main/linux-grsec: upgrade to grsecurity-2.2.0-2.6.32.23-201009272133

(cherry picked from commit 9743ede01facb6eb5bbebae1c40bbed39a49aa12)

2 files changed, 116 insertions, 152 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 457ff6c64f..7395160ae6 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=2.6.32.23
 _kernver=2.6.32
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	grsecurity-2.2.0-2.6.32.23-201009262116.patch
+	grsecurity-2.2.0-2.6.32.23-201009272133.patch
 	0001-grsec-revert-conflicting-flow-cache-changes.patch
 	0002-gre-fix-hard-header-destination-address-checking.patch
 	0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
@@ -150,7 +150,7 @@ firmware() {
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
 6eac9aebbf9e74546b7c44c0fb9348a7  patch-2.6.32.23.bz2
-f70ef30c2d2c60ffe11560201fe61d50  grsecurity-2.2.0-2.6.32.23-201009262116.patch
+1c9943454ee525a584543090486bd63f  grsecurity-2.2.0-2.6.32.23-201009272133.patch
 1d247140abec49b96250aec9aa59b324  0001-grsec-revert-conflicting-flow-cache-changes.patch
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
diff --git a/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009262116.patch b/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009272133.patch
index 4bebe8c85a..b87c317d86 100644
--- a/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009262116.patch
+++ b/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009272133.patch
@@ -5940,7 +5940,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/apm.h linux-2.6.32.23/arch/x86/i
  		"popl %%edi\n\t"
 diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch/x86/include/asm/atomic_32.h
 --- linux-2.6.32.23/arch/x86/include/asm/atomic_32.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/include/asm/atomic_32.h	2010-09-15 02:35:26.000000000 -0400
++++ linux-2.6.32.23/arch/x86/include/asm/atomic_32.h	2010-09-26 22:16:58.000000000 -0400
 @@ -25,6 +25,17 @@ static inline int atomic_read(const atom
  }
  
@@ -6229,7 +6229,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
  	asm volatile(LOCK_PREFIX "xaddl %0, %1"
  		     : "+r" (i), "+m" (v->counter)
  		     : : "memory");
-@@ -227,22 +422,37 @@ static inline int atomic_xchg(atomic_t *
+@@ -227,22 +422,39 @@ static inline int atomic_xchg(atomic_t *
   */
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -6245,6 +6245,8 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
 +		asm volatile("addl %2,%0\n"
 +
 +#ifdef CONFIG_PAX_REFCOUNT
++			     "jno 0f\n"
++			     "subl %2,%0\n"
 +			     "into\n0:\n"
 +			     _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -6271,7 +6273,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
  
  /* These are x86-specific, used by some header files */
-@@ -266,6 +476,14 @@ typedef struct {
+@@ -266,6 +478,14 @@ typedef struct {
  	u64 __aligned(8) counter;
  } atomic64_t;
  
@@ -6288,7 +6290,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
  extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
 diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch/x86/include/asm/atomic_64.h
 --- linux-2.6.32.23/arch/x86/include/asm/atomic_64.h	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/include/asm/atomic_64.h	2010-09-21 20:46:18.000000000 -0400
++++ linux-2.6.32.23/arch/x86/include/asm/atomic_64.h	2010-09-26 22:30:45.000000000 -0400
 @@ -24,6 +24,17 @@ static inline int atomic_read(const atom
  }
  
@@ -6406,7 +6408,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter), "=qm" (c)
  		     : "ir" (i), "m" (v->counter) : "memory");
  	return c;
-@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
+@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
   */
  static inline void atomic_inc(atomic_t *v)
  {
@@ -6415,13 +6417,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
 +		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     : "=m" (v->counter)
@@ -6440,7 +6438,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter)
  		     : "m" (v->counter));
  }
-@@ -103,7 +204,32 @@ static inline void atomic_inc(atomic_t *
+@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
   */
  static inline void atomic_dec(atomic_t *v)
  {
@@ -6449,13 +6447,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     : "=m" (v->counter)
@@ -6474,7 +6468,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter)
  		     : "m" (v->counter));
  }
-@@ -120,7 +246,20 @@ static inline int atomic_dec_and_test(at
+@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
  {
  	unsigned char c;
  
