main/linux-grsec: move grsecurity-2.2.2-2.6.38.2-201103281752 from testing

author: Natanael Copa <ncopa@alpinelinux.org> 2011-05-24 12:53:50 +0000
committer: Natanael Copa <ncopa@alpinelinux.org> 2011-05-24 12:53:50 +0000
commit: 8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d (patch)
tree: d32c69c9a8f6fa4c27eff3df871c71d6ae76876c /main/linux-grsec
parent: aeab26d98cd427c5b7effd561d230aae1515e3ea (diff)
download: aports-8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d.tar.bz2
aports-8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d.tar.xz
4 files changed, 18658 insertions, 6695 deletions
diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 3e7a6bc50c..758226d210 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -2,9 +2,9 @@
 
 _flavor=grsec
 pkgname=linux-${_flavor}
-pkgver=2.6.38.2
+pkgver=2.6.38.7
 _kernver=2.6.38
-pkgrel=3
+pkgrel=0
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
 	ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-	grsecurity-2.2.2-2.6.38.2-201103281752.patch
+	grsecurity-2.2.2-2.6.38.7-201105222331.patch
 	
 	0004-arp-flush-arp-cache-on-device-change.patch
 	net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
@@ -137,9 +137,9 @@ dev() {
 }
 
 md5sums="7d471477bfa67546f902da62227fa976  linux-2.6.38.tar.bz2
-599badab31c4920d4122133208c810d7  patch-2.6.38.2.bz2
-fac4f5fb386192c544fae27db6db18a7  grsecurity-2.2.2-2.6.38.2-201103281752.patch
+2639b4b98a2dcfc8b7f091543f289205  patch-2.6.38.7.bz2
+405571538f81e3ebbe8cbfc029c52fdd  grsecurity-2.2.2-2.6.38.7-201105222331.patch
 776adeeb5272093574f8836c5037dd7d  0004-arp-flush-arp-cache-on-device-change.patch
 aa1b82da0cabfb41c5e6da5bddf60bab  net-gre-provide-multicast-mappings-for-ipv4-and-ipv6.patch
-47ff0feca681cd53a037b7f5c9b46c3d  kernelconfig.x86
-2d70a4c38d97ca1a5280ca8d4e535628  kernelconfig.x86_64"
+f4cf5b0ddfeef7aa87fb27792aff88a4  kernelconfig.x86
+0a73d8d896101de90f47dae32119e7ca  kernelconfig.x86_64"
diff --git a/main/linux-grsec/grsecurity-2.2.2-2.6.38.2-201103281752.patch b/main/linux-grsec/grsecurity-2.2.2-2.6.38.7-201105222331.patch
index 190cb94594..8ac4f8cdfc 100644
--- a/main/linux-grsec/grsecurity-2.2.2-2.6.38.2-201103281752.patch
+++ b/main/linux-grsec/grsecurity-2.2.2-2.6.38.7-201105222331.patch
@@ -1,6 +1,6 @@
-diff -urNp linux-2.6.38.2/arch/alpha/include/asm/dma-mapping.h linux-2.6.38.2/arch/alpha/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/alpha/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/include/asm/dma-mapping.h linux-2.6.38.7/arch/alpha/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/alpha/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -3,9 +3,9 @@
  
  #include <linux/dma-attrs.h>
@@ -13,9 +13,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/include/asm/dma-mapping.h linux-2.6.38.2/ar
  {
  	return dma_ops;
  }
-diff -urNp linux-2.6.38.2/arch/alpha/include/asm/elf.h linux-2.6.38.2/arch/alpha/include/asm/elf.h
---- linux-2.6.38.2/arch/alpha/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/include/asm/elf.h linux-2.6.38.7/arch/alpha/include/asm/elf.h
+--- linux-2.6.38.7/arch/alpha/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -90,6 +90,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
  
