIZE)
50598 +       struct slob_page *sp = slob_page(b);
50599 +
50600 +       if (is_slob_page(sp))
50601                 slob_free(b, size);
50602 -       else
50603 +       else {
50604 +               clear_slob_page(sp);
50605 +               free_slob_page(sp);
50606 +               sp->size = 0;
50607                 slob_free_pages(b, get_order(size));
50608 +       }
50609  }
50610
50611  static void kmem_rcu_free(struct rcu_head *head)
50612 @@ -643,15 +740,24 @@ static void kmem_rcu_free(struct rcu_hea
50613
50614  void kmem_cache_free(struct kmem_cache *c, void *b)
50615  {
50616 +       int size = c->size;
50617 +
50618 +#ifdef CONFIG_PAX_USERCOPY
50619 +       if (size + c->align < PAGE_SIZE) {
50620 +               size += c->align;
50621 +               b -= c->align;
50622 +       }
50623 +#endif
50624 +
50625         kmemleak_free_recursive(b, c->flags);
50626         if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
50627                 struct slob_rcu *slob_rcu;
50628 -               slob_rcu = b + (c->size - sizeof(struct slob_rcu));
50629 +               slob_rcu = b + (size - sizeof(struct slob_rcu));
50630                 INIT_RCU_HEAD(&slob_rcu->head);
50631 -               slob_rcu->size = c->size;
50632 +               slob_rcu->size = size;
50633                 call_rcu(&slob_rcu->head, kmem_rcu_free);
50634         } else {
50635 -               __kmem_cache_free(b, c->size);
50636 +               __kmem_cache_free(b, size);
50637         }
50638
50639         trace_kmem_cache_free(_RET_IP_, b);
50640 diff -urNp linux-2.6.33/mm/slub.c linux-2.6.33/mm/slub.c
50641 --- linux-2.6.33/mm/slub.c      2010-02-24 13:52:17.000000000 -0500
50642 +++ linux-2.6.33/mm/slub.c      2010-03-07 12:23:36.165648287 -0500
50643 @@ -1893,6 +1893,8 @@ void kmem_cache_free(struct kmem_cache *
50644
50645         page = virt_to_head_page(x);
50646
50647 +       BUG_ON(!PageSlab(page));
50648 +
50649         slab_free(s, page, x, _RET_IP_);
50650
50651         trace_kmem_cache_free(_RET_IP_, x);
50652 @@ -1937,7 +1939,7 @@ static int slub_min_objects;
50653   * Merge control. If this is set then no merging of slab caches will occur.
50654   * (Could be removed. This was introduced to pacify the merge skeptics.)
50655   */
50656 -static int slub_nomerge;
50657 +static int slub_nomerge = 1;
50658
50659  /*
50660   * Calculate the order of allocation given an slab object size.
50661 @@ -2493,7 +2495,7 @@ static int kmem_cache_open(struct kmem_c
50662          * list to avoid pounding the page allocator excessively.
50663          */
50664         set_min_partial(s, ilog2(s->size));
50665 -       s->refcount = 1;
50666 +       atomic_set(&s->refcount, 1);
50667  #ifdef CONFIG_NUMA
50668         s->remote_node_defrag_ratio = 1000;
50669  #endif
50670 @@ -2630,8 +2632,7 @@ static inline int kmem_cache_close(struc
50671  void kmem_cache_destroy(struct kmem_cache *s)
50672  {
50673         down_write(&slub_lock);
50674 -       s->refcount--;
50675 -       if (!s->refcount) {
50676 +       if (atomic_dec_and_test(&s->refcount)) {
50677                 list_del(&s->list);
50678                 up_write(&slub_lock);
50679                 if (kmem_cache_close(s)) {
50680 @@ -2915,6 +2916,46 @@ void *__kmalloc_node(size_t size, gfp_t
50681  EXPORT_SYMBOL(__kmalloc_node);
50682  #endif
50683
50684 +void check_object_size(const void *ptr, unsigned long n, bool to)
50685 +{
50686 +
50687 +#ifdef CONFIG_PAX_USERCOPY
50688 +       struct page *page;
50689 +       struct kmem_cache *s;
50690 +       unsigned long offset;
50691 +
50692 +       if (!n)
50693 +               return;
50694 +
50695 +       if (ZERO_OR_NULL_PTR(ptr))
50696 +               goto report;
50697 +
50698 +       if (!virt_addr_valid(ptr))
50699 +               return;
50700 +
50701 +       page = get_object_page(ptr);
50702 +
50703 +       if (!page) {
50704 +               if (object_is_on_stack(ptr, n) == -1)
50705 +                       goto report;
50706 +               return;
50707 +       }
50708 +
50709 +       s = page->slab;
50710 +       offset = (ptr - page_address(page)) % s->size;
50711 +       if (offset <= s->objsize && n <= s->objsize - offset)
50712 +               return;
50713 +
50714 +report:
50715 +       if (to)
50716 +               pax_report_leak_to_user(ptr, n);
50717 +       else
50718 +               pax_report_overflow_from_user(ptr, n);
50719 +#endif
50720 +
50721 +}
50722 +EXPORT_SYMBOL(check_object_size);
50723 +
50724  size_t ksize(const void *object)
50725  {
50726         struct page *page;
50727 @@ -3186,7 +3227,7 @@ void __init kmem_cache_init(void)
50728          */
50729         create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
50730                 sizeof(struct kmem_cache_node), GFP_NOWAIT);
50731 -       kmalloc_caches[0].refcount = -1;
50732 +       atomic_set(&kmalloc_caches[0].refcount, -1);
50733         caches++;
50734
50735         hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
50736 @@ -3293,7 +3334,7 @@ static int slab_unmergeable(struct kmem_
50737         /*
50738          * We may have set a slab to be unmergeable during bootstrap.
50739          */
50740 -       if (s->refcount < 0)
50741 +       if (atomic_read(&s->refcount) < 0)
50742                 return 1;
50743
50744         return 0;
50745 @@ -3353,7 +3394,7 @@ struct kmem_cache *kmem_cache_create(con
50746         if (s) {
50747                 int cpu;
50748
50749 -               s->refcount++;
50750 +               atomic_inc(&s->refcount);
50751                 /*
50752                  * Adjust the object sizes so that we clear
50753                  * the complete object on kzalloc.
50754 @@ -3372,7 +3413,7 @@ struct kmem_cache *kmem_cache_create(con
50755
50756                 if (sysfs_slab_alias(s, name)) {
50757                         down_write(&slub_lock);
50758 -                       s->refcount--;
50759 +                       atomic_dec(&s->refcount);
50760                         up_write(&slub_lock);
50761                         goto err;
50762                 }
50763 @@ -4101,7 +4142,7 @@ SLAB_ATTR_RO(ctor);
50764
50765  static ssize_t aliases_show(struct kmem_cache *s, char *buf)
50766  {
50767 -       return sprintf(buf, "%d\n", s->refcount - 1);
50768 +       return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
50769  }
50770  SLAB_ATTR_RO(aliases);
50771
50772 @@ -4519,7 +4560,7 @@ static void kmem_cache_release(struct ko
50773         kfree(s);
50774  }
50775
50776 -static struct sysfs_ops slab_sysfs_ops = {
50777 +static const struct sysfs_ops slab_sysfs_ops = {
50778         .show = slab_attr_show,
50779         .store = slab_attr_store,
50780  };
50781 @@ -4538,7 +4579,7 @@ static int uevent_filter(struct kset *ks
50782         return 0;
50783  }
50784
50785 -static struct kset_uevent_ops slab_uevent_ops = {
50786 +static const struct kset_uevent_ops slab_uevent_ops = {
50787         .filter = uevent_filter,
50788  };
50789
50790 @@ -4712,7 +4753,7 @@ __initcall(slab_sysfs_init);
50791  /*
50792   * The /proc/slabinfo ABI
50793   */
50794 -#ifdef CONFIG_SLABINFO
50795 +#if defined(CONFIG_SLABINFO) && !defined(CONFIG_GRKERNSEC_PROC_ADD)
50796  static void print_slabinfo_header(struct seq_file *m)
50797  {
50798         seq_puts(m, "slabinfo - version: 2.1\n");
50799 diff -urNp linux-2.6.33/mm/util.c linux-2.6.33/mm/util.c
50800 --- linux-2.6.33/mm/util.c      2010-02-24 13:52:17.000000000 -0500
50801 +++ linux-2.6.33/mm/util.c      2010-03-07 12:23:36.165648287 -0500
50802 @@ -224,6 +224,12 @@ EXPORT_SYMBOL(strndup_user);
50803  void arch_pick_mmap_layout(struct mm_struct *mm)
50804  {
50805         mm->mmap_base = TASK_UNMAPPED_BASE;
50806 +
50807 +#ifdef CONFIG_PAX_RANDMMAP
50808 +       if (mm->pax_flags & MF_PAX_RANDMMAP)
50809 +               mm->mmap_base += mm->delta_mmap;
50810 +#endif
50811 +
50812         mm->get_unmapped_area = arch_get_unmapped_area;
50813         mm->unmap_area = arch_unmap_area;
50814  }
50815 diff -urNp linux-2.6.33/mm/vmalloc.c linux-2.6.33/mm/vmalloc.c
50816 --- linux-2.6.33/mm/vmalloc.c   2010-02-24 13:52:17.000000000 -0500
50817 +++ linux-2.6.33/mm/vmalloc.c   2010-03-07 12:23:36.165648287 -0500
50818 @@ -40,8 +40,19 @@ static void vunmap_pte_range(pmd_t *pmd,
50819
50820         pte = pte_offset_kernel(pmd, addr);
50821         do {
50822 -               pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
50823 -               WARN_ON(!pte_none(ptent) && !pte_present(ptent));
50824 +
50825 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50826 +               if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
50827 +                       BUG_ON(!pte_exec(*pte));
50828 +                       set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
50829 +                       continue;
50830 +               }
50831 +#endif
50832 +
50833 +               {
50834 +                       pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
50835 +                       WARN_ON(!pte_none(ptent) && !pte_present(ptent));
50836 +               }
50837         } while (pte++, addr += PAGE_SIZE, addr != end);
50838  }
50839
50840 @@ -92,6 +103,7 @@ static int vmap_pte_range(pmd_t *pmd, un
50841                 unsigned long end, pgprot_t prot, struct page **pages, int *nr)
50842  {
50843         pte_t *pte;
50844 +       int ret = -ENOMEM;
50845
50846         /*
50847          * nr is a running index into the array which helps higher level
50848 @@ -101,17 +113,30 @@ static int vmap_pte_range(pmd_t *pmd, un
50849         pte = pte_alloc_kernel(pmd, addr);
50850         if (!pte)
50851                 return -ENOMEM;
50852 +
50853 +       pax_open_kernel();
50854         do {
50855                 struct page *page = pages[*nr];
50856
50857 -               if (WARN_ON(!pte_none(*pte)))
50858 -                       return -EBUSY;
50859 -               if (WARN_ON(!page))
50860 -                       return -ENOMEM;
50861 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50862 +               if (pgprot_val(prot) & _PAGE_NX)
50863 +#endif
50864 +
50865 +               if (WARN_ON(!pte_none(*pte))) {
50866 +                       ret = -EBUSY;
50867 +                       goto out;
50868 +               }
50869 +               if (WARN_ON(!page)) {
50870 +                       ret = -ENOMEM;
50871 +                       goto out;
50872 +               }
50873                 set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
50874                 (*nr)++;
50875         } while (pte++, addr += PAGE_SIZE, addr != end);
50876 -       return 0;
50877 +       ret = 0;
50878 +out:
50879 +       pax_close_kernel();
50880 +       return ret;
50881  }
50882
50883  static int vmap_pmd_range(pud_t *pud, unsigned long addr,
50884 @@ -192,11 +217,20 @@ int is_vmalloc_or_module_addr(const void
50885          * and fall back on vmalloc() if that fails. Others
50886          * just put it in the vmalloc space.
50887          */
50888 -#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
50889 +#ifdef CONFIG_MODULES
50890 +#ifdef MODULES_VADDR
50891         unsigned long addr = (unsigned long)x;
50892         if (addr >= MODULES_VADDR && addr < MODULES_END)
50893                 return 1;
50894  #endif
50895 +
50896 +#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50897 +       if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
50898 +               return 1;
50899 +#endif
50900 +
50901 +#endif
50902 +
50903         return is_vmalloc_addr(x);
50904  }
50905
50906 @@ -292,13 +326,13 @@ static void __insert_vmap_area(struct vm
50907         struct rb_node *tmp;
50908
50909         while (*p) {
50910 -               struct vmap_area *tmp;
50911 +               struct vmap_area *varea;
50912
50913                 parent = *p;
50914 -               tmp = rb_entry(parent, struct vmap_area, rb_node);
50915 -               if (va->va_start < tmp->va_end)
50916 +               varea = rb_entry(parent, struct vmap_area, rb_node);
50917 +               if (va->va_start < varea->va_end)
50918                         p = &(*p)->rb_left;
50919 -               else if (va->va_end > tmp->va_start)
50920 +               else if (va->va_end > varea->va_start)
50921                         p = &(*p)->rb_right;
50922                 else
50923                         BUG();
50924 @@ -1224,6 +1258,16 @@ static struct vm_struct *__get_vm_area_n
50925         struct vm_struct *area;
50926
50927         BUG_ON(in_interrupt());
50928 +
50929 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50930 +       if (flags & VM_KERNEXEC) {
50931 +               if (start != VMALLOC_START || end != VMALLOC_END)
50932 +                       return NULL;
50933 +               start = (unsigned long)&MODULES_EXEC_VADDR;
50934 +               end = (unsigned long)&MODULES_EXEC_END;
50935 +       }
50936 +#endif
50937 +
50938         if (flags & VM_IOREMAP) {
50939                 int bit = fls(size);
50940
50941 @@ -1449,6 +1493,11 @@ void *vmap(struct page **pages, unsigned
50942         if (count > totalram_pages)
50943                 return NULL;
50944
50945 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50946 +       if (!(pgprot_val(prot) & _PAGE_NX))
50947 +               flags |= VM_KERNEXEC;
50948 +#endif
50949 +
50950         area = get_vm_area_caller((count << PAGE_SHIFT), flags,
50951                                         __builtin_return_address(0));
50952         if (!area)
50953 @@ -1558,6 +1607,13 @@ static void *__vmalloc_node(unsigned lon
50954         if (!size || (size >> PAGE_SHIFT) > totalram_pages)
50955                 return NULL;
50956
50957 +#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
50958 +       if (!(pgprot_val(prot) & _PAGE_NX))
50959 +               area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
50960 +                                               node, gfp_mask, caller);
50961 +       else
50962 +#endif
50963 +
50964         area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
50965                                   VMALLOC_END, node, gfp_mask, caller);
50966
50967 @@ -1576,6 +1632,7 @@ static void *__vmalloc_node(unsigned lon
50968         return addr;
50969  }
50970
50971 +#undef __vmalloc
50972  void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
50973  {
50974         return __vmalloc_node(size, 1, gfp_mask, prot, -1,
50975 @@ -1592,6 +1649,7 @@ EXPORT_SYMBOL(__vmalloc);
50976   *     For tight control over page level allocator and protection flags
50977   *     use __vmalloc() instead.
50978   */
50979 +#undef vmalloc
50980  void *vmalloc(unsigned long size)
50981  {
50982         return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
50983 @@ -1606,6 +1664,7 @@ EXPORT_SYMBOL(vmalloc);
50984   * The resulting memory area is zeroed so it can be mapped to userspace
50985   * without leaking data.
50986   */
50987 +#undef vmalloc_user
50988  void *vmalloc_user(unsigned long size)
50989  {
50990         struct vm_struct *area;
50991 @@ -1633,6 +1692,7 @@ EXPORT_SYMBOL(vmalloc_user);
50992   *     For tight control over page level allocator and protection flags
50993   *     use __vmalloc() instead.
50994   */
50995 +#undef vmalloc_node
50996  void *vmalloc_node(unsigned long size, int node)
50997  {
50998         return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
50999 @@ -1655,10 +1715,10 @@ EXPORT_SYMBOL(vmalloc_node);
51000   *     For tight control over page level allocator and protection flags
51001   *     use __vmalloc() instead.
51002   */
51003 -
51004 +#undef vmalloc_exec
51005  void *vmalloc_exec(unsigned long size)
51006  {
51007 -       return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
51008 +       return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
51009                               -1, __builtin_return_address(0));
51010  }
51011
51012 @@ -1677,6 +1737,7 @@ void *vmalloc_exec(unsigned long size)
51013   *     Allocate enough 32bit PA addressable pages to cover @size from the
51014   *     page level allocator and map them into contiguous kernel virtual space.