@@ -6483,20 +6477,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "incl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     "sete %1\n"
  		     : "=m" (v->counter), "=qm" (c)
  		     : "m" (v->counter) : "memory");
  	return c != 0;
-@@ -138,7 +277,20 @@ static inline int atomic_inc_and_test(at
+@@ -138,7 +265,16 @@ static inline int atomic_inc_and_test(at
  {
  	unsigned char c;
  
@@ -6505,20 +6495,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "decl %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     "sete %1\n"
  		     : "=m" (v->counter), "=qm" (c)
  		     : "m" (v->counter) : "memory");
  	return c != 0;
-@@ -157,7 +309,16 @@ static inline int atomic_add_negative(in
+@@ -157,7 +293,16 @@ static inline int atomic_add_negative(in
  {
  	unsigned char c;
  
@@ -6536,7 +6522,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter), "=qm" (c)
  		     : "ir" (i), "m" (v->counter) : "memory");
  	return c;
-@@ -173,7 +334,31 @@ static inline int atomic_add_negative(in
+@@ -173,7 +318,31 @@ static inline int atomic_add_negative(in
  static inline int atomic_add_return(int i, atomic_t *v)
  {
  	int __i = i;
@@ -6569,7 +6555,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "+r" (i), "+m" (v->counter)
  		     : : "memory");
  	return i + __i;
-@@ -185,6 +370,10 @@ static inline int atomic_sub_return(int 
+@@ -185,6 +354,10 @@ static inline int atomic_sub_return(int 
  }
  
  #define atomic_inc_return(v)  (atomic_add_return(1, v))
@@ -6580,7 +6566,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
  
  /* The 64-bit atomic type */
-@@ -204,6 +393,18 @@ static inline long atomic64_read(const a
+@@ -204,6 +377,18 @@ static inline long atomic64_read(const a
  }
  
  /**
@@ -6599,7 +6585,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
   * atomic64_set - set atomic64 variable
   * @v: pointer to type atomic64_t
   * @i: required value
-@@ -216,6 +417,18 @@ static inline void atomic64_set(atomic64
+@@ -216,6 +401,18 @@ static inline void atomic64_set(atomic64
  }
  
  /**
@@ -6618,7 +6604,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
   * atomic64_add - add integer to atomic64 variable
   * @i: integer value to add
   * @v: pointer to type atomic64_t
-@@ -224,6 +437,28 @@ static inline void atomic64_set(atomic64
+@@ -224,6 +421,28 @@ static inline void atomic64_set(atomic64
   */
  static inline void atomic64_add(long i, atomic64_t *v)
  {
@@ -6647,7 +6633,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  	asm volatile(LOCK_PREFIX "addq %1,%0"
  		     : "=m" (v->counter)
  		     : "er" (i), "m" (v->counter));
-@@ -238,7 +473,15 @@ static inline void atomic64_add(long i, 
+@@ -238,7 +457,15 @@ static inline void atomic64_add(long i, 
   */
  static inline void atomic64_sub(long i, atomic64_t *v)
  {
@@ -6664,7 +6650,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter)
  		     : "er" (i), "m" (v->counter));
  }
-@@ -256,7 +499,16 @@ static inline int atomic64_sub_and_test(
+@@ -256,7 +483,16 @@ static inline int atomic64_sub_and_test(
  {
  	unsigned char c;
  
@@ -6682,7 +6668,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter), "=qm" (c)
  		     : "er" (i), "m" (v->counter) : "memory");
  	return c;
-@@ -270,6 +522,31 @@ static inline int atomic64_sub_and_test(
+@@ -270,6 +506,27 @@ static inline int atomic64_sub_and_test(
   */
  static inline void atomic64_inc(atomic64_t *v)
  {
@@ -6690,13 +6676,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1:\n"
 +		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     : "=m" (v->counter)
@@ -6714,7 +6696,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  	asm volatile(LOCK_PREFIX "incq %0"
  		     : "=m" (v->counter)
  		     : "m" (v->counter));
-@@ -283,7 +560,32 @@ static inline void atomic64_inc(atomic64
+@@ -283,7 +540,28 @@ static inline void atomic64_inc(atomic64
   */
  static inline void atomic64_dec(atomic64_t *v)
  {
@@ -6723,13 +6705,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     : "=m" (v->counter)
@@ -6748,7 +6726,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter)
  		     : "m" (v->counter));
  }
-@@ -300,7 +602,20 @@ static inline int atomic64_dec_and_test(
+@@ -300,7 +578,16 @@ static inline int atomic64_dec_and_test(
  {
  	unsigned char c;
  