  #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
@@ -30,9 +30,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/include/asm/elf.h linux-2.6.38.2/arch/alpha
  /* $0 is set by ld.so to a pointer to a function which might be 
     registered using atexit.  This provides a mean for the dynamic
     linker to call DT_FINI functions for shared libraries that have
-diff -urNp linux-2.6.38.2/arch/alpha/include/asm/pgtable.h linux-2.6.38.2/arch/alpha/include/asm/pgtable.h
---- linux-2.6.38.2/arch/alpha/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/include/asm/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/include/asm/pgtable.h linux-2.6.38.7/arch/alpha/include/asm/pgtable.h
+--- linux-2.6.38.7/arch/alpha/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/include/asm/pgtable.h	2011-04-28 19:34:14.000000000 -0400
 @@ -101,6 +101,17 @@ struct vm_area_struct;
  #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
  #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
@@ -51,9 +51,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/include/asm/pgtable.h linux-2.6.38.2/arch/a
  #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
  
  #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
-diff -urNp linux-2.6.38.2/arch/alpha/kernel/module.c linux-2.6.38.2/arch/alpha/kernel/module.c
---- linux-2.6.38.2/arch/alpha/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/kernel/module.c linux-2.6.38.7/arch/alpha/kernel/module.c
+--- linux-2.6.38.7/arch/alpha/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -182,7 +182,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
  
  	/* The small sections were sorted to the end of the segment.
@@ -63,9 +63,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/kernel/module.c linux-2.6.38.2/arch/alpha/k
  	got = sechdrs[me->arch.gotsecindex].sh_addr;
  
  	for (i = 0; i < n; i++) {
-diff -urNp linux-2.6.38.2/arch/alpha/kernel/osf_sys.c linux-2.6.38.2/arch/alpha/kernel/osf_sys.c
---- linux-2.6.38.2/arch/alpha/kernel/osf_sys.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/kernel/osf_sys.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/kernel/osf_sys.c linux-2.6.38.7/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.38.7/arch/alpha/kernel/osf_sys.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/kernel/osf_sys.c	2011-04-28 19:34:14.000000000 -0400
 @@ -1162,7 +1162,7 @@ arch_get_unmapped_area_1(unsigned long a
  		/* At this point:  (!vma || addr < vma->vm_end). */
  		if (limit - len < addr)
@@ -97,9 +97,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/kernel/osf_sys.c linux-2.6.38.2/arch/alpha/
  	if (addr != (unsigned long) -ENOMEM)
  		return addr;
  
-diff -urNp linux-2.6.38.2/arch/alpha/kernel/pci_iommu.c linux-2.6.38.2/arch/alpha/kernel/pci_iommu.c
---- linux-2.6.38.2/arch/alpha/kernel/pci_iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/kernel/pci_iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/kernel/pci_iommu.c linux-2.6.38.7/arch/alpha/kernel/pci_iommu.c
+--- linux-2.6.38.7/arch/alpha/kernel/pci_iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/kernel/pci_iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -950,7 +950,7 @@ static int alpha_pci_set_mask(struct dev
  	return 0;
  }
@@ -116,9 +116,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/kernel/pci_iommu.c linux-2.6.38.2/arch/alph
 -struct dma_map_ops *dma_ops = &alpha_pci_ops;
 +const struct dma_map_ops *dma_ops = &alpha_pci_ops;
  EXPORT_SYMBOL(dma_ops);
-diff -urNp linux-2.6.38.2/arch/alpha/kernel/pci-noop.c linux-2.6.38.2/arch/alpha/kernel/pci-noop.c
---- linux-2.6.38.2/arch/alpha/kernel/pci-noop.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/kernel/pci-noop.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/kernel/pci-noop.c linux-2.6.38.7/arch/alpha/kernel/pci-noop.c
+--- linux-2.6.38.7/arch/alpha/kernel/pci-noop.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/kernel/pci-noop.c	2011-04-28 19:34:14.000000000 -0400
 @@ -173,7 +173,7 @@ static int alpha_noop_set_mask(struct de
  	return 0;
  }
@@ -137,9 +137,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/kernel/pci-noop.c linux-2.6.38.2/arch/alpha
  EXPORT_SYMBOL(dma_ops);
  