51015   */
51016 +#undef vmalloc_32
51017  void *vmalloc_32(unsigned long size)
51018  {
51019         return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
51020 @@ -1691,6 +1752,7 @@ EXPORT_SYMBOL(vmalloc_32);
51021   * The resulting memory area is 32bit addressable and zeroed so it can be
51022   * mapped to userspace without leaking data.
51023   */
51024 +#undef vmalloc_32_user
51025  void *vmalloc_32_user(unsigned long size)
51026  {
51027         struct vm_struct *area;
51028 diff -urNp linux-2.6.33/net/atm/atm_misc.c linux-2.6.33/net/atm/atm_misc.c
51029 --- linux-2.6.33/net/atm/atm_misc.c     2010-02-24 13:52:17.000000000 -0500
51030 +++ linux-2.6.33/net/atm/atm_misc.c     2010-03-07 12:23:36.165648287 -0500
51031 @@ -19,7 +19,7 @@ int atm_charge(struct atm_vcc *vcc,int t
51032         if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
51033                 return 1;
51034         atm_return(vcc,truesize);
51035 -       atomic_inc(&vcc->stats->rx_drop);
51036 +       atomic_inc_unchecked(&vcc->stats->rx_drop);
51037         return 0;
51038  }
51039
51040 @@ -41,7 +41,7 @@ struct sk_buff *atm_alloc_charge(struct
51041                 }
51042         }
51043         atm_return(vcc,guess);
51044 -       atomic_inc(&vcc->stats->rx_drop);
51045 +       atomic_inc_unchecked(&vcc->stats->rx_drop);
51046         return NULL;
51047  }
51048
51049 @@ -88,7 +88,7 @@ int atm_pcr_goal(const struct atm_trafpr
51050
51051  void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
51052  {
51053 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
51054 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
51055         __SONET_ITEMS
51056  #undef __HANDLE_ITEM
51057  }
51058 @@ -96,7 +96,7 @@ void sonet_copy_stats(struct k_sonet_sta
51059
51060  void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
51061  {
51062 -#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
51063 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
51064         __SONET_ITEMS
51065  #undef __HANDLE_ITEM
51066  }
51067 diff -urNp linux-2.6.33/net/atm/proc.c linux-2.6.33/net/atm/proc.c
51068 --- linux-2.6.33/net/atm/proc.c 2010-02-24 13:52:17.000000000 -0500
51069 +++ linux-2.6.33/net/atm/proc.c 2010-03-07 12:23:36.165648287 -0500
51070 @@ -43,9 +43,9 @@ static void add_stats(struct seq_file *s
51071    const struct k_atm_aal_stats *stats)
51072  {
51073         seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
51074 -           atomic_read(&stats->tx),atomic_read(&stats->tx_err),
51075 -           atomic_read(&stats->rx),atomic_read(&stats->rx_err),
51076 -           atomic_read(&stats->rx_drop));
51077 +           atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
51078 +           atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
51079 +           atomic_read_unchecked(&stats->rx_drop));
51080  }
51081
51082  static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
51083 diff -urNp linux-2.6.33/net/atm/resources.c linux-2.6.33/net/atm/resources.c
51084 --- linux-2.6.33/net/atm/resources.c    2010-02-24 13:52:17.000000000 -0500
51085 +++ linux-2.6.33/net/atm/resources.c    2010-03-07 12:23:36.165648287 -0500
51086 @@ -161,7 +161,7 @@ void atm_dev_deregister(struct atm_dev *
51087  static void copy_aal_stats(struct k_atm_aal_stats *from,
51088      struct atm_aal_stats *to)
51089  {
51090 -#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
51091 +#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
51092         __AAL_STAT_ITEMS
51093  #undef __HANDLE_ITEM
51094  }
51095 @@ -170,7 +170,7 @@ static void copy_aal_stats(struct k_atm_
51096  static void subtract_aal_stats(struct k_atm_aal_stats *from,
51097      struct atm_aal_stats *to)
51098  {
51099 -#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
51100 +#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
51101         __AAL_STAT_ITEMS
51102  #undef __HANDLE_ITEM
51103  }
51104 diff -urNp linux-2.6.33/net/bridge/br_private.h linux-2.6.33/net/bridge/br_private.h
51105 --- linux-2.6.33/net/bridge/br_private.h        2010-02-24 13:52:17.000000000 -0500
51106 +++ linux-2.6.33/net/bridge/br_private.h        2010-03-07 12:23:36.165648287 -0500
51107 @@ -254,7 +254,7 @@ extern void br_ifinfo_notify(int event,
51108
51109  #ifdef CONFIG_SYSFS
51110  /* br_sysfs_if.c */
51111 -extern struct sysfs_ops brport_sysfs_ops;
51112 +extern const struct sysfs_ops brport_sysfs_ops;
51113  extern int br_sysfs_addif(struct net_bridge_port *p);
51114
51115  /* br_sysfs_br.c */
51116 diff -urNp linux-2.6.33/net/bridge/br_stp_if.c linux-2.6.33/net/bridge/br_stp_if.c
51117 --- linux-2.6.33/net/bridge/br_stp_if.c 2010-02-24 13:52:17.000000000 -0500
51118 +++ linux-2.6.33/net/bridge/br_stp_if.c 2010-03-07 12:23:36.165648287 -0500
51119 @@ -146,7 +146,7 @@ static void br_stp_stop(struct net_bridg
51120         char *envp[] = { NULL };
51121
51122         if (br->stp_enabled == BR_USER_STP) {
51123 -               r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
51124 +               r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
51125                 printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
51126                         br->dev->name, r);
51127
51128 diff -urNp linux-2.6.33/net/bridge/br_sysfs_if.c linux-2.6.33/net/bridge/br_sysfs_if.c
51129 --- linux-2.6.33/net/bridge/br_sysfs_if.c       2010-02-24 13:52:17.000000000 -0500
51130 +++ linux-2.6.33/net/bridge/br_sysfs_if.c       2010-03-07 12:23:36.165648287 -0500
51131 @@ -220,7 +220,7 @@ static ssize_t brport_store(struct kobje
51132         return ret;
51133  }
51134
51135 -struct sysfs_ops brport_sysfs_ops = {
51136 +const struct sysfs_ops brport_sysfs_ops = {
51137         .show = brport_show,
51138         .store = brport_store,
51139  };
51140 diff -urNp linux-2.6.33/net/bridge/netfilter/ebtables.c linux-2.6.33/net/bridge/netfilter/ebtables.c
51141 --- linux-2.6.33/net/bridge/netfilter/ebtables.c        2010-02-24 13:52:17.000000000 -0500
51142 +++ linux-2.6.33/net/bridge/netfilter/ebtables.c        2010-03-07 12:23:36.165648287 -0500
51143 @@ -1456,7 +1456,7 @@ static int do_ebt_get_ctl(struct sock *s
51144                         tmp.valid_hooks = t->table->valid_hooks;
51145                 }
51146                 mutex_unlock(&ebt_mutex);
51147 -               if (copy_to_user(user, &tmp, *len) != 0){
51148 +               if (*len > sizeof(tmp) || copy_to_user(user, &tmp, *len) != 0){
51149                         BUGPRINT("c2u Didn't work\n");
51150                         ret = -EFAULT;
51151                         break;
51152 diff -urNp linux-2.6.33/net/core/dev.c linux-2.6.33/net/core/dev.c
51153 --- linux-2.6.33/net/core/dev.c 2010-02-24 13:52:17.000000000 -0500
51154 +++ linux-2.6.33/net/core/dev.c 2010-03-07 12:23:36.165648287 -0500
51155 @@ -2183,7 +2183,7 @@ int netif_rx_ni(struct sk_buff *skb)
51156  }
51157  EXPORT_SYMBOL(netif_rx_ni);
51158
51159 -static void net_tx_action(struct softirq_action *h)
51160 +static void net_tx_action(void)
51161  {
51162         struct softnet_data *sd = &__get_cpu_var(softnet_data);
51163
51164 @@ -2939,7 +2939,7 @@ void netif_napi_del(struct napi_struct *
51165  EXPORT_SYMBOL(netif_napi_del);
51166
51167
51168 -static void net_rx_action(struct softirq_action *h)
51169 +static void net_rx_action(void)
51170  {
51171         struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
51172         unsigned long time_limit = jiffies + 2;
51173 diff -urNp linux-2.6.33/net/core/flow.c linux-2.6.33/net/core/flow.c
51174 --- linux-2.6.33/net/core/flow.c        2010-02-24 13:52:17.000000000 -0500
51175 +++ linux-2.6.33/net/core/flow.c        2010-03-07 12:23:36.165648287 -0500
51176 @@ -39,7 +39,7 @@ atomic_t flow_cache_genid = ATOMIC_INIT(
51177
51178  static u32 flow_hash_shift;
51179  #define flow_hash_size (1 << flow_hash_shift)
51180 -static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
51181 +static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
51182
51183  #define flow_table(cpu) (per_cpu(flow_tables, cpu))
51184
51185 @@ -52,7 +52,7 @@ struct flow_percpu_info {
51186         u32 hash_rnd;
51187         int count;
51188  };
51189 -static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
51190 +static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
51191
51192  #define flow_hash_rnd_recalc(cpu) \
51193         (per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
51194 @@ -69,7 +69,7 @@ struct flow_flush_info {
51195         atomic_t cpuleft;
51196         struct completion completion;
51197  };
51198 -static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
51199 +static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
51200
51201  #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
51202
51203 diff -urNp linux-2.6.33/net/core/sock.c linux-2.6.33/net/core/sock.c
51204 --- linux-2.6.33/net/core/sock.c        2010-02-24 13:52:17.000000000 -0500
51205 +++ linux-2.6.33/net/core/sock.c        2010-03-07 12:23:36.169632867 -0500
51206 @@ -896,7 +896,7 @@ int sock_getsockopt(struct socket *sock,
51207                         return -ENOTCONN;
51208                 if (lv < len)
51209                         return -EINVAL;
51210 -               if (copy_to_user(optval, address, len))
51211 +               if (len > sizeof(address) || copy_to_user(optval, address, len))
51212                         return -EFAULT;
51213                 goto lenout;
51214         }
51215 @@ -929,7 +929,7 @@ int sock_getsockopt(struct socket *sock,
51216
51217         if (len > lv)
51218                 len = lv;
51219 -       if (copy_to_user(optval, &v, len))
51220 +       if (len > sizeof(v) || copy_to_user(optval, &v, len))
51221                 return -EFAULT;
51222  lenout:
51223         if (put_user(len, optlen))
51224 diff -urNp linux-2.6.33/net/dccp/ccids/ccid3.c linux-2.6.33/net/dccp/ccids/ccid3.c
51225 --- linux-2.6.33/net/dccp/ccids/ccid3.c 2010-02-24 13:52:17.000000000 -0500
51226 +++ linux-2.6.33/net/dccp/ccids/ccid3.c 2010-03-07 12:23:36.169632867 -0500
51227 @@ -41,7 +41,7 @@
51228  static int ccid3_debug;
51229  #define ccid3_pr_debug(format, a...)   DCCP_PR_DEBUG(ccid3_debug, format, ##a)
51230  #else
51231 -#define ccid3_pr_debug(format, a...)
51232 +#define ccid3_pr_debug(format, a...) do {} while (0)
51233  #endif
51234
51235  /*
51236 diff -urNp linux-2.6.33/net/dccp/dccp.h linux-2.6.33/net/dccp/dccp.h
51237 --- linux-2.6.33/net/dccp/dccp.h        2010-02-24 13:52:17.000000000 -0500
51238 +++ linux-2.6.33/net/dccp/dccp.h        2010-03-07 12:23:36.169632867 -0500
51239 @@ -44,9 +44,9 @@ extern int dccp_debug;
51240  #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
51241  #define dccp_debug(fmt, a...)            dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
51242  #else
51243 -#define dccp_pr_debug(format, a...)
51244 -#define dccp_pr_debug_cat(format, a...)
51245 -#define dccp_debug(format, a...)
51246 +#define dccp_pr_debug(format, a...) do {} while (0)
51247 +#define dccp_pr_debug_cat(format, a...) do {} while (0)
51248 +#define dccp_debug(format, a...) do {} while (0)
51249  #endif
51250
51251  extern struct inet_hashinfo dccp_hashinfo;
51252 diff -urNp linux-2.6.33/net/decnet/sysctl_net_decnet.c linux-2.6.33/net/decnet/sysctl_net_decnet.c
51253 --- linux-2.6.33/net/decnet/sysctl_net_decnet.c 2010-02-24 13:52:17.000000000 -0500
51254 +++ linux-2.6.33/net/decnet/sysctl_net_decnet.c 2010-03-07 12:23:36.169632867 -0500
51255 @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
51256
51257         if (len > *lenp) len = *lenp;
51258
51259 -       if (copy_to_user(buffer, addr, len))
51260 +       if (len > sizeof(addr) || copy_to_user(buffer, addr, len))
51261                 return -EFAULT;
51262
51263         *lenp = len;
51264 @@ -236,7 +236,7 @@ static int dn_def_dev_handler(ctl_table
51265
51266         if (len > *lenp) len = *lenp;
51267
51268 -       if (copy_to_user(buffer, devname, len))
51269 +       if (len > sizeof(devname) || copy_to_user(buffer, devname, len))
51270                 return -EFAULT;
51271
51272         *lenp = len;
51273 diff -urNp linux-2.6.33/net/ipv4/inet_hashtables.c linux-2.6.33/net/ipv4/inet_hashtables.c
51274 --- linux-2.6.33/net/ipv4/inet_hashtables.c     2010-02-24 13:52:17.000000000 -0500
51275 +++ linux-2.6.33/net/ipv4/inet_hashtables.c     2010-03-07 12:23:36.169632867 -0500
51276 @@ -18,11 +18,14 @@
51277  #include <linux/sched.h>
51278  #include <linux/slab.h>
51279  #include <linux/wait.h>
51280 +#include <linux/security.h>
51281
51282  #include <net/inet_connection_sock.h>
51283  #include <net/inet_hashtables.h>
51284  #include <net/route.h>
51285  #include <net/ip.h>
51286
51287 +extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
51288 +
51289  /*
51290   * Allocate and initialize a new local port bind bucket.