@@ -6757,20 +6735,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "incq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     "sete %1\n"
  		     : "=m" (v->counter), "=qm" (c)
  		     : "m" (v->counter) : "memory");
  	return c != 0;
-@@ -318,7 +633,20 @@ static inline int atomic64_inc_and_test(
+@@ -318,7 +605,16 @@ static inline int atomic64_inc_and_test(
  {
  	unsigned char c;
  
@@ -6779,20 +6753,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +		     "jno 0f\n"
-+		     "int $4\n0:\n"
-+		     ".pushsection .fixup,\"ax\"\n"
-+		     "1: \n"
 +		     LOCK_PREFIX "decq %0\n"
-+		     "jmp 0b\n"
-+		     ".popsection\n"
-+		     _ASM_EXTABLE(0b, 1b)
++		     "int $4\n0:\n"
++		     _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +		     "sete %1\n"
  		     : "=m" (v->counter), "=qm" (c)
  		     : "m" (v->counter) : "memory");
  	return c != 0;
-@@ -337,7 +665,16 @@ static inline int atomic64_add_negative(
+@@ -337,7 +633,16 @@ static inline int atomic64_add_negative(
  {
  	unsigned char c;
  
@@ -6810,7 +6780,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "=m" (v->counter), "=qm" (c)
  		     : "er" (i), "m" (v->counter) : "memory");
  	return c;
-@@ -353,7 +690,31 @@ static inline int atomic64_add_negative(
+@@ -353,7 +658,31 @@ static inline int atomic64_add_negative(
  static inline long atomic64_add_return(long i, atomic64_t *v)
  {
  	long __i = i;
@@ -6843,7 +6813,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  		     : "+r" (i), "+m" (v->counter)
  		     : : "memory");
  	return i + __i;
-@@ -365,6 +726,10 @@ static inline long atomic64_sub_return(l
+@@ -365,6 +694,10 @@ static inline long atomic64_sub_return(l
  }
  
  #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
@@ -6854,7 +6824,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
  
  static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -398,17 +763,29 @@ static inline long atomic_xchg(atomic_t 
+@@ -398,17 +731,30 @@ static inline long atomic_xchg(atomic_t 
   */
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -6871,6 +6841,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +			     "jno 0f\n"
++			     "subl %2,%0\n"
 +			     "int $4\n0:\n"
 +			     _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -6888,7 +6859,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  }
  
  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +801,29 @@ static inline int atomic_add_unless(atom
+@@ -424,17 +770,30 @@ static inline int atomic_add_unless(atom
   */
  static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
  {
@@ -6905,6 +6876,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +			     "jno 0f\n"
++			     "subq %2,%0\n"
 +			     "int $4\n0:\n"
 +			     _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -13932,7 +13904,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/syscall_table_32.S linux-2.6.32.23/ar
  	.long sys_exit
 diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c
 --- linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c	2010-09-17 18:34:04.000000000 -0400
++++ linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c	2010-09-26 22:08:46.000000000 -0400
 @@ -24,6 +24,21 @@
  
  #include <asm/syscalls.h>
@@ -13955,7 +13927,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  /*
   * Perform the select(nd, in, out, ex, tv) and mmap() system
   * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,208 @@ out:
+@@ -58,6 +73,212 @@ out:
  	return err;
  }
  
@@ -13972,6 +13944,8 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++	pax_task_size -= PAGE_SIZE;
++
 +	if (len > pax_task_size)
 +		return -ENOMEM;
 +
@@ -14061,6 +14035,8 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++	pax_task_size -= PAGE_SIZE;
++
 +	/* requested length too big for entire address space */
 +	if (len > pax_task_size)
 +		return -ENOMEM;
@@ -14164,7 +14140,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  
  struct sel_arg_struct {
  	unsigned long n;
-@@ -93,7 +310,7 @@ asmlinkage int sys_ipc(uint call, int fi
+@@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
  		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
  	case SEMTIMEDOP:
  		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
@@ -14173,7 +14149,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  
  	case SEMGET:
  		return sys_semget(first, second, third);
-@@ -140,7 +357,7 @@ asmlinkage int sys_ipc(uint call, int fi
+@@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
  			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
  			if (ret)
  				return ret;
@@ -18270,8 +18246,8 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/highmem_32.c linux-2.6.32.23/arch/x86/mm/
  }
 diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm/hugetlbpage.c
 --- linux-2.6.32.23/arch/x86/mm/hugetlbpage.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/mm/hugetlbpage.c	2010-09-17 18:34:04.000000000 -0400
-@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
++++ linux-2.6.32.23/arch/x86/mm/hugetlbpage.c	2010-09-26 22:08:46.000000000 -0400
+@@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
@@ -18282,6 +18258,8 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
 +	if (mm->pax_flags & MF_PAX_SEGMEXEC)
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
++
++	pax_task_size -= PAGE_SIZE;
  