  void __iomem *pci_iomap(struct pci_dev *dev, int bar, unsigned long maxlen)
-diff -urNp linux-2.6.38.2/arch/alpha/mm/fault.c linux-2.6.38.2/arch/alpha/mm/fault.c
---- linux-2.6.38.2/arch/alpha/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/alpha/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/alpha/mm/fault.c linux-2.6.38.7/arch/alpha/mm/fault.c
+--- linux-2.6.38.7/arch/alpha/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/alpha/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -54,6 +54,124 @@ __load_new_mm_context(struct mm_struct *
  	__reload_thread(pcb);
  }
@@ -296,9 +296,9 @@ diff -urNp linux-2.6.38.2/arch/alpha/mm/fault.c linux-2.6.38.2/arch/alpha/mm/fau
  	} else if (!cause) {
  		/* Allow reads even for write-only mappings */
  		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
-diff -urNp linux-2.6.38.2/arch/arm/include/asm/elf.h linux-2.6.38.2/arch/arm/include/asm/elf.h
---- linux-2.6.38.2/arch/arm/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/include/asm/elf.h linux-2.6.38.7/arch/arm/include/asm/elf.h
+--- linux-2.6.38.7/arch/arm/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -115,7 +115,14 @@ int dump_task_regs(struct task_struct *t
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
@@ -326,9 +326,9 @@ diff -urNp linux-2.6.38.2/arch/arm/include/asm/elf.h linux-2.6.38.2/arch/arm/inc
  extern int vectors_user_mapping(void);
  #define arch_setup_additional_pages(bprm, uses_interp) vectors_user_mapping()
  #define ARCH_HAS_SETUP_ADDITIONAL_PAGES
-diff -urNp linux-2.6.38.2/arch/arm/include/asm/kmap_types.h linux-2.6.38.2/arch/arm/include/asm/kmap_types.h
---- linux-2.6.38.2/arch/arm/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/include/asm/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/include/asm/kmap_types.h linux-2.6.38.7/arch/arm/include/asm/kmap_types.h
+--- linux-2.6.38.7/arch/arm/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/include/asm/kmap_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -21,6 +21,7 @@ enum km_type {
  	KM_L1_CACHE,
  	KM_L2_CACHE,
@@ -337,9 +337,9 @@ diff -urNp linux-2.6.38.2/arch/arm/include/asm/kmap_types.h linux-2.6.38.2/arch/
  	KM_TYPE_NR
  };
  
-diff -urNp linux-2.6.38.2/arch/arm/include/asm/uaccess.h linux-2.6.38.2/arch/arm/include/asm/uaccess.h
---- linux-2.6.38.2/arch/arm/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/include/asm/uaccess.h linux-2.6.38.7/arch/arm/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/arm/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -403,6 +403,9 @@ extern unsigned long __must_check __strn
  