51291 @@ -506,6 +509,8 @@ ok:
51292                         twrefcnt += inet_twsk_bind_unhash(tw, hinfo);
51293                 spin_unlock(&head->lock);
51294
51295 +               gr_update_task_in_ip_table(current, inet_sk(sk));
51296 +
51297                 if (tw) {
51298                         inet_twsk_deschedule(tw, death_row);
51299                         while (twrefcnt) {
51300 diff -urNp linux-2.6.33/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.33/net/ipv4/netfilter/nf_nat_snmp_basic.c
51301 --- linux-2.6.33/net/ipv4/netfilter/nf_nat_snmp_basic.c 2010-02-24 13:52:17.000000000 -0500
51302 +++ linux-2.6.33/net/ipv4/netfilter/nf_nat_snmp_basic.c 2010-03-07 12:23:36.169632867 -0500
51303 @@ -397,7 +397,7 @@ static unsigned char asn1_octets_decode(
51304
51305         *len = 0;
51306
51307 -       *octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
51308 +       *octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
51309         if (*octets == NULL) {
51310                 if (net_ratelimit())
51311                         printk("OOM in bsalg (%d)\n", __LINE__);
51312 diff -urNp linux-2.6.33/net/ipv4/tcp_ipv4.c linux-2.6.33/net/ipv4/tcp_ipv4.c
51313 --- linux-2.6.33/net/ipv4/tcp_ipv4.c    2010-02-24 13:52:17.000000000 -0500
51314 +++ linux-2.6.33/net/ipv4/tcp_ipv4.c    2010-03-07 12:23:36.169632867 -0500
51315 @@ -1585,6 +1585,9 @@ int tcp_v4_do_rcv(struct sock *sk, struc
51316         return 0;
51317
51318  reset:
51319 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51320 +       if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
51321 +#endif
51322         tcp_v4_send_reset(rsk, skb);
51323  discard:
51324         kfree_skb(skb);
51325 @@ -1693,6 +1696,9 @@ no_tcp_socket:
51326  bad_packet:
51327                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
51328         } else {
51329 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51330 +               if (skb->dev->flags & IFF_LOOPBACK)
51331 +#endif
51332                 tcp_v4_send_reset(NULL, skb);
51333         }
51334
51335 diff -urNp linux-2.6.33/net/ipv4/tcp_minisocks.c linux-2.6.33/net/ipv4/tcp_minisocks.c
51336 --- linux-2.6.33/net/ipv4/tcp_minisocks.c       2010-02-24 13:52:17.000000000 -0500
51337 +++ linux-2.6.33/net/ipv4/tcp_minisocks.c       2010-03-07 12:23:36.169632867 -0500
51338 @@ -698,8 +698,11 @@ listen_overflow:
51339
51340  embryonic_reset:
51341         NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
51342 +
51343 +#ifndef CONFIG_GRKERNSEC_BLACKHOLE
51344         if (!(flg & TCP_FLAG_RST))
51345                 req->rsk_ops->send_reset(sk, skb);
51346 +#endif
51347
51348         inet_csk_reqsk_queue_drop(sk, req, prev);
51349         return NULL;
51350 diff -urNp linux-2.6.33/net/ipv4/tcp_probe.c linux-2.6.33/net/ipv4/tcp_probe.c
51351 --- linux-2.6.33/net/ipv4/tcp_probe.c   2010-02-24 13:52:17.000000000 -0500
51352 +++ linux-2.6.33/net/ipv4/tcp_probe.c   2010-03-07 12:23:36.169632867 -0500
51353 @@ -201,7 +201,7 @@ static ssize_t tcpprobe_read(struct file
51354                 if (cnt + width >= len)
51355                         break;
51356
51357 -               if (copy_to_user(buf + cnt, tbuf, width))
51358 +               if (width > sizeof(tbuf) || copy_to_user(buf + cnt, tbuf, width))
51359                         return -EFAULT;
51360                 cnt += width;
51361         }
51362 diff -urNp linux-2.6.33/net/ipv4/udp.c linux-2.6.33/net/ipv4/udp.c
51363 --- linux-2.6.33/net/ipv4/udp.c 2010-02-24 13:52:17.000000000 -0500
51364 +++ linux-2.6.33/net/ipv4/udp.c 2010-03-07 12:23:36.169632867 -0500
51365 @@ -86,6 +86,7 @@
51366  #include <linux/types.h>
51367  #include <linux/fcntl.h>
51368  #include <linux/module.h>
51369 +#include <linux/security.h>
51370  #include <linux/socket.h>
51371  #include <linux/sockios.h>
51372  #include <linux/igmp.h>
51373 @@ -562,6 +563,9 @@ found:
51374         return s;
51375  }
51376
51377 +extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
51378 +extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
51379 +
51380  /*
51381   * This routine is called by the ICMP module when it gets some
51382   * sort of error condition.  If err < 0 then the socket should
51383 @@ -830,9 +834,18 @@ int udp_sendmsg(struct kiocb *iocb, stru
51384                 dport = usin->sin_port;
51385                 if (dport == 0)
51386                         return -EINVAL;
51387 +
51388 +               err = gr_search_udp_sendmsg(sk, usin);
51389 +               if (err)
51390 +                       return err;
51391         } else {
51392                 if (sk->sk_state != TCP_ESTABLISHED)
51393                         return -EDESTADDRREQ;
51394 +
51395 +               err = gr_search_udp_sendmsg(sk, NULL);
51396 +               if (err)
51397 +                       return err;
51398 +
51399                 daddr = inet->inet_daddr;
51400                 dport = inet->inet_dport;
51401                 /* Open fast path for connected socket.
51402 @@ -1137,6 +1150,10 @@ try_again:
51403         if (!skb)
51404                 goto out;
51405
51406 +       err = gr_search_udp_recvmsg(sk, skb);
51407 +       if (err)
51408 +               goto out_free;
51409 +
51410         ulen = skb->len - sizeof(struct udphdr);
51411         copied = len;
51412         if (copied > ulen)
51413 @@ -1568,6 +1585,9 @@ int __udp4_lib_rcv(struct sk_buff *skb,
51414                 goto csum_error;
51415
51416         UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
51417 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51418 +       if (skb->dev->flags & IFF_LOOPBACK)
51419 +#endif
51420         icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
51421
51422         /*
51423 diff -urNp linux-2.6.33/net/ipv6/exthdrs.c linux-2.6.33/net/ipv6/exthdrs.c
51424 --- linux-2.6.33/net/ipv6/exthdrs.c     2010-02-24 13:52:17.000000000 -0500
51425 +++ linux-2.6.33/net/ipv6/exthdrs.c     2010-03-07 12:23:36.169632867 -0500
51426 @@ -635,7 +635,7 @@ static struct tlvtype_proc tlvprochopopt
51427                 .type   = IPV6_TLV_JUMBO,
51428                 .func   = ipv6_hop_jumbo,
51429         },
51430 -       { -1, }
51431 +       { -1, NULL }
51432  };
51433
51434  int ipv6_parse_hopopts(struct sk_buff *skb)
51435 diff -urNp linux-2.6.33/net/ipv6/raw.c linux-2.6.33/net/ipv6/raw.c
51436 --- linux-2.6.33/net/ipv6/raw.c 2010-02-24 13:52:17.000000000 -0500
51437 +++ linux-2.6.33/net/ipv6/raw.c 2010-03-07 12:23:36.169632867 -0500
51438 @@ -597,7 +597,7 @@ out:
51439         return err;
51440  }
51441
51442 -static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
51443 +static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
51444                         struct flowi *fl, struct rt6_info *rt,
51445                         unsigned int flags)
51446  {
51447 diff -urNp linux-2.6.33/net/ipv6/tcp_ipv6.c linux-2.6.33/net/ipv6/tcp_ipv6.c
51448 --- linux-2.6.33/net/ipv6/tcp_ipv6.c    2010-02-24 13:52:17.000000000 -0500
51449 +++ linux-2.6.33/net/ipv6/tcp_ipv6.c    2010-03-07 12:23:36.169632867 -0500
51450 @@ -1625,6 +1625,9 @@ static int tcp_v6_do_rcv(struct sock *sk
51451         return 0;
51452
51453  reset:
51454 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51455 +       if (!skb->dev || (skb->dev->flags & IFF_LOOPBACK))
51456 +#endif
51457         tcp_v6_send_reset(sk, skb);
51458  discard:
51459         if (opt_skb)
51460 @@ -1747,6 +1750,9 @@ no_tcp_socket:
51461  bad_packet:
51462                 TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
51463         } else {
51464 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51465 +               if (skb->dev->flags & IFF_LOOPBACK)
51466 +#endif
51467                 tcp_v6_send_reset(NULL, skb);
51468         }
51469
51470 diff -urNp linux-2.6.33/net/ipv6/udp.c linux-2.6.33/net/ipv6/udp.c
51471 --- linux-2.6.33/net/ipv6/udp.c 2010-02-24 13:52:17.000000000 -0500
51472 +++ linux-2.6.33/net/ipv6/udp.c 2010-03-07 12:23:36.169632867 -0500
51473 @@ -745,6 +745,9 @@ int __udp6_lib_rcv(struct sk_buff *skb,
51474                 UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
51475                                 proto == IPPROTO_UDPLITE);
51476
51477 +#ifdef CONFIG_GRKERNSEC_BLACKHOLE
51478 +               if (skb->dev->flags & IFF_LOOPBACK)
51479 +#endif
51480                 icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
51481
51482                 kfree_skb(skb);
51483 diff -urNp linux-2.6.33/net/irda/ircomm/ircomm_tty.c linux-2.6.33/net/irda/ircomm/ircomm_tty.c
51484 --- linux-2.6.33/net/irda/ircomm/ircomm_tty.c   2010-02-24 13:52:17.000000000 -0500
51485 +++ linux-2.6.33/net/irda/ircomm/ircomm_tty.c   2010-03-07 12:23:36.173612095 -0500
51486 @@ -280,16 +280,16 @@ static int ircomm_tty_block_til_ready(st
51487         add_wait_queue(&self->open_wait, &wait);
51488
51489         IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
51490 -             __FILE__,__LINE__, tty->driver->name, self->open_count );
51491 +             __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
51492
51493         /* As far as I can see, we protect open_count - Jean II */
51494         spin_lock_irqsave(&self->spinlock, flags);
51495         if (!tty_hung_up_p(filp)) {
51496                 extra_count = 1;
51497 -               self->open_count--;
51498 +               atomic_dec(&self->open_count);
51499         }
51500         spin_unlock_irqrestore(&self->spinlock, flags);
51501 -       self->blocked_open++;
51502 +       atomic_inc(&self->blocked_open);
51503
51504         while (1) {
51505                 if (tty->termios->c_cflag & CBAUD) {
51506 @@ -329,7 +329,7 @@ static int ircomm_tty_block_til_ready(st
51507                 }
51508
51509                 IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
51510 -                     __FILE__,__LINE__, tty->driver->name, self->open_count );
51511 +                     __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count) );
51512
51513                 schedule();
51514         }
51515 @@ -340,13 +340,13 @@ static int ircomm_tty_block_til_ready(st
51516         if (extra_count) {
51517                 /* ++ is not atomic, so this should be protected - Jean II */
51518                 spin_lock_irqsave(&self->spinlock, flags);
51519 -               self->open_count++;
51520 +               atomic_inc(&self->open_count);
51521                 spin_unlock_irqrestore(&self->spinlock, flags);
51522         }
51523 -       self->blocked_open--;
51524 +       atomic_dec(&self->blocked_open);
51525
51526         IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
51527 -             __FILE__,__LINE__, tty->driver->name, self->open_count);
51528 +             __FILE__,__LINE__, tty->driver->name, atomic_read(&self->open_count));
51529
51530         if (!retval)
51531                 self->flags |= ASYNC_NORMAL_ACTIVE;
51532 @@ -415,14 +415,14 @@ static int ircomm_tty_open(struct tty_st
51533         }
51534         /* ++ is not atomic, so this should be protected - Jean II */
51535         spin_lock_irqsave(&self->spinlock, flags);
51536 -       self->open_count++;
51537 +       atomic_inc(&self->open_count);
51538
51539         tty->driver_data = self;
51540         self->tty = tty;
51541         spin_unlock_irqrestore(&self->spinlock, flags);
51542
51543         IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
51544 -                  self->line, self->open_count);
51545 +                  self->line, atomic_read(&self->open_count));
51546
51547         /* Not really used by us, but lets do it anyway */
51548         self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
51549 @@ -511,7 +511,7 @@ static void ircomm_tty_close(struct tty_
51550                 return;
51551         }
51552
51553 -       if ((tty->count == 1) && (self->open_count != 1)) {
51554 +       if ((tty->count == 1) && (atomic_read(&self->open_count) != 1)) {
51555                 /*
51556                  * Uh, oh.  tty->count is 1, which means that the tty
51557                  * structure will be freed.  state->count should always
51558 @@ -521,16 +521,16 @@ static void ircomm_tty_close(struct tty_
51559                  */
51560                 IRDA_DEBUG(0, "%s(), bad serial port count; "
51561                            "tty->count is 1, state->count is %d\n", __func__ ,
51562 -                          self->open_count);
51563 -               self->open_count = 1;
51564 +                          atomic_read(&self->open_count));
51565 +               atomic_set(&self->open_count, 1);
51566         }
51567
51568 -       if (--self->open_count < 0) {
51569 +       if (atomic_dec_return(&self->open_count) < 0) {
51570                 IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
51571 -                          __func__, self->line, self->open_count);
51572 -               self->open_count = 0;
51573 +                          __func__, self->line, atomic_read(&self->open_count));
51574 +               atomic_set(&self->open_count, 0);
51575         }
51576 -       if (self->open_count) {
51577 +       if (atomic_read(&self->open_count)) {
51578                 spin_unlock_irqrestore(&self->spinlock, flags);
51579
51580                 IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
51581 @@ -562,7 +562,7 @@ static void ircomm_tty_close(struct tty_
51582         tty->closing = 0;
51583         self->tty = NULL;
51584
51585 -       if (self->blocked_open) {
51586 +       if (atomic_read(&self->blocked_open)) {
51587                 if (self->close_delay)
51588                         schedule_timeout_interruptible(self->close_delay);
51589                 wake_up_interruptible(&self->open_wait);
51590 @@ -1017,7 +1017,7 @@ static void ircomm_tty_hangup(struct tty
51591         spin_lock_irqsave(&self->spinlock, flags);
51592         self->flags &= ~ASYNC_NORMAL_ACTIVE;
51593         self->tty = NULL;
51594 -       self->open_count = 0;
51595 +       atomic_set(&self->open_count, 0);
51596         spin_unlock_irqrestore(&self->spinlock, flags);
51597
51598         wake_up_interruptible(&self->open_wait);
51599 @@ -1369,7 +1369,7 @@ static void ircomm_tty_line_info(struct
51600         seq_putc(m, '\n');
51601
51602         seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
51603 -       seq_printf(m, "Open count: %d\n", self->open_count);
51604 +       seq_printf(m, "Open count: %d\n", atomic_read(&self->open_count));
51605         seq_printf(m, "Max data size: %d\n", self->max_data_size);
51606         seq_printf(m, "Max header size: %d\n", self->max_header_size);
51607
51608 diff -urNp linux-2.6.33/net/mac80211/ieee80211_i.h linux-2.6.33/net/mac80211/ieee80211_i.h
51609 --- linux-2.6.33/net/mac80211/ieee80211_i.h     2010-02-24 13:52:17.000000000 -0500
51610 +++ linux-2.6.33/net/mac80211/ieee80211_i.h     2010-03-07 12:23:36.173612095 -0500
51611 @@ -574,7 +574,7 @@ struct ieee80211_local {
51612         /* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
51613         spinlock_t queue_stop_reason_lock;
51614
51615 -       int open_count;
51616 +       atomic_t open_count;
51617         int monitors, cooked_mntrs;
51618         /* number of interfaces with corresponding FIF_ flags */
51619         int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
51620 diff -urNp linux-2.6.33/net/mac80211/iface.c linux-2.6.33/net/mac80211/iface.c
51621 --- linux-2.6.33/net/mac80211/iface.c   2010-02-24 13:52:17.000000000 -0500
51622 +++ linux-2.6.33/net/mac80211/iface.c   2010-03-07 12:23:36.173612095 -0500
51623 @@ -166,7 +166,7 @@ static int ieee80211_open(struct net_dev
51624                 break;
51625         }
51626
51627 -       if (local->open_count == 0) {
51628 +       if (atomic_read(&local->open_count) == 0) {
51629                 res = drv_start(local);
51630                 if (res)
51631                         goto err_del_bss;
51632 @@ -198,7 +198,7 @@ static int ieee80211_open(struct net_dev
51633          * Validate the MAC address for this device.