  	if (len > mm->cached_hole_size) {
 -	        start_addr = mm->free_area_cache;
@@ -18294,7 +18272,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  	}
  
  full_search:
-@@ -281,26 +286,27 @@ full_search:
+@@ -281,26 +288,27 @@ full_search:
  
  	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
  		/* At this point:  (!vma || addr < vma->vm_end). */
@@ -18329,7 +18307,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  }
  
  static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -309,10 +315,9 @@ static unsigned long hugetlb_get_unmappe
+@@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
  {
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
@@ -18342,7 +18320,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  
  	/* don't allow allocations above current base */
  	if (mm->free_area_cache > base)
-@@ -322,7 +327,7 @@ static unsigned long hugetlb_get_unmappe
+@@ -322,7 +329,7 @@ static unsigned long hugetlb_get_unmappe
  	        largest_hole = 0;
  		mm->free_area_cache  = base;
  	}
@@ -18351,7 +18329,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  	/* make sure it can fit in the remaining address space */
  	if (mm->free_area_cache < len)
  		goto fail;
-@@ -330,33 +335,27 @@ try_again:
+@@ -330,33 +337,27 @@ try_again:
  	/* either no address requested or cant fit in requested address hole */
  	addr = (mm->free_area_cache - len) & huge_page_mask(h);
  	do {
@@ -18395,7 +18373,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  
  		/* try just below the current vma->vm_start */
  		addr = (vma->vm_start - len) & huge_page_mask(h);
-@@ -364,22 +363,26 @@ try_again:
+@@ -364,22 +365,26 @@ try_again:
  
  fail:
  	/*
@@ -18433,7 +18411,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  	mm->cached_hole_size = ~0UL;
  	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
  			len, pgoff, flags);
-@@ -387,6 +390,7 @@ fail:
+@@ -387,6 +392,7 @@ fail:
  	/*
  	 * Restore the topdown base:
  	 */
@@ -18441,7 +18419,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  	mm->free_area_cache = base;
  	mm->cached_hole_size = ~0UL;
  
-@@ -400,10 +404,17 @@ hugetlb_get_unmapped_area(struct file *f
+@@ -400,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
  	struct vm_area_struct *vma;
@@ -18456,11 +18434,13 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++	pax_task_size -= PAGE_SIZE;
++
 +	if (len > pax_task_size)
  		return -ENOMEM;
  