  static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
@@ -360,9 +360,9 @@ diff -urNp linux-2.6.38.2/arch/arm/include/asm/uaccess.h linux-2.6.38.2/arch/arm
  	if (access_ok(VERIFY_WRITE, to, n))
  		n = __copy_to_user(to, from, n);
  	return n;
-diff -urNp linux-2.6.38.2/arch/arm/kernel/kgdb.c linux-2.6.38.2/arch/arm/kernel/kgdb.c
---- linux-2.6.38.2/arch/arm/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/kernel/kgdb.c linux-2.6.38.7/arch/arm/kernel/kgdb.c
+--- linux-2.6.38.7/arch/arm/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -246,7 +246,7 @@ void kgdb_arch_exit(void)
   * and we handle the normal undef case within the do_undefinstr
   * handler.
@@ -372,9 +372,9 @@ diff -urNp linux-2.6.38.2/arch/arm/kernel/kgdb.c linux-2.6.38.2/arch/arm/kernel/
  #ifndef __ARMEB__
  	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
  #else /* ! __ARMEB__ */
-diff -urNp linux-2.6.38.2/arch/arm/kernel/process.c linux-2.6.38.2/arch/arm/kernel/process.c
---- linux-2.6.38.2/arch/arm/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/kernel/process.c linux-2.6.38.7/arch/arm/kernel/process.c
+--- linux-2.6.38.7/arch/arm/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -28,7 +28,6 @@
  #include <linux/tick.h>
  #include <linux/utsname.h>
@@ -396,9 +396,9 @@ diff -urNp linux-2.6.38.2/arch/arm/kernel/process.c linux-2.6.38.2/arch/arm/kern
  #ifdef CONFIG_MMU
  /*
   * The vectors page is always readable from user space for the
-diff -urNp linux-2.6.38.2/arch/arm/mach-msm/last_radio_log.c linux-2.6.38.2/arch/arm/mach-msm/last_radio_log.c
---- linux-2.6.38.2/arch/arm/mach-msm/last_radio_log.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/mach-msm/last_radio_log.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/mach-msm/last_radio_log.c linux-2.6.38.7/arch/arm/mach-msm/last_radio_log.c
+--- linux-2.6.38.7/arch/arm/mach-msm/last_radio_log.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/mach-msm/last_radio_log.c	2011-04-28 19:34:14.000000000 -0400
 @@ -47,7 +47,7 @@ static ssize_t last_radio_log_read(struc
  	return count;
  }
@@ -408,9 +408,9 @@ diff -urNp linux-2.6.38.2/arch/arm/mach-msm/last_radio_log.c linux-2.6.38.2/arch
  	.read = last_radio_log_read,
  	.llseek = default_llseek,
  };
-diff -urNp linux-2.6.38.2/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.38.2/arch/arm/mach-ux500/mbox-db5500.c
---- linux-2.6.38.2/arch/arm/mach-ux500/mbox-db5500.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/mach-ux500/mbox-db5500.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.38.7/arch/arm/mach-ux500/mbox-db5500.c
+--- linux-2.6.38.7/arch/arm/mach-ux500/mbox-db5500.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/mach-ux500/mbox-db5500.c	2011-04-28 19:34:14.000000000 -0400
 @@ -168,7 +168,7 @@ static ssize_t mbox_read_fifo(struct dev
  	return sprintf(buf, "0x%X\n", mbox_value);
  }
@@ -420,9 +420,9 @@ diff -urNp linux-2.6.38.2/arch/arm/mach-ux500/mbox-db5500.c linux-2.6.38.2/arch/
  
  static int mbox_show(struct seq_file *s, void *data)
  {
-diff -urNp linux-2.6.38.2/arch/arm/mm/fault.c linux-2.6.38.2/arch/arm/mm/fault.c
---- linux-2.6.38.2/arch/arm/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/mm/fault.c linux-2.6.38.7/arch/arm/mm/fault.c
+--- linux-2.6.38.7/arch/arm/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -167,6 +167,13 @@ __do_user_fault(struct task_struct *tsk,
  	}
  #endif
@@ -471,9 +471,9 @@ diff -urNp linux-2.6.38.2/arch/arm/mm/fault.c linux-2.6.38.2/arch/arm/mm/fault.c
  /*
   * First Level Translation Fault Handler
   *
-diff -urNp linux-2.6.38.2/arch/arm/mm/mmap.c linux-2.6.38.2/arch/arm/mm/mmap.c
---- linux-2.6.38.2/arch/arm/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/arm/mm/mmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/arm/mm/mmap.c linux-2.6.38.7/arch/arm/mm/mmap.c
+--- linux-2.6.38.7/arch/arm/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/arm/mm/mmap.c	2011-04-28 19:34:14.000000000 -0400
 @@ -64,6 +64,10 @@ arch_get_unmapped_area(struct file *filp
  	if (len > TASK_SIZE)
  		return -ENOMEM;
@@ -523,9 +523,9 @@ diff -urNp linux-2.6.38.2/arch/arm/mm/mmap.c linux-2.6.38.2/arch/arm/mm/mmap.c
  			/*
  			 * Remember the place where we stopped the search:
  			 */
-diff -urNp linux-2.6.38.2/arch/avr32/include/asm/elf.h linux-2.6.38.2/arch/avr32/include/asm/elf.h
---- linux-2.6.38.2/arch/avr32/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/avr32/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/avr32/include/asm/elf.h linux-2.6.38.7/arch/avr32/include/asm/elf.h
+--- linux-2.6.38.7/arch/avr32/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/avr32/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -84,8 +84,14 @@ typedef struct user_fpu_struct elf_fpreg
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
@@ -542,9 +542,9 @@ diff -urNp linux-2.6.38.2/arch/avr32/include/asm/elf.h linux-2.6.38.2/arch/avr32
  