51634          */
51635         if (!is_valid_ether_addr(dev->dev_addr)) {
51636 -               if (!local->open_count)
51637 +               if (!atomic_read(&local->open_count))
51638                         drv_stop(local);
51639                 return -EADDRNOTAVAIL;
51640         }
51641 @@ -294,7 +294,7 @@ static int ieee80211_open(struct net_dev
51642
51643         hw_reconf_flags |= __ieee80211_recalc_idle(local);
51644
51645 -       local->open_count++;
51646 +       atomic_inc(&local->open_count);
51647         if (hw_reconf_flags) {
51648                 ieee80211_hw_config(local, hw_reconf_flags);
51649                 /*
51650 @@ -322,7 +322,7 @@ static int ieee80211_open(struct net_dev
51651   err_del_interface:
51652         drv_remove_interface(local, &conf);
51653   err_stop:
51654 -       if (!local->open_count)
51655 +       if (!atomic_read(&local->open_count))
51656                 drv_stop(local);
51657   err_del_bss:
51658         sdata->bss = NULL;
51659 @@ -422,7 +422,7 @@ static int ieee80211_stop(struct net_dev
51660                 WARN_ON(!list_empty(&sdata->u.ap.vlans));
51661         }
51662
51663 -       local->open_count--;
51664 +       atomic_dec(&local->open_count);
51665
51666         switch (sdata->vif.type) {
51667         case NL80211_IFTYPE_AP_VLAN:
51668 @@ -528,7 +528,7 @@ static int ieee80211_stop(struct net_dev
51669
51670         ieee80211_recalc_ps(local, -1);
51671
51672 -       if (local->open_count == 0) {
51673 +       if (atomic_read(&local->open_count) == 0) {
51674                 ieee80211_clear_tx_pending(local);
51675                 ieee80211_stop_device(local);
51676
51677 diff -urNp linux-2.6.33/net/mac80211/main.c linux-2.6.33/net/mac80211/main.c
51678 --- linux-2.6.33/net/mac80211/main.c    2010-02-24 13:52:17.000000000 -0500
51679 +++ linux-2.6.33/net/mac80211/main.c    2010-03-07 12:23:36.173612095 -0500
51680 @@ -129,7 +129,7 @@ int ieee80211_hw_config(struct ieee80211
51681                 local->hw.conf.power_level = power;
51682         }
51683
51684 -       if (changed && local->open_count) {
51685 +       if (changed && atomic_read(&local->open_count)) {
51686                 ret = drv_config(local, changed);
51687                 /*
51688                  * Goal:
51689 diff -urNp linux-2.6.33/net/mac80211/pm.c linux-2.6.33/net/mac80211/pm.c
51690 --- linux-2.6.33/net/mac80211/pm.c      2010-02-24 13:52:17.000000000 -0500
51691 +++ linux-2.6.33/net/mac80211/pm.c      2010-03-07 12:23:36.173612095 -0500
51692 @@ -107,7 +107,7 @@ int __ieee80211_suspend(struct ieee80211
51693         }
51694
51695         /* stop hardware - this must stop RX */
51696 -       if (local->open_count)
51697 +       if (atomic_read(&local->open_count))
51698                 ieee80211_stop_device(local);
51699
51700         local->suspended = true;
51701 diff -urNp linux-2.6.33/net/mac80211/rate.c linux-2.6.33/net/mac80211/rate.c
51702 --- linux-2.6.33/net/mac80211/rate.c    2010-02-24 13:52:17.000000000 -0500
51703 +++ linux-2.6.33/net/mac80211/rate.c    2010-03-07 12:23:36.173612095 -0500
51704 @@ -288,7 +288,7 @@ int ieee80211_init_rate_ctrl_alg(struct
51705
51706         ASSERT_RTNL();
51707
51708 -       if (local->open_count)
51709 +       if (atomic_read(&local->open_count))
51710                 return -EBUSY;
51711
51712         if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
51713 diff -urNp linux-2.6.33/net/mac80211/rc80211_pid_debugfs.c linux-2.6.33/net/mac80211/rc80211_pid_debugfs.c
51714 --- linux-2.6.33/net/mac80211/rc80211_pid_debugfs.c     2010-02-24 13:52:17.000000000 -0500
51715 +++ linux-2.6.33/net/mac80211/rc80211_pid_debugfs.c     2010-03-07 12:23:36.173612095 -0500
51716 @@ -191,7 +191,7 @@ static ssize_t rate_control_pid_events_r
51717
51718         spin_unlock_irqrestore(&events->lock, status);
51719
51720 -       if (copy_to_user(buf, pb, p))
51721 +       if (p > sizeof(pb) || copy_to_user(buf, pb, p))
51722                 return -EFAULT;
51723
51724         return p;
51725 diff -urNp linux-2.6.33/net/mac80211/util.c linux-2.6.33/net/mac80211/util.c
51726 --- linux-2.6.33/net/mac80211/util.c    2010-02-24 13:52:17.000000000 -0500
51727 +++ linux-2.6.33/net/mac80211/util.c    2010-03-07 12:23:36.173612095 -0500
51728 @@ -1050,14 +1050,14 @@ int ieee80211_reconfig(struct ieee80211_
51729                 local->resuming = true;
51730
51731         /* restart hardware */
51732 -       if (local->open_count) {
51733 +       if (atomic_read(&local->open_count)) {
51734                 /*
51735                  * Upon resume hardware can sometimes be goofy due to
51736                  * various platform / driver / bus issues, so restarting
51737                  * the device may at times not work immediately. Propagate
51738                  * the error.
51739                  */
51740 -               res = drv_start(local);
51741 +                res = drv_start(local);
51742                 if (res) {
51743                         WARN(local->suspended, "Harware became unavailable "
51744                              "upon resume. This is could be a software issue"
51745 diff -urNp linux-2.6.33/net/packet/af_packet.c linux-2.6.33/net/packet/af_packet.c
51746 --- linux-2.6.33/net/packet/af_packet.c 2010-02-24 13:52:17.000000000 -0500
51747 +++ linux-2.6.33/net/packet/af_packet.c 2010-03-07 12:23:36.173612095 -0500
51748 @@ -1886,7 +1886,7 @@ static int packet_getsockopt(struct sock
51749         case PACKET_HDRLEN:
51750                 if (len > sizeof(int))
51751                         len = sizeof(int);
51752 -               if (copy_from_user(&val, optval, len))
51753 +               if (len > sizeof(val) || copy_from_user(&val, optval, len))
51754                         return -EFAULT;
51755                 switch (val) {
51756                 case TPACKET_V1:
51757 @@ -1919,7 +1919,7 @@ static int packet_getsockopt(struct sock
51758
51759         if (put_user(len, optlen))
51760                 return -EFAULT;
51761 -       if (copy_to_user(optval, data, len))
51762 +       if (len > sizeof(st) || copy_to_user(optval, data, len))
51763                 return -EFAULT;
51764         return 0;
51765  }
51766 diff -urNp linux-2.6.33/net/sctp/socket.c linux-2.6.33/net/sctp/socket.c
51767 --- linux-2.6.33/net/sctp/socket.c      2010-02-24 13:52:17.000000000 -0500
51768 +++ linux-2.6.33/net/sctp/socket.c      2010-03-07 12:23:36.173612095 -0500
51769 @@ -1482,7 +1482,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
51770         struct sctp_sndrcvinfo *sinfo;
51771         struct sctp_initmsg *sinit;
51772         sctp_assoc_t associd = 0;
51773 -       sctp_cmsgs_t cmsgs = { NULL };
51774 +       sctp_cmsgs_t cmsgs = { NULL, NULL };
51775         int err;
51776         sctp_scope_t scope;
51777         long timeo;
51778 @@ -4386,7 +4386,7 @@ static int sctp_getsockopt_peer_addrs(st
51779                 addrlen = sctp_get_af_specific(sk->sk_family)->sockaddr_len;
51780                 if (space_left < addrlen)
51781                         return -ENOMEM;
51782 -               if (copy_to_user(to, &temp, addrlen))
51783 +               if (addrlen > sizeof(temp) || copy_to_user(to, &temp, addrlen))
51784                         return -EFAULT;
51785                 to += addrlen;
51786                 cnt++;
51787 @@ -5478,7 +5478,6 @@ pp_found:
51788                  */
51789                 int reuse = sk->sk_reuse;
51790                 struct sock *sk2;
51791 -               struct hlist_node *node;
51792
51793                 SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
51794                 if (pp->fastreuse && sk->sk_reuse &&
51795 diff -urNp linux-2.6.33/net/socket.c linux-2.6.33/net/socket.c
51796 --- linux-2.6.33/net/socket.c   2010-02-24 13:52:17.000000000 -0500
51797 +++ linux-2.6.33/net/socket.c   2010-03-07 12:23:36.173612095 -0500
51798 @@ -87,6 +87,7 @@
51799  #include <linux/wireless.h>
51800  #include <linux/nsproxy.h>
51801  #include <linux/magic.h>
51802 +#include <linux/in.h>
51803
51804  #include <asm/uaccess.h>
51805  #include <asm/unistd.h>
51806 @@ -103,6 +104,8 @@
51807  #include <linux/sockios.h>
51808  #include <linux/atalk.h>
51809
51810 +#include <linux/grsock.h>
51811 +
51812  static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
51813  static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
51814                          unsigned long nr_segs, loff_t pos);
51815 @@ -304,7 +307,7 @@ static int sockfs_get_sb(struct file_sys
51816                              mnt);
51817  }
51818
51819 -static struct vfsmount *sock_mnt __read_mostly;
51820 +struct vfsmount *sock_mnt __read_mostly;
51821
51822  static struct file_system_type sock_fs_type = {
51823         .name =         "sockfs",
51824 @@ -1310,6 +1313,16 @@ SYSCALL_DEFINE3(socket, int, family, int
51825         if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
51826                 flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
51827
51828 +       if(!gr_search_socket(family, type, protocol)) {
51829 +               retval = -EACCES;
51830 +               goto out;
51831 +       }
51832 +
51833 +       if (gr_handle_sock_all(family, type, protocol)) {
51834 +               retval = -EACCES;
51835 +               goto out;
51836 +       }
51837 +
51838         retval = sock_create(family, type, protocol, &sock);
51839         if (retval < 0)
51840                 goto out;
51841 @@ -1422,6 +1435,14 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
51842         if (sock) {
51843                 err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
51844                 if (err >= 0) {
51845 +                       if (gr_handle_sock_server((struct sockaddr *)&address)) {
51846 +                               err = -EACCES;
51847 +                               goto error;
51848 +                       }
51849 +                       err = gr_search_bind(sock, (struct sockaddr_in *)&address);
51850 +                       if (err)
51851 +                               goto error;
51852 +
51853                         err = security_socket_bind(sock,
51854                                                    (struct sockaddr *)&address,
51855                                                    addrlen);
51856 @@ -1430,6 +1451,7 @@ SYSCALL_DEFINE3(bind, int, fd, struct so
51857                                                       (struct sockaddr *)
51858                                                       &address, addrlen);
51859                 }
51860 +error:
51861                 fput_light(sock->file, fput_needed);
51862         }
51863         return err;
51864 @@ -1453,10 +1475,20 @@ SYSCALL_DEFINE2(listen, int, fd, int, ba
51865                 if ((unsigned)backlog > somaxconn)
51866                         backlog = somaxconn;
51867
51868 +               if (gr_handle_sock_server_other(sock)) {
51869 +                       err = -EPERM;
51870 +                       goto error;
51871 +               }
51872 +
51873 +               err = gr_search_listen(sock);
51874 +               if (err)
51875 +                       goto error;
51876 +
51877                 err = security_socket_listen(sock, backlog);
51878                 if (!err)
51879                         err = sock->ops->listen(sock, backlog);
51880
51881 +error:
51882                 fput_light(sock->file, fput_needed);
51883         }
51884         return err;
51885 @@ -1499,6 +1531,18 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
51886         newsock->type = sock->type;
51887         newsock->ops = sock->ops;
51888
51889 +       if (gr_handle_sock_server_other(sock)) {
51890 +               err = -EPERM;
51891 +               sock_release(newsock);
51892 +               goto out_put;
51893 +       }
51894 +
51895 +       err = gr_search_accept(sock);
51896 +       if (err) {
51897 +               sock_release(newsock);
51898 +               goto out_put;
51899 +       }
51900 +
51901         /*
51902          * We don't need try_module_get here, as the listening socket (sock)
51903          * has the protocol module (sock->ops->owner) held.
51904 @@ -1537,6 +1581,8 @@ SYSCALL_DEFINE4(accept4, int, fd, struct
51905         fd_install(newfd, newfile);
51906         err = newfd;
51907
51908 +       gr_attach_curr_ip(newsock->sk);
51909 +
51910  out_put:
51911         fput_light(sock->file, fput_needed);
51912  out:
51913 @@ -1569,6 +1615,7 @@ SYSCALL_DEFINE3(connect, int, fd, struct
51914                 int, addrlen)
51915  {
51916         struct socket *sock;
51917 +       struct sockaddr *sck;
51918         struct sockaddr_storage address;
51919         int err, fput_needed;
51920
51921 @@ -1579,6 +1626,17 @@ SYSCALL_DEFINE3(connect, int, fd, struct
51922         if (err < 0)
51923                 goto out_put;
51924
51925 +       sck = (struct sockaddr *)&address;
51926 +
51927 +       if (gr_handle_sock_client(sck)) {
51928 +               err = -EACCES;
51929 +               goto out_put;
51930 +       }
51931 +
51932 +       err = gr_search_connect(sock, (struct sockaddr_in *)sck);
51933 +       if (err)
51934 +               goto out_put;
51935 +
51936         err =
51937             security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
51938         if (err)
51939 diff -urNp linux-2.6.33/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.33/net/sunrpc/xprtrdma/svc_rdma.c
51940 --- linux-2.6.33/net/sunrpc/xprtrdma/svc_rdma.c 2010-02-24 13:52:17.000000000 -0500
51941 +++ linux-2.6.33/net/sunrpc/xprtrdma/svc_rdma.c 2010-03-07 12:23:36.173612095 -0500
51942 @@ -105,7 +105,7 @@ static int read_reset_stat(ctl_table *ta
51943                 len -= *ppos;
51944                 if (len > *lenp)
51945                         len = *lenp;
51946 -               if (len && copy_to_user(buffer, str_buf, len))
51947 +               if (len > sizeof(str_buf) || (len && copy_to_user(buffer, str_buf, len)))
51948                         return -EFAULT;
51949                 *lenp = len;
51950                 *ppos += len;
51951 diff -urNp linux-2.6.33/net/sysctl_net.c linux-2.6.33/net/sysctl_net.c
51952 --- linux-2.6.33/net/sysctl_net.c       2010-02-24 13:52:17.000000000 -0500
51953 +++ linux-2.6.33/net/sysctl_net.c       2010-03-07 12:23:36.173612095 -0500
51954 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
51955                                struct ctl_table *table)
51956  {
51957         /* Allow network administrator to have same access as root. */
51958 -       if (capable(CAP_NET_ADMIN)) {
51959 +       if (capable_nolog(CAP_NET_ADMIN)) {
51960                 int mode = (table->mode >> 6) & 7;
51961                 return (mode << 6) | (mode << 3) | mode;
51962         }
51963 diff -urNp linux-2.6.33/net/unix/af_unix.c linux-2.6.33/net/unix/af_unix.c
51964 --- linux-2.6.33/net/unix/af_unix.c     2010-02-24 13:52:17.000000000 -0500
51965 +++ linux-2.6.33/net/unix/af_unix.c     2010-03-07 12:23:36.177657977 -0500
51966 @@ -735,6 +735,12 @@ static struct sock *unix_find_other(stru
51967                 err = -ECONNREFUSED;
51968                 if (!S_ISSOCK(inode->i_mode))
51969                         goto put_fail;
51970 +
51971 +               if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
51972 +                       err = -EACCES;
51973 +                       goto put_fail;
51974 +               }
51975 +
51976                 u = unix_find_socket_byinode(net, inode);
51977                 if (!u)
51978                         goto put_fail;
51979 @@ -755,6 +761,13 @@ static struct sock *unix_find_other(stru
51980                 if (u) {
51981                         struct dentry *dentry;
51982                         dentry = unix_sk(u)->dentry;
51983 +
51984 +                       if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
51985 +                               err = -EPERM;
51986 +                               sock_put(u);
51987 +                               goto fail;
51988 +                       }
51989 +
51990                         if (dentry)
51991                                 touch_atime(unix_sk(u)->mnt, dentry);
51992                 } else
51993 @@ -840,11 +853,18 @@ static int unix_bind(struct socket *sock
51994                 err = security_path_mknod(&nd.path, dentry, mode, 0);
51995                 if (err)
51996                         goto out_mknod_drop_write;
51997 +               if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
51998 +                       err = -EACCES;
51999 +                       goto out_mknod_drop_write;
52000 +               }
52001                 err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
52002  out_mknod_drop_write:
52003                 mnt_drop_write(nd.path.mnt);
52004                 if (err)
52005                         goto out_mknod_dput;
52006 +
52007 +               gr_handle_create(dentry, nd.path.mnt);
52008 +
52009                 mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