  	if (flags & MAP_FIXED) {
-@@ -415,8 +426,7 @@ hugetlb_get_unmapped_area(struct file *f
+@@ -415,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
  	if (addr) {
  		addr = ALIGN(addr, huge_page_size(h));
  		vma = find_vma(mm, addr);
@@ -23722,7 +23702,7 @@ diff -urNp linux-2.6.32.23/drivers/base/sys.c linux-2.6.32.23/drivers/base/sys.c
  };
 diff -urNp linux-2.6.32.23/drivers/block/pktcdvd.c linux-2.6.32.23/drivers/block/pktcdvd.c
 --- linux-2.6.32.23/drivers/block/pktcdvd.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/drivers/block/pktcdvd.c	2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/drivers/block/pktcdvd.c	2010-09-27 18:49:22.000000000 -0400
 @@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
  	return len;
  }
@@ -23732,6 +23712,15 @@ diff -urNp linux-2.6.32.23/drivers/block/pktcdvd.c linux-2.6.32.23/drivers/block
  	.show = kobj_pkt_show,
  	.store = kobj_pkt_store
  };
+@@ -2408,7 +2408,7 @@ static void pkt_release_dev(struct pktcd
+ 	pkt_shrink_pktlist(pd);
+ }
+ 
+-static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
++static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor)
+ {
+ 	if (dev_minor >= MAX_WRITERS)
+ 		return NULL;
 diff -urNp linux-2.6.32.23/drivers/char/agp/frontend.c linux-2.6.32.23/drivers/char/agp/frontend.c
 --- linux-2.6.32.23/drivers/char/agp/frontend.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.23/drivers/char/agp/frontend.c	2010-09-04 15:54:52.000000000 -0400
@@ -30133,63 +30122,16 @@ diff -urNp linux-2.6.32.23/drivers/video/vesafb.c linux-2.6.32.23/drivers/video/
  	framebuffer_release(info);
 diff -urNp linux-2.6.32.23/drivers/xen/events.c linux-2.6.32.23/drivers/xen/events.c
 --- linux-2.6.32.23/drivers/xen/events.c	2010-09-20 17:26:42.000000000 -0400
-+++ linux-2.6.32.23/drivers/xen/events.c	2010-09-21 21:18:38.000000000 -0400
-@@ -106,7 +106,6 @@ static inline unsigned long *cpu_evtchn_
- #define VALID_EVTCHN(chn)	((chn) != 0)
- 
- static struct irq_chip xen_dynamic_chip;
--static struct irq_chip xen_percpu_chip;
- 
- /* Constructor for packed IRQ information. */
- static struct irq_info mk_unbound_info(void)
-@@ -363,7 +362,7 @@ int bind_evtchn_to_irq(unsigned int evtc
- 		irq = find_unbound_irq();
- 
- 		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
--					      handle_edge_irq, "event");
-+					      handle_level_irq, "event");
- 
- 		evtchn_to_irq[evtchn] = irq;
- 		irq_info[irq] = mk_evtchn_info(evtchn);
-@@ -389,8 +388,8 @@ static int bind_ipi_to_irq(unsigned int 
- 		if (irq < 0)
- 			goto out;
- 
--		set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
--					      handle_percpu_irq, "ipi");
-+		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
-+					      handle_level_irq, "ipi");
- 
- 		bind_ipi.vcpu = cpu;
- 		if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
-@@ -430,8 +429,8 @@ static int bind_virq_to_irq(unsigned int
- 
- 		irq = find_unbound_irq();
- 
--		set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
--					      handle_percpu_irq, "virq");
-+		set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
-+					      handle_level_irq, "virq");
- 
- 		evtchn_to_irq[evtchn] = irq;
- 		irq_info[irq] = mk_virq_info(evtchn, virq);
-@@ -930,16 +929,6 @@ static struct irq_chip xen_dynamic_chip 
++++ linux-2.6.32.23/drivers/xen/events.c	2010-09-26 21:25:12.000000000 -0400
+@@ -930,7 +930,7 @@ static struct irq_chip xen_dynamic_chip 
  	.retrigger	= retrigger_dynirq,
  };
  
 -static struct irq_chip en_percpu_chip __read_mostly = {
--	.name		= "xen-percpu",
--
--	.disable	= disable_dynirq,
--	.mask		= disable_dynirq,
--	.unmask		= enable_dynirq,
--
--	.ack		= ack_dynirq,
--};
--
- void __init xen_init_IRQ(void)
- {
- 	int i;
++static struct irq_chip xen_percpu_chip __read_mostly = {
+ 	.name		= "xen-percpu",
+ 
+ 	.disable	= disable_dynirq,
 diff -urNp linux-2.6.32.23/drivers/xen/sys-hypervisor.c linux-2.6.32.23/drivers/xen/sys-hypervisor.c
 --- linux-2.6.32.23/drivers/xen/sys-hypervisor.c	2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.23/drivers/xen/sys-hypervisor.c	2010-09-04 15:54:52.000000000 -0400
@@ -48623,7 +48565,7 @@ diff -urNp linux-2.6.32.23/include/linux/vmalloc.h linux-2.6.32.23/include/linux
  #endif /* _LINUX_VMALLOC_H */
 diff -urNp linux-2.6.32.23/include/linux/vmstat.h linux-2.6.32.23/include/linux/vmstat.h
 --- linux-2.6.32.23/include/linux/vmstat.h	2010-09-26 17:26:05.000000000 -0400
-+++ linux-2.6.32.23/include/linux/vmstat.h	2010-09-26 17:26:57.000000000 -0400
++++ linux-2.6.32.23/include/linux/vmstat.h	2010-09-26 22:01:38.000000000 -0400
 @@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
  /*
   * Zone based page accounting with per cpu differentials.
@@ -48656,6 +48598,15 @@ diff -urNp linux-2.6.32.23/include/linux/vmstat.h linux-2.6.32.23/include/linux/
  #ifdef CONFIG_SMP
  	if (x < 0)
  		x = 0;
+@@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
+ static inline unsigned long zone_page_state_snapshot(struct zone *zone,
+ 					enum zone_stat_item item)
+ {
+-	long x = atomic_long_read(&zone->vm_stat[item]);
++	long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
+ 
+ #ifdef CONFIG_SMP
+ 	int cpu;
 @@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
  