  /* This yields a mask that user programs can use to figure out what
     instruction set this CPU supports.  This could be done in user space,
-diff -urNp linux-2.6.38.2/arch/avr32/include/asm/kmap_types.h linux-2.6.38.2/arch/avr32/include/asm/kmap_types.h
---- linux-2.6.38.2/arch/avr32/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/avr32/include/asm/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/avr32/include/asm/kmap_types.h linux-2.6.38.7/arch/avr32/include/asm/kmap_types.h
+--- linux-2.6.38.7/arch/avr32/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/avr32/include/asm/kmap_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -22,7 +22,8 @@ D(10)	KM_IRQ0,
  D(11)	KM_IRQ1,
  D(12)	KM_SOFTIRQ0,
@@ -555,9 +555,9 @@ diff -urNp linux-2.6.38.2/arch/avr32/include/asm/kmap_types.h linux-2.6.38.2/arc
  };
  
  #undef D
-diff -urNp linux-2.6.38.2/arch/avr32/mm/fault.c linux-2.6.38.2/arch/avr32/mm/fault.c
---- linux-2.6.38.2/arch/avr32/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/avr32/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/avr32/mm/fault.c linux-2.6.38.7/arch/avr32/mm/fault.c
+--- linux-2.6.38.7/arch/avr32/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/avr32/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
  
  int exception_trace = 1;
@@ -599,9 +599,9 @@ diff -urNp linux-2.6.38.2/arch/avr32/mm/fault.c linux-2.6.38.2/arch/avr32/mm/fau
  		if (exception_trace && printk_ratelimit())
  			printk("%s%s[%d]: segfault at %08lx pc %08lx "
  			       "sp %08lx ecr %lu\n",
-diff -urNp linux-2.6.38.2/arch/blackfin/kernel/kgdb.c linux-2.6.38.2/arch/blackfin/kernel/kgdb.c
---- linux-2.6.38.2/arch/blackfin/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/blackfin/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/blackfin/kernel/kgdb.c linux-2.6.38.7/arch/blackfin/kernel/kgdb.c
+--- linux-2.6.38.7/arch/blackfin/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/blackfin/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -420,7 +420,7 @@ int kgdb_arch_handle_exception(int vecto
  	return -1;		/* this means that we do not want to exit from the handler */
  }
@@ -611,9 +611,9 @@ diff -urNp linux-2.6.38.2/arch/blackfin/kernel/kgdb.c linux-2.6.38.2/arch/blackf
  	.gdb_bpt_instr = {0xa1},
  #ifdef CONFIG_SMP
  	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
-diff -urNp linux-2.6.38.2/arch/blackfin/mm/maccess.c linux-2.6.38.2/arch/blackfin/mm/maccess.c
---- linux-2.6.38.2/arch/blackfin/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/blackfin/mm/maccess.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/blackfin/mm/maccess.c linux-2.6.38.7/arch/blackfin/mm/maccess.c
+--- linux-2.6.38.7/arch/blackfin/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/blackfin/mm/maccess.c	2011-04-28 19:34:14.000000000 -0400
 @@ -16,7 +16,7 @@ static int validate_memory_access_addres
  	return bfin_mem_access_type(addr, size);
  }
@@ -632,9 +632,9 @@ diff -urNp linux-2.6.38.2/arch/blackfin/mm/maccess.c linux-2.6.38.2/arch/blackfi
  {
  	unsigned long ldst = (unsigned long)dst;
  	int mem_type;
-diff -urNp linux-2.6.38.2/arch/frv/include/asm/kmap_types.h linux-2.6.38.2/arch/frv/include/asm/kmap_types.h
---- linux-2.6.38.2/arch/frv/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/frv/include/asm/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/frv/include/asm/kmap_types.h linux-2.6.38.7/arch/frv/include/asm/kmap_types.h
+--- linux-2.6.38.7/arch/frv/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/frv/include/asm/kmap_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -23,6 +23,7 @@ enum km_type {
  	KM_IRQ1,
  	KM_SOFTIRQ0,
@@ -643,9 +643,9 @@ diff -urNp linux-2.6.38.2/arch/frv/include/asm/kmap_types.h linux-2.6.38.2/arch/
  	KM_TYPE_NR
  };
  