52010                 dput(nd.path.dentry);
52011                 nd.path.dentry = dentry;
52012 @@ -862,6 +882,10 @@ out_mknod_drop_write:
52013                         goto out_unlock;
52014                 }
52015
52016 +#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
52017 +               sk->sk_peercred.pid = current->pid;
52018 +#endif
52019 +
52020                 list = &unix_socket_table[addr->hash];
52021         } else {
52022                 list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
52023 diff -urNp linux-2.6.33/samples/kobject/kset-example.c linux-2.6.33/samples/kobject/kset-example.c
52024 --- linux-2.6.33/samples/kobject/kset-example.c 2010-02-24 13:52:17.000000000 -0500
52025 +++ linux-2.6.33/samples/kobject/kset-example.c 2010-03-07 12:23:36.177657977 -0500
52026 @@ -87,7 +87,7 @@ static ssize_t foo_attr_store(struct kob
52027  }
52028
52029  /* Our custom sysfs_ops that we will associate with our ktype later on */
52030 -static struct sysfs_ops foo_sysfs_ops = {
52031 +static const struct sysfs_ops foo_sysfs_ops = {
52032         .show = foo_attr_show,
52033         .store = foo_attr_store,
52034  };
52035 diff -urNp linux-2.6.33/scripts/basic/fixdep.c linux-2.6.33/scripts/basic/fixdep.c
52036 --- linux-2.6.33/scripts/basic/fixdep.c 2010-02-24 13:52:17.000000000 -0500
52037 +++ linux-2.6.33/scripts/basic/fixdep.c 2010-03-07 12:23:36.177657977 -0500
52038 @@ -222,9 +222,9 @@ static void use_config(char *m, int slen
52039
52040  static void parse_config_file(char *map, size_t len)
52041  {
52042 -       int *end = (int *) (map + len);
52043 +       unsigned int *end = (unsigned int *) (map + len);
52044         /* start at +1, so that p can never be < map */
52045 -       int *m   = (int *) map + 1;
52046 +       unsigned int *m   = (unsigned int *) map + 1;
52047         char *p, *q;
52048
52049         for (; m < end; m++) {
52050 @@ -371,7 +371,7 @@ static void print_deps(void)
52051  static void traps(void)
52052  {
52053         static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
52054 -       int *p = (int *)test;
52055 +       unsigned int *p = (unsigned int *)test;
52056
52057         if (*p != INT_CONF) {
52058                 fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
52059 diff -urNp linux-2.6.33/scripts/kallsyms.c linux-2.6.33/scripts/kallsyms.c
52060 --- linux-2.6.33/scripts/kallsyms.c     2010-02-24 13:52:17.000000000 -0500
52061 +++ linux-2.6.33/scripts/kallsyms.c     2010-03-07 12:23:36.177657977 -0500
52062 @@ -43,10 +43,10 @@ struct text_range {
52063
52064  static unsigned long long _text;
52065  static struct text_range text_ranges[] = {
52066 -       { "_stext",     "_etext"     },
52067 -       { "_sinittext", "_einittext" },
52068 -       { "_stext_l1",  "_etext_l1"  }, /* Blackfin on-chip L1 inst SRAM */
52069 -       { "_stext_l2",  "_etext_l2"  }, /* Blackfin on-chip L2 SRAM */
52070 +       { "_stext",     "_etext",     0, 0 },
52071 +       { "_sinittext", "_einittext", 0, 0 },
52072 +       { "_stext_l1",  "_etext_l1",  0, 0 },   /* Blackfin on-chip L1 inst SRAM */
52073 +       { "_stext_l2",  "_etext_l2",  0, 0 },   /* Blackfin on-chip L2 SRAM */
52074  };
52075  #define text_range_text     (&text_ranges[0])
52076  #define text_range_inittext (&text_ranges[1])
52077 diff -urNp linux-2.6.33/scripts/mod/file2alias.c linux-2.6.33/scripts/mod/file2alias.c
52078 --- linux-2.6.33/scripts/mod/file2alias.c       2010-02-24 13:52:17.000000000 -0500
52079 +++ linux-2.6.33/scripts/mod/file2alias.c       2010-03-07 12:23:36.177657977 -0500
52080 @@ -72,7 +72,7 @@ static void device_id_check(const char *
52081                             unsigned long size, unsigned long id_size,
52082                             void *symval)
52083  {
52084 -       int i;
52085 +       unsigned int i;
52086
52087         if (size % id_size || size < id_size) {
52088                 if (cross_build != 0)
52089 @@ -102,7 +102,7 @@ static void device_id_check(const char *
52090  /* USB is special because the bcdDevice can be matched against a numeric range */
52091  /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
52092  static void do_usb_entry(struct usb_device_id *id,
52093 -                        unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
52094 +                        unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
52095                          unsigned char range_lo, unsigned char range_hi,
52096                          unsigned char max, struct module *mod)
52097  {
52098 @@ -437,7 +437,7 @@ static void do_pnp_device_entry(void *sy
52099         for (i = 0; i < count; i++) {
52100                 const char *id = (char *)devs[i].id;
52101                 char acpi_id[sizeof(devs[0].id)];
52102 -               int j;
52103 +               unsigned int j;
52104
52105                 buf_printf(&mod->dev_table_buf,
52106                            "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
52107 @@ -467,7 +467,7 @@ static void do_pnp_card_entries(void *sy
52108
52109                 for (j = 0; j < PNP_MAX_DEVICES; j++) {
52110                         const char *id = (char *)card->devs[j].id;
52111 -                       int i2, j2;
52112 +                       unsigned int i2, j2;
52113                         int dup = 0;
52114
52115                         if (!id[0])
52116 @@ -493,7 +493,7 @@ static void do_pnp_card_entries(void *sy
52117                         /* add an individual alias for every device entry */
52118                         if (!dup) {
52119                                 char acpi_id[sizeof(card->devs[0].id)];
52120 -                               int k;
52121 +                               unsigned int k;
52122
52123                                 buf_printf(&mod->dev_table_buf,
52124                                            "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
52125 @@ -768,7 +768,7 @@ static void dmi_ascii_filter(char *d, co
52126  static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
52127                         char *alias)
52128  {
52129 -       int i, j;
52130 +       unsigned int i, j;
52131
52132         sprintf(alias, "dmi*");
52133
52134 diff -urNp linux-2.6.33/scripts/mod/modpost.c linux-2.6.33/scripts/mod/modpost.c
52135 --- linux-2.6.33/scripts/mod/modpost.c  2010-02-24 13:52:17.000000000 -0500
52136 +++ linux-2.6.33/scripts/mod/modpost.c  2010-03-07 12:23:36.177657977 -0500
52137 @@ -842,6 +842,7 @@ enum mismatch {
52138         INIT_TO_EXIT,
52139         EXIT_TO_INIT,
52140         EXPORT_TO_INIT_EXIT,
52141 +       DATA_TO_TEXT
52142  };
52143
52144  struct sectioncheck {
52145 @@ -927,6 +928,12 @@ const struct sectioncheck sectioncheck[]
52146         .fromsec = { "__ksymtab*", NULL },
52147         .tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
52148         .mismatch = EXPORT_TO_INIT_EXIT
52149 +},
52150 +/* Do not reference code from writable data */
52151 +{
52152 +       .fromsec = { DATA_SECTIONS, NULL },
52153 +       .tosec   = { TEXT_SECTIONS, NULL },
52154 +       .mismatch = DATA_TO_TEXT
52155  }
52156  };
52157
52158 @@ -1031,10 +1038,10 @@ static Elf_Sym *find_elf_symbol(struct e
52159                         continue;
52160                 if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
52161                         continue;
52162 -               if (sym->st_value == addr)
52163 -                       return sym;
52164                 /* Find a symbol nearby - addr are maybe negative */
52165                 d = sym->st_value - addr;
52166 +               if (d == 0)
52167 +                       return sym;
52168                 if (d < 0)
52169                         d = addr - sym->st_value;
52170                 if (d < distance) {
52171 @@ -1275,6 +1282,14 @@ static void report_sec_mismatch(const ch
52172                 "Fix this by removing the %sannotation of %s "
52173                 "or drop the export.\n",
52174                 tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
52175 +       case DATA_TO_TEXT:
52176 +/*
52177 +               fprintf(stderr,
52178 +               "The variable %s references\n"
52179 +               "the %s %s%s%s\n",
52180 +               fromsym, to, sec2annotation(tosec), tosym, to_p);
52181 +*/
52182 +               break;
52183         case NO_MISMATCH:
52184                 /* To get warnings on missing members */
52185                 break;
52186 @@ -1600,7 +1615,7 @@ void __attribute__((format(printf, 2, 3)
52187         va_end(ap);
52188  }
52189
52190 -void buf_write(struct buffer *buf, const char *s, int len)
52191 +void buf_write(struct buffer *buf, const char *s, unsigned int len)
52192  {
52193         if (buf->size - buf->pos < len) {
52194                 buf->size += len + SZ;
52195 @@ -1812,7 +1827,7 @@ static void write_if_changed(struct buff
52196         if (fstat(fileno(file), &st) < 0)
52197                 goto close_write;
52198
52199 -       if (st.st_size != b->pos)
52200 +       if (st.st_size != (off_t)b->pos)
52201                 goto close_write;
52202
52203         tmp = NOFAIL(malloc(b->pos));
52204 diff -urNp linux-2.6.33/scripts/mod/modpost.h linux-2.6.33/scripts/mod/modpost.h
52205 --- linux-2.6.33/scripts/mod/modpost.h  2010-02-24 13:52:17.000000000 -0500
52206 +++ linux-2.6.33/scripts/mod/modpost.h  2010-03-07 12:23:36.177657977 -0500
52207 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
52208
52209  struct buffer {
52210         char *p;
52211 -       int pos;
52212 -       int size;
52213 +       unsigned int pos;
52214 +       unsigned int size;
52215  };
52216
52217  void __attribute__((format(printf, 2, 3)))
52218  buf_printf(struct buffer *buf, const char *fmt, ...);
52219
52220  void
52221 -buf_write(struct buffer *buf, const char *s, int len);
52222 +buf_write(struct buffer *buf, const char *s, unsigned int len);
52223
52224  struct module {
52225         struct module *next;
52226 diff -urNp linux-2.6.33/scripts/mod/sumversion.c linux-2.6.33/scripts/mod/sumversion.c
52227 --- linux-2.6.33/scripts/mod/sumversion.c       2010-02-24 13:52:17.000000000 -0500
52228 +++ linux-2.6.33/scripts/mod/sumversion.c       2010-03-07 12:23:36.177657977 -0500
52229 @@ -455,7 +455,7 @@ static void write_version(const char *fi
52230                 goto out;
52231         }
52232
52233 -       if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
52234 +       if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
52235                 warn("writing sum in %s failed: %s\n",
52236                         filename, strerror(errno));
52237                 goto out;
52238 diff -urNp linux-2.6.33/scripts/pnmtologo.c linux-2.6.33/scripts/pnmtologo.c
52239 --- linux-2.6.33/scripts/pnmtologo.c    2010-02-24 13:52:17.000000000 -0500
52240 +++ linux-2.6.33/scripts/pnmtologo.c    2010-03-07 12:23:36.177657977 -0500
52241 @@ -237,14 +237,14 @@ static void write_header(void)
52242      fprintf(out, " *  Linux logo %s\n", logoname);
52243      fputs(" */\n\n", out);
52244      fputs("#include <linux/linux_logo.h>\n\n", out);
52245 -    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
52246 +    fprintf(out, "static unsigned char %s_data[] = {\n",
52247             logoname);
52248  }
52249
52250  static void write_footer(void)
52251  {
52252      fputs("\n};\n\n", out);
52253 -    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
52254 +    fprintf(out, "const struct linux_logo %s = {\n", logoname);
52255      fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
52256      fprintf(out, "\t.width\t\t= %d,\n", logo_width);
52257      fprintf(out, "\t.height\t\t= %d,\n", logo_height);
52258 @@ -374,7 +374,7 @@ static void write_logo_clut224(void)
52259      fputs("\n};\n\n", out);
52260
52261      /* write logo clut */
52262 -    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
52263 +    fprintf(out, "static unsigned char %s_clut[] = {\n",
52264             logoname);
52265      write_hex_cnt = 0;
52266      for (i = 0; i < logo_clutsize; i++) {
52267 diff -urNp linux-2.6.33/security/commoncap.c linux-2.6.33/security/commoncap.c
52268 --- linux-2.6.33/security/commoncap.c   2010-02-24 13:52:17.000000000 -0500
52269 +++ linux-2.6.33/security/commoncap.c   2010-03-07 12:23:36.177657977 -0500
52270 @@ -27,7 +27,7 @@
52271  #include <linux/sched.h>
52272  #include <linux/prctl.h>
52273  #include <linux/securebits.h>
52274 -
52275 +#include <net/sock.h>
52276  /*
52277   * If a non-root user executes a setuid-root binary in
52278   * !secure(SECURE_NOROOT) mode, then we raise capabilities.
52279 @@ -50,9 +50,11 @@ static void warn_setuid_and_fcaps_mixed(
52280         }
52281  }
52282
52283 +extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
52284 +
52285  int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
52286  {
52287 -       NETLINK_CB(skb).eff_cap = current_cap();
52288 +       NETLINK_CB(skb).eff_cap = gr_cap_rtnetlink(sk);
52289         return 0;
52290  }
52291
52292 diff -urNp linux-2.6.33/security/integrity/ima/ima_api.c linux-2.6.33/security/integrity/ima/ima_api.c
52293 --- linux-2.6.33/security/integrity/ima/ima_api.c       2010-02-24 13:52:17.000000000 -0500
52294 +++ linux-2.6.33/security/integrity/ima/ima_api.c       2010-03-07 12:23:36.177657977 -0500
52295 @@ -74,7 +74,7 @@ void ima_add_violation(struct inode *ino
52296         int result;
52297
52298         /* can overflow, only indicator */
52299 -       atomic_long_inc(&ima_htable.violations);
52300 +       atomic_long_inc_unchecked(&ima_htable.violations);
52301
52302         entry = kmalloc(sizeof(*entry), GFP_KERNEL);
52303         if (!entry) {
52304 diff -urNp linux-2.6.33/security/integrity/ima/ima_fs.c linux-2.6.33/security/integrity/ima/ima_fs.c
52305 --- linux-2.6.33/security/integrity/ima/ima_fs.c        2010-02-24 13:52:17.000000000 -0500
52306 +++ linux-2.6.33/security/integrity/ima/ima_fs.c        2010-03-07 12:23:36.177657977 -0500
52307 @@ -27,12 +27,12 @@
52308  static int valid_policy = 1;
52309  #define TMPBUFLEN 12
52310  static ssize_t ima_show_htable_value(char __user *buf, size_t count,
52311 -                                    loff_t *ppos, atomic_long_t *val)
52312 +                                    loff_t *ppos, atomic_long_unchecked_t *val)
52313  {
52314         char tmpbuf[TMPBUFLEN];
52315         ssize_t len;
52316
52317 -       len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
52318 +       len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
52319         return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
52320  }
52321
52322 diff -urNp linux-2.6.33/security/integrity/ima/ima.h linux-2.6.33/security/integrity/ima/ima.h
52323 --- linux-2.6.33/security/integrity/ima/ima.h   2010-02-24 13:52:17.000000000 -0500
52324 +++ linux-2.6.33/security/integrity/ima/ima.h   2010-03-07 12:23:36.177657977 -0500
52325 @@ -83,8 +83,8 @@ void ima_add_violation(struct inode *ino
52326  extern spinlock_t ima_queue_lock;
52327
52328  struct ima_h_table {
52329 -       atomic_long_t len;      /* number of stored measurements in the list */
52330 -       atomic_long_t violations;
52331 +       atomic_long_unchecked_t len;    /* number of stored measurements in the list */
52332 +       atomic_long_unchecked_t violations;
52333         struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
52334  };
52335  extern struct ima_h_table ima_htable;
52336 diff -urNp linux-2.6.33/security/integrity/ima/ima_queue.c linux-2.6.33/security/integrity/ima/ima_queue.c
52337 --- linux-2.6.33/security/integrity/ima/ima_queue.c     2010-02-24 13:52:17.000000000 -0500
52338 +++ linux-2.6.33/security/integrity/ima/ima_queue.c     2010-03-07 12:23:36.177657977 -0500
52339 @@ -78,7 +78,7 @@ static int ima_add_digest_entry(struct i
52340         INIT_LIST_HEAD(&qe->later);
52341         list_add_tail_rcu(&qe->later, &ima_measurements);
52342
52343 -       atomic_long_inc(&ima_htable.len);
52344 +       atomic_long_inc_unchecked(&ima_htable.len);
52345         key = ima_hash_key(entry->digest);
52346         hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
52347         return 0;
52348 diff -urNp linux-2.6.33/security/Kconfig linux-2.6.33/security/Kconfig
52349 --- linux-2.6.33/security/Kconfig       2010-02-24 13:52:17.000000000 -0500
52350 +++ linux-2.6.33/security/Kconfig       2010-03-07 12:23:36.177657977 -0500
52351 @@ -4,6 +4,488 @@
52352
52353  menu "Security options"
52354
52355 +source grsecurity/Kconfig
52356 +
52357 +menu "PaX"
52358 +
52359 +config PAX
52360 +       bool "Enable various PaX features"
52361 +       depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS32 || MIPS64 || PARISC || PPC32 || PPC64 || SPARC32 || SPARC64 || X86)
52362 +       help
52363 +         This allows you to enable various PaX features.  PaX adds
52364 +         intrusion prevention mechanisms to the kernel that reduce
52365 +         the risks posed by exploitable memory corruption bugs.