  static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
@@ -54380,7 +54331,7 @@ diff -urNp linux-2.6.32.23/mm/mprotect.c linux-2.6.32.23/mm/mprotect.c
  		if (nstart < prev->vm_end)
 diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 --- linux-2.6.32.23/mm/mremap.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/mm/mremap.c	2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/mm/mremap.c	2010-09-26 22:08:46.000000000 -0400
 @@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
  			continue;
  		pte = ptep_clear_flush(vma, old_addr, old_pte);
@@ -54406,7 +54357,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  	/* We can't remap across vm area boundaries */
  	if (old_len > vma->vm_end - addr)
  		goto Efault;
-@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
+@@ -322,20 +333,25 @@ static unsigned long mremap_to(unsigned 
  	unsigned long ret = -EINVAL;
  	unsigned long charged = 0;
  	unsigned long map_flags;
@@ -54421,6 +54372,8 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++	pax_task_size -= PAGE_SIZE;
++
 +	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
  		goto out;
  
@@ -54435,7 +54388,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  		goto out;
  
  	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -407,6 +423,7 @@ unsigned long do_mremap(unsigned long ad
  	struct vm_area_struct *vma;
  	unsigned long ret = -EINVAL;
  	unsigned long charged = 0;
@@ -54443,7 +54396,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  
  	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
  		goto out;
-@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
+@@ -425,6 +442,17 @@ unsigned long do_mremap(unsigned long ad
  	if (!new_len)
  		goto out;
  
@@ -54452,6 +54405,8 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++	pax_task_size -= PAGE_SIZE;
++
 +	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
 +	    old_len > pax_task_size || addr > pax_task_size-old_len)
 +		goto out;
@@ -54459,7 +54414,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  	if (flags & MREMAP_FIXED) {
  		if (flags & MREMAP_MAYMOVE)
  			ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -471,6 +499,7 @@ unsigned long do_mremap(unsigned long ad
  						   addr + new_len);
  			}
  			ret = addr;
@@ -54467,7 +54422,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  			goto out;
  		}
  	}
-@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
+@@ -497,7 +526,13 @@ unsigned long do_mremap(unsigned long ad
  		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
  		if (ret)
  			goto out;
@@ -58356,7 +58311,7 @@ diff -urNp linux-2.6.32.23/usr/gen_init_cpio.c linux-2.6.32.23/usr/gen_init_cpio
         }
 diff -urNp linux-2.6.32.23/virt/kvm/kvm_main.c linux-2.6.32.23/virt/kvm/kvm_main.c
 --- linux-2.6.32.23/virt/kvm/kvm_main.c	2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/virt/kvm/kvm_main.c	2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/virt/kvm/kvm_main.c	2010-09-26 22:08:46.000000000 -0400
 @@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
  	return 0;
  }
@@ -58391,6 +58346,15 @@ diff -urNp linux-2.6.32.23/virt/kvm/kvm_main.c linux-2.6.32.23/virt/kvm/kvm_main
  };
  
  static void hardware_enable(void *junk)
+@@ -2494,7 +2500,7 @@ asmlinkage void kvm_handle_fault_on_rebo
+ 	if (kvm_rebooting)
+ 		/* spin while reset goes on */
+ 		while (true)
+-			;
++			cpu_relax();
+ 	/* Fault while not rebooting.  We want the trace. */
+ 	BUG();
+ }
 @@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
  	kvm_arch_vcpu_put(vcpu);
  }