-diff -urNp linux-2.6.38.2/arch/frv/mm/elf-fdpic.c linux-2.6.38.2/arch/frv/mm/elf-fdpic.c
---- linux-2.6.38.2/arch/frv/mm/elf-fdpic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/frv/mm/elf-fdpic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/frv/mm/elf-fdpic.c linux-2.6.38.7/arch/frv/mm/elf-fdpic.c
+--- linux-2.6.38.7/arch/frv/mm/elf-fdpic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/frv/mm/elf-fdpic.c	2011-04-28 19:34:14.000000000 -0400
 @@ -73,8 +73,7 @@ unsigned long arch_get_unmapped_area(str
  	if (addr) {
  		addr = PAGE_ALIGN(addr);
@@ -674,9 +674,9 @@ diff -urNp linux-2.6.38.2/arch/frv/mm/elf-fdpic.c linux-2.6.38.2/arch/frv/mm/elf
  				goto success;
  			addr = vma->vm_end;
  		}
-diff -urNp linux-2.6.38.2/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.38.2/arch/ia64/hp/common/hwsw_iommu.c
---- linux-2.6.38.2/arch/ia64/hp/common/hwsw_iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/hp/common/hwsw_iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.38.7/arch/ia64/hp/common/hwsw_iommu.c
+--- linux-2.6.38.7/arch/ia64/hp/common/hwsw_iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/hp/common/hwsw_iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -17,7 +17,7 @@
  #include <linux/swiotlb.h>
  #include <asm/machvec.h>
@@ -695,9 +695,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.38.2/arch/i
  {
  	if (use_swiotlb(dev))
  		return &swiotlb_dma_ops;
-diff -urNp linux-2.6.38.2/arch/ia64/hp/common/sba_iommu.c linux-2.6.38.2/arch/ia64/hp/common/sba_iommu.c
---- linux-2.6.38.2/arch/ia64/hp/common/sba_iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/hp/common/sba_iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/hp/common/sba_iommu.c linux-2.6.38.7/arch/ia64/hp/common/sba_iommu.c
+--- linux-2.6.38.7/arch/ia64/hp/common/sba_iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/hp/common/sba_iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -2097,7 +2097,7 @@ static struct acpi_driver acpi_sba_ioc_d
  	},
  };
@@ -716,9 +716,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/hp/common/sba_iommu.c linux-2.6.38.2/arch/ia
  	.alloc_coherent		= sba_alloc_coherent,
  	.free_coherent		= sba_free_coherent,
  	.map_page		= sba_map_page,
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/dma-mapping.h linux-2.6.38.2/arch/ia64/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/ia64/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/dma-mapping.h linux-2.6.38.7/arch/ia64/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/ia64/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,7 +12,7 @@
  
  #define ARCH_HAS_DMA_GET_REQUIRED_MASK
@@ -762,9 +762,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/dma-mapping.h linux-2.6.38.2/arc
  	return ops->dma_supported(dev, mask);
  }
  