52366 +
52367 +menu "PaX Control"
52368 +       depends on PAX
52369 +
52370 +config PAX_SOFTMODE
52371 +       bool 'Support soft mode'
52372 +       select PAX_PT_PAX_FLAGS
52373 +       help
52374 +         Enabling this option will allow you to run PaX in soft mode, that
52375 +         is, PaX features will not be enforced by default, only on executables
52376 +         marked explicitly.  You must also enable PT_PAX_FLAGS support as it
52377 +         is the only way to mark executables for soft mode use.
52378 +
52379 +         Soft mode can be activated by using the "pax_softmode=1" kernel command
52380 +         line option on boot.  Furthermore you can control various PaX features
52381 +         at runtime via the entries in /proc/sys/kernel/pax.
52382 +
52383 +config PAX_EI_PAX
52384 +       bool 'Use legacy ELF header marking'
52385 +       help
52386 +         Enabling this option will allow you to control PaX features on
52387 +         a per executable basis via the 'chpax' utility available at
52388 +         http://pax.grsecurity.net/.  The control flags will be read from
52389 +         an otherwise reserved part of the ELF header.  This marking has
52390 +         numerous drawbacks (no support for soft-mode, toolchain does not
52391 +         know about the non-standard use of the ELF header) therefore it
52392 +         has been deprecated in favour of PT_PAX_FLAGS support.
52393 +
52394 +         If you have applications not marked by the PT_PAX_FLAGS ELF
52395 +         program header then you MUST enable this option otherwise they
52396 +         will not get any protection.
52397 +
52398 +         Note that if you enable PT_PAX_FLAGS marking support as well,
52399 +         the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
52400 +
52401 +config PAX_PT_PAX_FLAGS
52402 +       bool 'Use ELF program header marking'
52403 +       help
52404 +         Enabling this option will allow you to control PaX features on
52405 +         a per executable basis via the 'paxctl' utility available at
52406 +         http://pax.grsecurity.net/.  The control flags will be read from
52407 +         a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
52408 +         has the benefits of supporting both soft mode and being fully
52409 +         integrated into the toolchain (the binutils patch is available
52410 +         from http://pax.grsecurity.net).
52411 +
52412 +         If you have applications not marked by the PT_PAX_FLAGS ELF
52413 +         program header then you MUST enable the EI_PAX marking support
52414 +         otherwise they will not get any protection.
52415 +
52416 +         Note that if you enable the legacy EI_PAX marking support as well,
52417 +         the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
52418 +
52419 +choice
52420 +       prompt 'MAC system integration'
52421 +       default PAX_HAVE_ACL_FLAGS
52422 +       help
52423 +         Mandatory Access Control systems have the option of controlling
52424 +         PaX flags on a per executable basis, choose the method supported
52425 +         by your particular system.
52426 +
52427 +         - "none": if your MAC system does not interact with PaX,
52428 +         - "direct": if your MAC system defines pax_set_initial_flags() itself,
52429 +         - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
52430 +
52431 +         NOTE: this option is for developers/integrators only.
52432 +
52433 +       config PAX_NO_ACL_FLAGS
52434 +               bool 'none'
52435 +
52436 +       config PAX_HAVE_ACL_FLAGS
52437 +               bool 'direct'
52438 +
52439 +       config PAX_HOOK_ACL_FLAGS
52440 +               bool 'hook'
52441 +endchoice
52442 +
52443 +endmenu
52444 +
52445 +menu "Non-executable pages"
52446 +       depends on PAX
52447 +
52448 +config PAX_NOEXEC
52449 +       bool "Enforce non-executable pages"
52450 +       depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS32 || MIPS64 || PARISC || PPC32 || PPC64 || S390 || SPARC32 || SPARC64 || X86)
52451 +       help
52452 +         By design some architectures do not allow for protecting memory
52453 +         pages against execution or even if they do, Linux does not make
52454 +         use of this feature.  In practice this means that if a page is
52455 +         readable (such as the stack or heap) it is also executable.
52456 +
52457 +         There is a well known exploit technique that makes use of this
52458 +         fact and a common programming mistake where an attacker can
52459 +         introduce code of his choice somewhere in the attacked program's
52460 +         memory (typically the stack or the heap) and then execute it.
52461 +
52462 +         If the attacked program was running with different (typically
52463 +         higher) privileges than that of the attacker, then he can elevate
52464 +         his own privilege level (e.g. get a root shell, write to files for
52465 +         which he does not have write access to, etc).
52466 +
52467 +         Enabling this option will let you choose from various features
52468 +         that prevent the injection and execution of 'foreign' code in
52469 +         a program.
52470 +
52471 +         This will also break programs that rely on the old behaviour and
52472 +         expect that dynamically allocated memory via the malloc() family
52473 +         of functions is executable (which it is not).  Notable examples
52474 +         are the XFree86 4.x server, the java runtime and wine.
52475 +
52476 +config PAX_PAGEEXEC
52477 +       bool "Paging based non-executable pages"
52478 +       depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
52479 +       select S390_SWITCH_AMODE if S390
52480 +       select S390_EXEC_PROTECT if S390
52481 +       help
52482 +         This implementation is based on the paging feature of the CPU.
52483 +         On i386 without hardware non-executable bit support there is a
52484 +         variable but usually low performance impact, however on Intel's
52485 +         P4 core based CPUs it is very high so you should not enable this
52486 +         for kernels meant to be used on such CPUs.
52487 +
52488 +         On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
52489 +         with hardware non-executable bit support there is no performance
52490 +         impact, on ppc the impact is negligible.
52491 +
52492 +         Note that several architectures require various emulations due to
52493 +         badly designed userland ABIs, this will cause a performance impact
52494 +         but will disappear as soon as userland is fixed. For example, ppc
52495 +         userland MUST have been built with secure-plt by a recent toolchain.
52496 +
52497 +config PAX_SEGMEXEC
52498 +       bool "Segmentation based non-executable pages"
52499 +       depends on PAX_NOEXEC && X86_32
52500 +       help
52501 +         This implementation is based on the segmentation feature of the
52502 +         CPU and has a very small performance impact, however applications
52503 +         will be limited to a 1.5 GB address space instead of the normal
52504 +         3 GB.
52505 +
52506 +config PAX_EMUTRAMP
52507 +       bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
52508 +       default y if PARISC
52509 +       help
52510 +         There are some programs and libraries that for one reason or
52511 +         another attempt to execute special small code snippets from
52512 +         non-executable memory pages.  Most notable examples are the
52513 +         signal handler return code generated by the kernel itself and
52514 +         the GCC trampolines.
52515 +
52516 +         If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
52517 +         such programs will no longer work under your kernel.
52518 +
52519 +         As a remedy you can say Y here and use the 'chpax' or 'paxctl'
52520 +         utilities to enable trampoline emulation for the affected programs
52521 +         yet still have the protection provided by the non-executable pages.
52522 +
52523 +         On parisc you MUST enable this option and EMUSIGRT as well, otherwise
52524 +         your system will not even boot.
52525 +
52526 +         Alternatively you can say N here and use the 'chpax' or 'paxctl'
52527 +         utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
52528 +         for the affected files.
52529 +
52530 +         NOTE: enabling this feature *may* open up a loophole in the
52531 +         protection provided by non-executable pages that an attacker
52532 +         could abuse.  Therefore the best solution is to not have any
52533 +         files on your system that would require this option.  This can
52534 +         be achieved by not using libc5 (which relies on the kernel
52535 +         signal handler return code) and not using or rewriting programs
52536 +         that make use of the nested function implementation of GCC.
52537 +         Skilled users can just fix GCC itself so that it implements
52538 +         nested function calls in a way that does not interfere with PaX.
52539 +
52540 +config PAX_EMUSIGRT
52541 +       bool "Automatically emulate sigreturn trampolines"
52542 +       depends on PAX_EMUTRAMP && PARISC
52543 +       default y
52544 +       help
52545 +         Enabling this option will have the kernel automatically detect
52546 +         and emulate signal return trampolines executing on the stack
52547 +         that would otherwise lead to task termination.
52548 +
52549 +         This solution is intended as a temporary one for users with
52550 +         legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
52551 +         Modula-3 runtime, etc) or executables linked to such, basically
52552 +         everything that does not specify its own SA_RESTORER function in
52553 +         normal executable memory like glibc 2.1+ does.
52554 +
52555 +         On parisc you MUST enable this option, otherwise your system will
52556 +         not even boot.
52557 +
52558 +         NOTE: this feature cannot be disabled on a per executable basis
52559 +         and since it *does* open up a loophole in the protection provided
52560 +         by non-executable pages, the best solution is to not have any
52561 +         files on your system that would require this option.
52562 +
52563 +config PAX_MPROTECT
52564 +       bool "Restrict mprotect()"
52565 +       depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
52566 +       help
52567 +         Enabling this option will prevent programs from
52568 +          - changing the executable status of memory pages that were
52569 +            not originally created as executable,
52570 +          - making read-only executable pages writable again,
52571 +          - creating executable pages from anonymous memory.
52572 +
52573 +         You should say Y here to complete the protection provided by
52574 +         the enforcement of non-executable pages.
52575 +
52576 +         NOTE: you can use the 'chpax' or 'paxctl' utilities to control
52577 +         this feature on a per file basis.
52578 +
52579 +config PAX_NOELFRELOCS
52580 +       bool "Disallow ELF text relocations"
52581 +       depends on PAX_MPROTECT && !PAX_ETEXECRELOCS && (IA64 || PPC || X86)
52582 +       help
52583 +         Non-executable pages and mprotect() restrictions are effective
52584 +         in preventing the introduction of new executable code into an
52585 +         attacked task's address space.  There remain only two venues
52586 +         for this kind of attack: if the attacker can execute already
52587 +         existing code in the attacked task then he can either have it
52588 +         create and mmap() a file containing his code or have it mmap()
52589 +         an already existing ELF library that does not have position
52590 +         independent code in it and use mprotect() on it to make it
52591 +         writable and copy his code there.  While protecting against
52592 +         the former approach is beyond PaX, the latter can be prevented
52593 +         by having only PIC ELF libraries on one's system (which do not
52594 +         need to relocate their code).  If you are sure this is your case,
52595 +         then enable this option otherwise be careful as you may not even
52596 +         be able to boot or log on your system (for example, some PAM
52597 +         modules are erroneously compiled as non-PIC by default).
52598 +
52599 +         NOTE: if you are using dynamic ELF executables (as suggested
52600 +         when using ASLR) then you must have made sure that you linked
52601 +         your files using the PIC version of crt1 (the et_dyn.tar.gz package
52602 +         referenced there has already been updated to support this).
52603 +
52604 +config PAX_ETEXECRELOCS
52605 +       bool "Allow ELF ET_EXEC text relocations"
52606 +       depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
52607 +       default y
52608 +       help
52609 +         On some architectures there are incorrectly created applications
52610 +         that require text relocations and would not work without enabling
52611 +         this option.  If you are an alpha, ia64 or parisc user, you should
52612 +         enable this option and disable it once you have made sure that
52613 +         none of your applications need it.
52614 +
52615 +config PAX_EMUPLT
52616 +       bool "Automatically emulate ELF PLT"
52617 +       depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC32 || SPARC64)
52618 +       default y
52619 +       help
52620 +         Enabling this option will have the kernel automatically detect
52621 +         and emulate the Procedure Linkage Table entries in ELF files.
52622 +         On some architectures such entries are in writable memory, and
52623 +         become non-executable leading to task termination.  Therefore
52624 +         it is mandatory that you enable this option on alpha, parisc,
52625 +         sparc and sparc64, otherwise your system would not even boot.
52626 +
52627 +         NOTE: this feature *does* open up a loophole in the protection
52628 +         provided by the non-executable pages, therefore the proper
52629 +         solution is to modify the toolchain to produce a PLT that does
52630 +         not need to be writable.
52631 +
52632 +config PAX_DLRESOLVE
52633 +       bool 'Emulate old glibc resolver stub'
52634 +       depends on PAX_EMUPLT && (SPARC32 || SPARC64)
52635 +       default n
52636 +       help
52637 +         This option is needed if userland has an old glibc (before 2.4)
52638 +         that puts a 'save' instruction into the runtime generated resolver
52639 +         stub that needs special emulation.
52640 +
52641 +config PAX_KERNEXEC
52642 +       bool "Enforce non-executable kernel pages"
52643 +       depends on PAX_NOEXEC && (PPC32 || PPC64 || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
52644 +       help
52645 +         This is the kernel land equivalent of PAGEEXEC and MPROTECT,
52646 +         that is, enabling this option will make it harder to inject
52647 +         and execute 'foreign' code in kernel memory itself.
52648 +
52649 +config PAX_KERNEXEC_MODULE_TEXT
52650 +       int "Minimum amount of memory reserved for module code"
52651 +       default "4"
52652 +       depends on PAX_KERNEXEC && X86_32 && MODULES
52653 +       help
52654 +         Due to implementation details the kernel must reserve a fixed
52655 +         amount of memory for module code at compile time that cannot be
52656 +         changed at runtime.  Here you can specify the minimum amount
52657 +         in MB that will be reserved.  Due to the same implementation
52658 +         details this size will always be rounded up to the next 2/4 MB
52659 +         boundary (depends on PAE) so the actually available memory for
52660 +         module code will usually be more than this minimum.
52661 +
52662 +         The default 4 MB should be enough for most users but if you have
52663 +         an excessive number of modules (e.g., most distribution configs
52664 +         compile many drivers as modules) or use huge modules such as
52665 +         nvidia's kernel driver, you will need to adjust this amount.
52666 +         A good rule of thumb is to look at your currently loaded kernel
52667 +         modules and add up their sizes.
52668 +
52669 +endmenu
52670 +
52671 +menu "Address Space Layout Randomization"
52672 +       depends on PAX
52673 +
52674 +config PAX_ASLR
52675 +       bool "Address Space Layout Randomization"
52676 +       depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
52677 +       help
52678 +         Many if not most exploit techniques rely on the knowledge of
52679 +         certain addresses in the attacked program.  The following options
52680 +         will allow the kernel to apply a certain amount of randomization
52681 +         to specific parts of the program thereby forcing an attacker to
52682 +         guess them in most cases.  Any failed guess will most likely crash
52683 +         the attacked program which allows the kernel to detect such attempts
52684 +         and react on them.  PaX itself provides no reaction mechanisms,
52685 +         instead it is strongly encouraged that you make use of Nergal's
52686 +         segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
52687 +         (http://www.grsecurity.net/) built-in crash detection features or
52688 +         develop one yourself.
52689 +
52690 +         By saying Y here you can choose to randomize the following areas:
52691 +          - top of the task's kernel stack
52692 +          - top of the task's userland stack
52693 +          - base address for mmap() requests that do not specify one
52694 +            (this includes all libraries)
52695 +          - base address of the main executable
52696 +
52697 +         It is strongly recommended to say Y here as address space layout
52698 +         randomization has negligible impact on performance yet it provides
52699 +         a very effective protection.
52700 +
52701 +         NOTE: you can use the 'chpax' or 'paxctl' utilities to control
52702 +         this feature on a per file basis.
52703 +
52704 +config PAX_RANDKSTACK
52705 +       bool "Randomize kernel stack base"
52706 +       depends on PAX_ASLR && X86_TSC && X86_32
52707 +       help
52708 +         By saying Y here the kernel will randomize every task's kernel
52709 +         stack on every system call.  This will not only force an attacker
52710 +         to guess it but also prevent him from making use of possible
52711 +         leaked information about it.
52712 +
52713 +         Since the kernel stack is a rather scarce resource, randomization
52714 +         may cause unexpected stack overflows, therefore you should very
52715 +         carefully test your system.  Note that once enabled in the kernel
52716 +         configuration, this feature cannot be disabled on a per file basis.
52717 +
52718 +config PAX_RANDUSTACK
52719 +       bool "Randomize user stack base"
52720 +       depends on PAX_ASLR
52721 +       help
52722 +         By saying Y here the kernel will randomize every task's userland
52723 +         stack.  The randomization is done in two steps where the second
52724 +         one may apply a big amount of shift to the top of the stack and
52725 +         cause problems for programs that want to use lots of memory (more
52726 +         than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
52727 +         For this reason the second step can be controlled by 'chpax' or
52728 +         'paxctl' on a per file basis.