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/elf.h linux-2.6.38.2/arch/ia64/include/asm/elf.h
---- linux-2.6.38.2/arch/ia64/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/elf.h linux-2.6.38.7/arch/ia64/include/asm/elf.h
+--- linux-2.6.38.7/arch/ia64/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -42,6 +42,13 @@
   */
  #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
@@ -779,9 +779,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/elf.h linux-2.6.38.2/arch/ia64/i
  #define PT_IA_64_UNWIND		0x70000001
  
  /* IA-64 relocations: */
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/machvec.h linux-2.6.38.2/arch/ia64/include/asm/machvec.h
---- linux-2.6.38.2/arch/ia64/include/asm/machvec.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/machvec.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/machvec.h linux-2.6.38.7/arch/ia64/include/asm/machvec.h
+--- linux-2.6.38.7/arch/ia64/include/asm/machvec.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/machvec.h	2011-04-28 19:34:14.000000000 -0400
 @@ -45,7 +45,7 @@ typedef void ia64_mv_kernel_launch_event
  /* DMA-mapping interface: */
  typedef void ia64_mv_dma_init (void);
@@ -800,9 +800,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/machvec.h linux-2.6.38.2/arch/ia
  
  /*
   * Define default versions so we can extend machvec for new platforms without having
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/pgtable.h linux-2.6.38.2/arch/ia64/include/asm/pgtable.h
---- linux-2.6.38.2/arch/ia64/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/pgtable.h linux-2.6.38.7/arch/ia64/include/asm/pgtable.h
+--- linux-2.6.38.7/arch/ia64/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/pgtable.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,7 +12,7 @@
   *	David Mosberger-Tang <davidm@hpl.hp.com>
   */
@@ -830,9 +830,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/pgtable.h linux-2.6.38.2/arch/ia
  #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
  #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
  #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/spinlock.h linux-2.6.38.2/arch/ia64/include/asm/spinlock.h
---- linux-2.6.38.2/arch/ia64/include/asm/spinlock.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/spinlock.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/spinlock.h linux-2.6.38.7/arch/ia64/include/asm/spinlock.h
+--- linux-2.6.38.7/arch/ia64/include/asm/spinlock.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/spinlock.h	2011-04-28 19:34:14.000000000 -0400
 @@ -72,7 +72,7 @@ static __always_inline void __ticket_spi
  	unsigned short	*p = (unsigned short *)&lock->lock + 1, tmp;
  
@@ -842,9 +842,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/spinlock.h linux-2.6.38.2/arch/i
  }
  
  static __always_inline void __ticket_spin_unlock_wait(arch_spinlock_t *lock)
-diff -urNp linux-2.6.38.2/arch/ia64/include/asm/uaccess.h linux-2.6.38.2/arch/ia64/include/asm/uaccess.h
---- linux-2.6.38.2/arch/ia64/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/include/asm/uaccess.h linux-2.6.38.7/arch/ia64/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/ia64/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -257,7 +257,7 @@ __copy_from_user (void *to, const void _
  	const void *__cu_from = (from);							\
  	long __cu_len = (n);								\
@@ -863,9 +863,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/include/asm/uaccess.h linux-2.6.38.2/arch/ia
  		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
  	__cu_len;									\
  })
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/dma-mapping.c linux-2.6.38.2/arch/ia64/kernel/dma-mapping.c
---- linux-2.6.38.2/arch/ia64/kernel/dma-mapping.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/dma-mapping.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/dma-mapping.c linux-2.6.38.7/arch/ia64/kernel/dma-mapping.c
+--- linux-2.6.38.7/arch/ia64/kernel/dma-mapping.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/dma-mapping.c	2011-04-28 19:34:14.000000000 -0400
 @@ -3,7 +3,7 @@
  /* Set this to 1 if there is a HW IOMMU in the system */
  int iommu_detected __read_mostly;
@@ -884,9 +884,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/dma-mapping.c linux-2.6.38.2/arch/ia6
  {
  	return dma_ops;
  }
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/module.c linux-2.6.38.2/arch/ia64/kernel/module.c
---- linux-2.6.38.2/arch/ia64/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/module.c linux-2.6.38.7/arch/ia64/kernel/module.c
+--- linux-2.6.38.7/arch/ia64/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -315,8 +315,7 @@ module_alloc (unsigned long size)
  void
  module_free (struct module *mod, void *module_region)
@@ -975,9 +975,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/module.c linux-2.6.38.2/arch/ia64/ker
  		mod->arch.gp = gp;
  		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
  	}
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/pci-dma.c linux-2.6.38.2/arch/ia64/kernel/pci-dma.c
---- linux-2.6.38.2/arch/ia64/kernel/pci-dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/pci-dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/pci-dma.c linux-2.6.38.7/arch/ia64/kernel/pci-dma.c
+--- linux-2.6.38.7/arch/ia64/kernel/pci-dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/pci-dma.c	2011-04-28 19:34:14.000000000 -0400
 @@ -43,7 +43,7 @@ struct device fallback_dev = {
  	.dma_mask = &fallback_dev.coherent_dma_mask,
  };
@@ -987,9 +987,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/pci-dma.c linux-2.6.38.2/arch/ia64/ke
  