52729 +
52730 +config PAX_RANDMMAP
52731 +       bool "Randomize mmap() base"
52732 +       depends on PAX_ASLR
52733 +       help
52734 +         By saying Y here the kernel will use a randomized base address for
52735 +         mmap() requests that do not specify one themselves.  As a result
52736 +         all dynamically loaded libraries will appear at random addresses
52737 +         and therefore be harder to exploit by a technique where an attacker
52738 +         attempts to execute library code for his purposes (e.g. spawn a
52739 +         shell from an exploited program that is running at an elevated
52740 +         privilege level).
52741 +
52742 +         Furthermore, if a program is relinked as a dynamic ELF file, its
52743 +         base address will be randomized as well, completing the full
52744 +         randomization of the address space layout.  Attacking such programs
52745 +         becomes a guess game.  You can find an example of doing this at
52746 +         http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
52747 +         http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
52748 +
52749 +         NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
52750 +         feature on a per file basis.
52751 +
52752 +endmenu
52753 +
52754 +menu "Miscellaneous hardening features"
52755 +
52756 +config PAX_MEMORY_SANITIZE
52757 +       bool "Sanitize all freed memory"
52758 +       help
52759 +         By saying Y here the kernel will erase memory pages as soon as they
52760 +         are freed.  This in turn reduces the lifetime of data stored in the
52761 +         pages, making it less likely that sensitive information such as
52762 +         passwords, cryptographic secrets, etc stay in memory for too long.
52763 +
52764 +         This is especially useful for programs whose runtime is short, long
52765 +         lived processes and the kernel itself benefit from this as long as
52766 +         they operate on whole memory pages and ensure timely freeing of pages
52767 +         that may hold sensitive information.
52768 +
52769 +         The tradeoff is performance impact, on a single CPU system kernel
52770 +         compilation sees a 3% slowdown, other systems and workloads may vary
52771 +         and you are advised to test this feature on your expected workload
52772 +         before deploying it.
52773 +
52774 +         Note that this feature does not protect data stored in live pages,
52775 +         e.g., process memory swapped to disk may stay there for a long time.
52776 +
52777 +config PAX_MEMORY_UDEREF
52778 +       bool "Prevent invalid userland pointer dereference"
52779 +       depends on X86_32 && !UML_X86 && !XEN
52780 +       help
52781 +         By saying Y here the kernel will be prevented from dereferencing
52782 +         userland pointers in contexts where the kernel expects only kernel
52783 +         pointers.  This is both a useful runtime debugging feature and a
52784 +         security measure that prevents exploiting a class of kernel bugs.
52785 +
52786 +         The tradeoff is that some virtualization solutions may experience
52787 +         a huge slowdown and therefore you should not enable this feature
52788 +         for kernels meant to run in such environments.  Whether a given VM
52789 +         solution is affected or not is best determined by simply trying it
52790 +         out, the performance impact will be obvious right on boot as this
52791 +         mechanism engages from very early on.  A good rule of thumb is that
52792 +         VMs running on CPUs without hardware virtualization support (i.e.,
52793 +         the majority of IA-32 CPUs) will likely experience the slowdown.
52794 +
52795 +config PAX_REFCOUNT
52796 +       bool "Prevent various kernel object reference counter overflows"
52797 +       depends on GRKERNSEC && (X86 || SPARC64)
52798 +       help
52799 +         By saying Y here the kernel will detect and prevent overflowing
52800 +         various (but not all) kinds of object reference counters.  Such
52801 +         overflows can normally occur due to bugs only and are often, if
52802 +         not always, exploitable.
52803 +
52804 +         The tradeoff is that data structures protected by an overflowed
52805 +         refcount will never be freed and therefore will leak memory.  Note
52806 +         that this leak also happens even without this protection but in
52807 +         that case the overflow can eventually trigger the freeing of the
52808 +         data structure while it is still being used elsewhere, resulting
52809 +         in the exploitable situation that this feature prevents.
52810 +
52811 +         Since this has a negligible performance impact, you should enable
52812 +         this feature.
52813 +
52814 +config PAX_USERCOPY
52815 +       bool "Bounds check heap object copies between kernel and userland"
52816 +       depends on X86 || PPC32 || PPC64 || SPARC32 || SPARC64
52817 +       depends on GRKERNSEC && (SLAB || SLUB || SLOB)
52818 +       help
52819 +         By saying Y here the kernel will enforce the size of heap objects
52820 +         when they are copied in either direction between the kernel and
52821 +         userland, even if only a part of the heap object is copied.
52822 +
52823 +         Specifically, this checking prevents information leaking from the
52824 +         kernel heap during kernel to userland copies (if the kernel heap
52825 +         object is otherwise fully initialized) and prevents kernel heap
52826 +         overflows during userland to kernel copies.
52827 +
52828 +         Note that the current implementation provides the strictest checks
52829 +         for the SLUB allocator.
52830 +
52831 +         Since this has a negligible performance impact, you should enable
52832 +         this feature.
52833 +endmenu
52834 +
52835 +endmenu
52836 +
52837  config KEYS
52838         bool "Enable access key retention support"
52839         help
52840 @@ -124,7 +606,7 @@ config INTEL_TXT
52841  config LSM_MMAP_MIN_ADDR
52842         int "Low address space for LSM to protect from user allocation"
52843         depends on SECURITY && SECURITY_SELINUX
52844 -       default 65536
52845 +       default 32768
52846         help
52847           This is the portion of low virtual memory which should be protected
52848           from userspace allocation.  Keeping a user from writing to low pages
52849 diff -urNp linux-2.6.33/security/min_addr.c linux-2.6.33/security/min_addr.c
52850 --- linux-2.6.33/security/min_addr.c    2010-02-24 13:52:17.000000000 -0500
52851 +++ linux-2.6.33/security/min_addr.c    2010-03-07 12:23:36.177657977 -0500
52852 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
52853   */
52854  static void update_mmap_min_addr(void)
52855  {
52856 +#ifndef SPARC
52857  #ifdef CONFIG_LSM_MMAP_MIN_ADDR
52858         if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
52859                 mmap_min_addr = dac_mmap_min_addr;
52860 @@ -22,6 +23,7 @@ static void update_mmap_min_addr(void)
52861  #else
52862         mmap_min_addr = dac_mmap_min_addr;
52863  #endif
52864 +#endif
52865  }
52866
52867  /*
52868 diff -urNp linux-2.6.33/sound/aoa/codecs/onyx.c linux-2.6.33/sound/aoa/codecs/onyx.c
52869 --- linux-2.6.33/sound/aoa/codecs/onyx.c        2010-02-24 13:52:17.000000000 -0500
52870 +++ linux-2.6.33/sound/aoa/codecs/onyx.c        2010-03-07 12:23:36.177657977 -0500
52871 @@ -53,7 +53,7 @@ struct onyx {
52872                                 spdif_locked:1,
52873                                 analog_locked:1,
52874                                 original_mute:2;
52875 -       int                     open_count;
52876 +       atomic_t                open_count;
52877         struct codec_info       *codec_info;
52878
52879         /* mutex serializes concurrent access to the device
52880 @@ -752,7 +752,7 @@ static int onyx_open(struct codec_info_i
52881         struct onyx *onyx = cii->codec_data;
52882
52883         mutex_lock(&onyx->mutex);
52884 -       onyx->open_count++;
52885 +       atomic_inc(&onyx->open_count);
52886         mutex_unlock(&onyx->mutex);
52887
52888         return 0;
52889 @@ -764,8 +764,7 @@ static int onyx_close(struct codec_info_
52890         struct onyx *onyx = cii->codec_data;
52891
52892         mutex_lock(&onyx->mutex);
52893 -       onyx->open_count--;
52894 -       if (!onyx->open_count)
52895 +       if (atomic_dec_and_test(&onyx->open_count))
52896                 onyx->spdif_locked = onyx->analog_locked = 0;
52897         mutex_unlock(&onyx->mutex);
52898
52899 diff -urNp linux-2.6.33/sound/core/oss/pcm_oss.c linux-2.6.33/sound/core/oss/pcm_oss.c
52900 --- linux-2.6.33/sound/core/oss/pcm_oss.c       2010-02-24 13:52:17.000000000 -0500
52901 +++ linux-2.6.33/sound/core/oss/pcm_oss.c       2010-03-07 12:23:36.177657977 -0500
52902 @@ -2949,8 +2949,8 @@ static void snd_pcm_oss_proc_done(struct
52903         }
52904  }
52905  #else /* !CONFIG_SND_VERBOSE_PROCFS */
52906 -#define snd_pcm_oss_proc_init(pcm)
52907 -#define snd_pcm_oss_proc_done(pcm)
52908 +#define snd_pcm_oss_proc_init(pcm) do {} while (0)
52909 +#define snd_pcm_oss_proc_done(pcm) do {} while (0)
52910  #endif /* CONFIG_SND_VERBOSE_PROCFS */
52911
52912  /*
52913 diff -urNp linux-2.6.33/sound/core/seq/seq_lock.h linux-2.6.33/sound/core/seq/seq_lock.h
52914 --- linux-2.6.33/sound/core/seq/seq_lock.h      2010-02-24 13:52:17.000000000 -0500
52915 +++ linux-2.6.33/sound/core/seq/seq_lock.h      2010-03-07 12:23:36.177657977 -0500
52916 @@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
52917  #else /* SMP || CONFIG_SND_DEBUG */
52918
52919  typedef spinlock_t snd_use_lock_t;     /* dummy */
52920 -#define snd_use_lock_init(lockp) /**/
52921 -#define snd_use_lock_use(lockp) /**/
52922 -#define snd_use_lock_free(lockp) /**/
52923 -#define snd_use_lock_sync(lockp) /**/
52924 +#define snd_use_lock_init(lockp) do {} while (0)
52925 +#define snd_use_lock_use(lockp) do {} while (0)
52926 +#define snd_use_lock_free(lockp) do {} while (0)
52927 +#define snd_use_lock_sync(lockp) do {} while (0)
52928
52929  #endif /* SMP || CONFIG_SND_DEBUG */
52930
52931 diff -urNp linux-2.6.33/sound/drivers/mts64.c linux-2.6.33/sound/drivers/mts64.c
52932 --- linux-2.6.33/sound/drivers/mts64.c  2010-02-24 13:52:17.000000000 -0500
52933 +++ linux-2.6.33/sound/drivers/mts64.c  2010-03-07 12:23:36.181703000 -0500
52934 @@ -65,7 +65,7 @@ struct mts64 {
52935         struct pardevice *pardev;
52936         int pardev_claimed;
52937
52938 -       int open_count;
52939 +       atomic_t open_count;
52940         int current_midi_output_port;
52941         int current_midi_input_port;
52942         u8 mode[MTS64_NUM_INPUT_PORTS];
52943 @@ -695,7 +695,7 @@ static int snd_mts64_rawmidi_open(struct
52944  {
52945         struct mts64 *mts = substream->rmidi->private_data;
52946
52947 -       if (mts->open_count == 0) {
52948 +       if (atomic_read(&mts->open_count) == 0) {
52949                 /* We don't need a spinlock here, because this is just called
52950                    if the device has not been opened before.
52951                    So there aren't any IRQs from the device */
52952 @@ -703,7 +703,7 @@ static int snd_mts64_rawmidi_open(struct
52953
52954                 msleep(50);
52955         }
52956 -       ++(mts->open_count);
52957 +       atomic_inc(&mts->open_count);
52958
52959         return 0;
52960  }
52961 @@ -713,8 +713,7 @@ static int snd_mts64_rawmidi_close(struc
52962         struct mts64 *mts = substream->rmidi->private_data;
52963         unsigned long flags;
52964
52965 -       --(mts->open_count);
52966 -       if (mts->open_count == 0) {
52967 +       if (atomic_dec_return(&mts->open_count) == 0) {
52968                 /* We need the spinlock_irqsave here because we can still
52969                    have IRQs at this point */
52970                 spin_lock_irqsave(&mts->lock, flags);
52971 @@ -723,8 +722,8 @@ static int snd_mts64_rawmidi_close(struc
52972
52973                 msleep(500);
52974
52975 -       } else if (mts->open_count < 0)
52976 -               mts->open_count = 0;
52977 +       } else if (atomic_read(&mts->open_count) < 0)
52978 +               atomic_set(&mts->open_count, 0);
52979
52980         return 0;
52981  }
52982 diff -urNp linux-2.6.33/sound/drivers/portman2x4.c linux-2.6.33/sound/drivers/portman2x4.c
52983 --- linux-2.6.33/sound/drivers/portman2x4.c     2010-02-24 13:52:17.000000000 -0500
52984 +++ linux-2.6.33/sound/drivers/portman2x4.c     2010-03-07 12:23:36.181703000 -0500
52985 @@ -83,7 +83,7 @@ struct portman {
52986         struct pardevice *pardev;
52987         int pardev_claimed;
52988
52989 -       int open_count;
52990 +       atomic_t open_count;
52991         int mode[PORTMAN_NUM_INPUT_PORTS];
52992         struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
52993  };
52994 diff -urNp linux-2.6.33/sound/oss/sb_audio.c linux-2.6.33/sound/oss/sb_audio.c
52995 --- linux-2.6.33/sound/oss/sb_audio.c   2010-02-24 13:52:17.000000000 -0500
52996 +++ linux-2.6.33/sound/oss/sb_audio.c   2010-03-07 12:23:36.181703000 -0500
52997 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
52998                 buf16 = (signed short *)(localbuf + localoffs);
52999                 while (c)
53000                 {
53001 -                       locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
53002 +                       locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
53003                         if (copy_from_user(lbuf8,
53004                                            userbuf+useroffs + p,
53005                                            locallen))
53006 diff -urNp linux-2.6.33/sound/pci/ac97/ac97_codec.c linux-2.6.33/sound/pci/ac97/ac97_codec.c
53007 --- linux-2.6.33/sound/pci/ac97/ac97_codec.c    2010-02-24 13:52:17.000000000 -0500
53008 +++ linux-2.6.33/sound/pci/ac97/ac97_codec.c    2010-03-07 12:23:36.181703000 -0500
53009 @@ -1962,7 +1962,7 @@ static int snd_ac97_dev_disconnect(struc
53010  }
53011
53012  /* build_ops to do nothing */
53013 -static struct snd_ac97_build_ops null_build_ops;
53014 +static const struct snd_ac97_build_ops null_build_ops;
53015
53016  #ifdef CONFIG_SND_AC97_POWER_SAVE
53017  static void do_update_power(struct work_struct *work)
53018 diff -urNp linux-2.6.33/sound/pci/ac97/ac97_patch.c linux-2.6.33/sound/pci/ac97/ac97_patch.c
53019 --- linux-2.6.33/sound/pci/ac97/ac97_patch.c    2010-02-24 13:52:17.000000000 -0500
53020 +++ linux-2.6.33/sound/pci/ac97/ac97_patch.c    2010-03-07 12:23:36.181703000 -0500
53021 @@ -371,7 +371,7 @@ static int patch_yamaha_ymf743_build_spd
53022         return 0;
53023  }
53024
53025 -static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
53026 +static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
53027         .build_spdif    = patch_yamaha_ymf743_build_spdif,
53028         .build_3d       = patch_yamaha_ymf7x3_3d,
53029  };
53030 @@ -455,7 +455,7 @@ static int patch_yamaha_ymf753_post_spdi
53031         return 0;
53032  }
53033
53034 -static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
53035 +static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
53036         .build_3d       = patch_yamaha_ymf7x3_3d,
53037         .build_post_spdif = patch_yamaha_ymf753_post_spdif
53038  };
53039 @@ -502,7 +502,7 @@ static int patch_wolfson_wm9703_specific
53040         return 0;
53041  }
53042
53043 -static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
53044 +static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
53045         .build_specific = patch_wolfson_wm9703_specific,
53046  };
53047
53048 @@ -533,7 +533,7 @@ static int patch_wolfson_wm9704_specific
53049         return 0;
53050  }
53051
53052 -static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
53053 +static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
53054         .build_specific = patch_wolfson_wm9704_specific,
53055  };
53056
53057 @@ -555,7 +555,7 @@ static int patch_wolfson_wm9705_specific
53058         return 0;
53059  }
53060
53061 -static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
53062 +static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
53063         .build_specific = patch_wolfson_wm9705_specific,
53064  };
53065
53066 @@ -692,7 +692,7 @@ static int patch_wolfson_wm9711_specific
53067         return 0;
53068  }
53069
53070 -static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
53071 +static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
53072         .build_specific = patch_wolfson_wm9711_specific,
53073  };
53074
53075 @@ -886,7 +886,7 @@ static void patch_wolfson_wm9713_resume
53076  }
53077  #endif
53078
53079 -static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
53080 +static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
53081         .build_specific = patch_wolfson_wm9713_specific,
53082         .build_3d = patch_wolfson_wm9713_3d,
53083  #ifdef CONFIG_PM
53084 @@ -991,7 +991,7 @@ static int patch_sigmatel_stac97xx_speci
53085         return 0;
53086  }
53087
53088 -static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
53089 +static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
53090         .build_3d       = patch_sigmatel_stac9700_3d,
53091         .build_specific = patch_sigmatel_stac97xx_specific
53092  };
53093 @@ -1038,7 +1038,7 @@ static int patch_sigmatel_stac9708_speci
53094         return patch_sigmatel_stac97xx_specific(ac97);
53095  }
53096
53097 -static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
53098 +static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
53099         .build_3d       = patch_sigmatel_stac9708_3d,
53100         .build_specific = patch_sigmatel_stac9708_specific
53101  };
53102 @@ -1267,7 +1267,7 @@ static int patch_sigmatel_stac9758_speci
53103         return 0;
53104  }
53105
53106 -static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
53107 +static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
53108         .build_3d       = patch_sigmatel_stac9700_3d,
53109         .build_specific = patch_sigmatel_stac9758_specific
53110  };
53111 @@ -1342,7 +1342,7 @@ static int patch_cirrus_build_spdif(stru
53112         return 0;
53113  }
53114
53115 -static struct snd_ac97_build_ops patch_cirrus_ops = {
53116 +static const struct snd_ac97_build_ops patch_cirrus_ops = {
53117         .build_spdif = patch_cirrus_build_spdif
53118  };
53119
53120 @@ -1399,7 +1399,7 @@ static int patch_conexant_build_spdif(st
53121         return 0;
53122  }
53123
53124 -static struct snd_ac97_build_ops patch_conexant_ops = {
53125 +static const struct snd_ac97_build_ops patch_conexant_ops = {
53126         .build_spdif = patch_conexant_build_spdif
53127  };
53128
53129 @@ -1501,7 +1501,7 @@ static const struct snd_ac97_res_table a
53130         { AC97_VIDEO, 0x9f1f },
53131         { AC97_AUX, 0x9f1f },
53132         { AC97_PCM, 0x9f1f },
53133 -       { } /* terminator */
53134 +       { 0, 0 } /* terminator */
53135  };
53136
53137  static int patch_ad1819(struct snd_ac97 * ac97)
53138 @@ -1575,7 +1575,7 @@ static void patch_ad1881_chained(struct
53139         }
53140  }
53141
53142 -static struct snd_ac97_build_ops patch_ad1881_build_ops = {
53143 +static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
53144  #ifdef CONFIG_PM
53145         .resume = ad18xx_resume
53146  #endif
53147 @@ -1662,7 +1662,7 @@ static int patch_ad1885_specific(struct
53148         return 0;
53149  }
53150
53151 -static struct snd_ac97_build_ops patch_ad1885_build_ops = {
53152 +static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
53153         .build_specific = &patch_ad1885_specific,
53154  #ifdef CONFIG_PM
53155         .resume = ad18xx_resume
53156 @@ -1689,7 +1689,7 @@ static int patch_ad1886_specific(struct
53157         return 0;
53158  }
53159
53160 -static struct snd_ac97_build_ops patch_ad1886_build_ops = {
53161 +static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
53162         .build_specific = &patch_ad1886_specific,
53163  #ifdef CONFIG_PM
53164         .resume = ad18xx_resume
53165 @@ -1894,7 +1894,7 @@ static int patch_ad1981a_specific(struct
53166                                     ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
53167  }
53168
53169 -static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
53170 +static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
53171         .build_post_spdif = patch_ad198x_post_spdif,
53172         .build_specific = patch_ad1981a_specific,
53173  #ifdef CONFIG_PM
53174 @@ -1949,7 +1949,7 @@ static int patch_ad1981b_specific(struct
53175                                     ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
53176  }
53177
53178 -static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
53179 +static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
53180         .build_post_spdif = patch_ad198x_post_spdif,
53181         .build_specific = patch_ad1981b_specific,
53182  #ifdef CONFIG_PM
53183 @@ -2088,7 +2088,7 @@ static int patch_ad1888_specific(struct
53184         return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
53185  }
53186
53187 -static struct snd_ac97_build_ops patch_ad1888_build_ops = {
53188 +static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
53189         .build_post_spdif = patch_ad198x_post_spdif,
53190         .build_specific = patch_ad1888_specific,
53191  #ifdef CONFIG_PM
53192 @@ -2137,7 +2137,7 @@ static int patch_ad1980_specific(struct
53193         return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
53194  }
53195
53196 -static struct snd_ac97_build_ops patch_ad1980_build_ops = {
53197 +static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
53198         .build_post_spdif = patch_ad198x_post_spdif,
53199         .build_specific = patch_ad1980_specific,
53200  #ifdef CONFIG_PM
53201 @@ -2252,7 +2252,7 @@ static int patch_ad1985_specific(struct
53202                                     ARRAY_SIZE(snd_ac97_ad1985_controls));
53203  }
53204
53205 -static struct snd_ac97_build_ops patch_ad1985_build_ops = {
53206 +static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
53207         .build_post_spdif = patch_ad198x_post_spdif,
53208         .build_specific = patch_ad1985_specific,
53209  #ifdef CONFIG_PM
53210 @@ -2544,7 +2544,7 @@ static int patch_ad1986_specific(struct
53211                                     ARRAY_SIZE(snd_ac97_ad1985_controls));
53212  }
53213
53214 -static struct snd_ac97_build_ops patch_ad1986_build_ops = {
53215 +static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
53216         .build_post_spdif = patch_ad198x_post_spdif,
53217         .build_specific = patch_ad1986_specific,
53218  #ifdef CONFIG_PM
53219 @@ -2649,7 +2649,7 @@ static int patch_alc650_specific(struct
53220         return 0;
53221  }
53222
53223 -static struct snd_ac97_build_ops patch_alc650_ops = {
53224 +static const struct snd_ac97_build_ops patch_alc650_ops = {
53225         .build_specific = patch_alc650_specific,
53226         .update_jacks = alc650_update_jacks
53227  };
53228 @@ -2801,7 +2801,7 @@ static int patch_alc655_specific(struct
53229         return 0;
53230  }
53231
53232 -static struct snd_ac97_build_ops patch_alc655_ops = {
53233 +static const struct snd_ac97_build_ops patch_alc655_ops = {
53234         .build_specific = patch_alc655_specific,
53235         .update_jacks = alc655_update_jacks
53236  };
53237 @@ -2913,7 +2913,7 @@ static int patch_alc850_specific(struct
53238         return 0;
53239  }
53240
53241 -static struct snd_ac97_build_ops patch_alc850_ops = {
53242 +static const struct snd_ac97_build_ops patch_alc850_ops = {
53243         .build_specific = patch_alc850_specific,
53244         .update_jacks = alc850_update_jacks
53245  };
53246 @@ -2975,7 +2975,7 @@ static int patch_cm9738_specific(struct
53247         return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
53248  }
53249
53250 -static struct snd_ac97_build_ops patch_cm9738_ops = {
53251 +static const struct snd_ac97_build_ops patch_cm9738_ops = {
53252         .build_specific = patch_cm9738_specific,
53253         .update_jacks = cm9738_update_jacks
53254  };
53255 @@ -3066,7 +3066,7 @@ static int patch_cm9739_post_spdif(struc
53256         return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
53257  }
53258
53259 -static struct snd_ac97_build_ops patch_cm9739_ops = {
53260 +static const struct snd_ac97_build_ops patch_cm9739_ops = {
53261         .build_specific = patch_cm9739_specific,
53262         .build_post_spdif = patch_cm9739_post_spdif,
53263         .update_jacks = cm9739_update_jacks
53264 @@ -3240,7 +3240,7 @@ static int patch_cm9761_specific(struct
53265         return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
53266  }
53267
53268 -static struct snd_ac97_build_ops patch_cm9761_ops = {
53269 +static const struct snd_ac97_build_ops patch_cm9761_ops = {
53270         .build_specific = patch_cm9761_specific,
53271         .build_post_spdif = patch_cm9761_post_spdif,
53272         .update_jacks = cm9761_update_jacks
53273 @@ -3336,7 +3336,7 @@ static int patch_cm9780_specific(struct
53274         return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
53275  }
53276
53277 -static struct snd_ac97_build_ops patch_cm9780_ops = {
53278 +static const struct snd_ac97_build_ops patch_cm9780_ops = {
53279         .build_specific = patch_cm9780_specific,
53280         .build_post_spdif = patch_cm9761_post_spdif     /* identical with CM9761 */
53281  };
53282 @@ -3456,7 +3456,7 @@ static int patch_vt1616_specific(struct
53283         return 0;
53284  }
53285
53286 -static struct snd_ac97_build_ops patch_vt1616_ops = {
53287 +static const struct snd_ac97_build_ops patch_vt1616_ops = {
53288         .build_specific = patch_vt1616_specific
53289  };
53290
53291 @@ -3810,7 +3810,7 @@ static int patch_it2646_specific(struct
53292         return 0;
53293  }
53294
53295 -static struct snd_ac97_build_ops patch_it2646_ops = {
53296 +static const struct snd_ac97_build_ops patch_it2646_ops = {
53297         .build_specific = patch_it2646_specific,
53298         .update_jacks = it2646_update_jacks
53299  };
53300 @@ -3844,7 +3844,7 @@ static int patch_si3036_specific(struct
53301         return 0;
53302  }
53303
53304 -static struct snd_ac97_build_ops patch_si3036_ops = {
53305 +static const struct snd_ac97_build_ops patch_si3036_ops = {
53306         .build_specific = patch_si3036_specific,
53307  };
53308
53309 @@ -3877,7 +3877,7 @@ static struct snd_ac97_res_table lm4550_
53310         { AC97_AUX, 0x1f1f },
53311         { AC97_PCM, 0x1f1f },
53312         { AC97_REC_GAIN, 0x0f0f },
53313 -       { } /* terminator */
53314 +       { 0, 0 } /* terminator */
53315  };
53316
53317  static int patch_lm4550(struct snd_ac97 *ac97)
53318 @@ -3911,7 +3911,7 @@ static int patch_ucb1400_specific(struct
53319         return 0;
53320  }
53321
53322 -static struct snd_ac97_build_ops patch_ucb1400_ops = {
53323 +static const struct snd_ac97_build_ops patch_ucb1400_ops = {
53324         .build_specific = patch_ucb1400_specific,
53325  };
53326
53327 diff -urNp linux-2.6.33/sound/pci/ens1370.c linux-2.6.33/sound/pci/ens1370.c
53328 --- linux-2.6.33/sound/pci/ens1370.c    2010-02-24 13:52:17.000000000 -0500
53329 +++ linux-2.6.33/sound/pci/ens1370.c    2010-03-07 12:23:36.181703000 -0500
53330 @@ -452,7 +452,7 @@ static struct pci_device_id snd_audiopci
53331         { PCI_VDEVICE(ENSONIQ, 0x5880), 0, },   /* ES1373 - CT5880 */
53332         { PCI_VDEVICE(ECTIVA, 0x8938), 0, },    /* Ectiva EV1938 */
53333  #endif
53334 -       { 0, }
53335 +       { 0, 0, 0, 0, 0, 0, 0 }
53336  };
53337
53338  MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
53339 diff -urNp linux-2.6.33/sound/pci/intel8x0.c linux-2.6.33/sound/pci/intel8x0.c
53340 --- linux-2.6.33/sound/pci/intel8x0.c   2010-02-24 13:52:17.000000000 -0500
53341 +++ linux-2.6.33/sound/pci/intel8x0.c   2010-03-07 12:23:36.181703000 -0500
53342 @@ -444,7 +444,7 @@ static struct pci_device_id snd_intel8x0
53343         { PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },     /* AMD8111 */
53344         { PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },     /* AMD768 */
53345         { PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
53346 -       { 0, }
53347 +       { 0, 0, 0, 0, 0, 0, 0 }
53348  };
53349
53350  MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
53351 @@ -2129,7 +2129,7 @@ static struct ac97_quirk ac97_quirks[] _
53352                 .type = AC97_TUNE_HP_ONLY
53353         },
53354  #endif
53355 -       { } /* terminator */
53356 +       { 0, 0, 0, 0, NULL, 0 } /* terminator */
53357  };
53358
53359  static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
53360 diff -urNp linux-2.6.33/sound/pci/intel8x0m.c linux-2.6.33/sound/pci/intel8x0m.c
53361 --- linux-2.6.33/sound/pci/intel8x0m.c  2010-02-24 13:52:17.000000000 -0500
53362 +++ linux-2.6.33/sound/pci/intel8x0m.c  2010-03-07 12:23:36.181703000 -0500
53363 @@ -239,7 +239,7 @@ static struct pci_device_id snd_intel8x0
53364         { PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },     /* AMD8111 */
53365         { PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
53366  #endif
53367 -       { 0, }
53368 +       { 0, 0, 0, 0, 0, 0, 0 }
53369  };
53370
53371  MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
53372 @@ -1264,7 +1264,7 @@ static struct shortname_table {
53373         { 0x5455, "ALi M5455" },
53374         { 0x746d, "AMD AMD8111" },
53375  #endif
53376 -       { 0 },
53377 +       { 0, NULL },
53378  };
53379
53380  static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
53381 diff -urNp linux-2.6.33/usr/gen_init_cpio.c linux-2.6.33/usr/gen_init_cpio.c
53382 --- linux-2.6.33/usr/gen_init_cpio.c    2010-02-24 13:52:17.000000000 -0500
53383 +++ linux-2.6.33/usr/gen_init_cpio.c    2010-03-07 12:23:36.181703000 -0500
53384 @@ -299,7 +299,7 @@ static int cpio_mkfile(const char *name,
53385         int retval;
53386         int rc = -1;
53387         int namesize;
53388 -       int i;
53389 +       unsigned int i;
53390
53391         mode |= S_IFREG;
53392
53393 @@ -386,9 +386,10 @@ static char *cpio_replace_env(char *new_
53394                         *env_var = *expanded = '\0';
53395                         strncat(env_var, start + 2, end - start - 2);
53396                         strncat(expanded, new_location, start - new_location);
53397 -                       strncat(expanded, getenv(env_var), PATH_MAX);
53398 -                       strncat(expanded, end + 1, PATH_MAX);
53399 +                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
53400 +                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
53401                         strncpy(new_location, expanded, PATH_MAX);
53402 +                       new_location[PATH_MAX] = 0;
53403                 } else
53404                         break;
53405         }
53406 diff -urNp linux-2.6.33/virt/kvm/kvm_main.c linux-2.6.33/virt/kvm/kvm_main.c
53407 --- linux-2.6.33/virt/kvm/kvm_main.c    2010-02-24 13:52:17.000000000 -0500
53408 +++ linux-2.6.33/virt/kvm/kvm_main.c    2010-03-07 12:23:36.181703000 -0500
53409 @@ -1168,6 +1168,7 @@ static int kvm_vcpu_release(struct inode
53410         return 0;
53411  }
53412
53413 +/* cannot be const */
53414  static struct file_operations kvm_vcpu_fops = {
53415         .release        = kvm_vcpu_release,
53416         .unlocked_ioctl = kvm_vcpu_ioctl,
53417 @@ -1624,6 +1625,7 @@ static int kvm_vm_mmap(struct file *file
53418         return 0;
53419  }
53420
53421 +/* cannot be const */
53422  static struct file_operations kvm_vm_fops = {
53423         .release        = kvm_vm_release,
53424         .unlocked_ioctl = kvm_vm_ioctl,
53425 @@ -1714,6 +1716,7 @@ out:
53426         return r;
53427  }
53428
53429 +/* cannot be const */
53430  static struct file_operations kvm_chardev_ops = {
53431         .unlocked_ioctl = kvm_dev_ioctl,
53432         .compat_ioctl   = kvm_dev_ioctl,
53433 @@ -1723,6 +1726,9 @@ static struct miscdevice kvm_dev = {
53434         KVM_MINOR,
53435         "kvm",
53436         &kvm_chardev_ops,
53437 +       {NULL, NULL},
53438 +       NULL,
53439 +       NULL
53440  };
53441
53442  static void hardware_enable(void *junk)
53443 @@ -2050,7 +2056,7 @@ static void kvm_sched_out(struct preempt
53444         kvm_arch_vcpu_put(vcpu);
53445  }
53446
53447 -int kvm_init(void *opaque, unsigned int vcpu_size,
53448 +int kvm_init(const void *opaque, unsigned int vcpu_size,
53449                   struct module *module)
53450  {
53451         int r;