  static int __init pci_iommu_init(void)
  {
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/pci-swiotlb.c linux-2.6.38.2/arch/ia64/kernel/pci-swiotlb.c
---- linux-2.6.38.2/arch/ia64/kernel/pci-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/pci-swiotlb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/pci-swiotlb.c linux-2.6.38.7/arch/ia64/kernel/pci-swiotlb.c
+--- linux-2.6.38.7/arch/ia64/kernel/pci-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/pci-swiotlb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -22,7 +22,7 @@ static void *ia64_swiotlb_alloc_coherent
  	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
  }
@@ -999,9 +999,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/pci-swiotlb.c linux-2.6.38.2/arch/ia6
  	.alloc_coherent = ia64_swiotlb_alloc_coherent,
  	.free_coherent = swiotlb_free_coherent,
  	.map_page = swiotlb_map_page,
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/sys_ia64.c linux-2.6.38.2/arch/ia64/kernel/sys_ia64.c
---- linux-2.6.38.2/arch/ia64/kernel/sys_ia64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/sys_ia64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/sys_ia64.c linux-2.6.38.7/arch/ia64/kernel/sys_ia64.c
+--- linux-2.6.38.7/arch/ia64/kernel/sys_ia64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/sys_ia64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -43,6 +43,13 @@ arch_get_unmapped_area (struct file *fil
  	if (REGION_NUMBER(addr) == RGN_HPAGE)
  		addr = 0;
@@ -1034,9 +1034,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/sys_ia64.c linux-2.6.38.2/arch/ia64/k
  			/* Remember the address where we stopped this search:  */
  			mm->free_area_cache = addr + len;
  			return addr;
-diff -urNp linux-2.6.38.2/arch/ia64/kernel/vmlinux.lds.S linux-2.6.38.2/arch/ia64/kernel/vmlinux.lds.S
---- linux-2.6.38.2/arch/ia64/kernel/vmlinux.lds.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/kernel/vmlinux.lds.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/kernel/vmlinux.lds.S linux-2.6.38.7/arch/ia64/kernel/vmlinux.lds.S
+--- linux-2.6.38.7/arch/ia64/kernel/vmlinux.lds.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/kernel/vmlinux.lds.S	2011-04-28 19:34:14.000000000 -0400
 @@ -199,7 +199,7 @@ SECTIONS {
  	/* Per-cpu data: */
  	. = ALIGN(PERCPU_PAGE_SIZE);
@@ -1046,9 +1046,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/kernel/vmlinux.lds.S linux-2.6.38.2/arch/ia6
  	/*
  	 * ensure percpu data fits
  	 * into percpu page size
-diff -urNp linux-2.6.38.2/arch/ia64/mm/fault.c linux-2.6.38.2/arch/ia64/mm/fault.c
---- linux-2.6.38.2/arch/ia64/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/mm/fault.c linux-2.6.38.7/arch/ia64/mm/fault.c
+--- linux-2.6.38.7/arch/ia64/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -72,6 +72,23 @@ mapped_kernel_page_is_present (unsigned 
  	return pte_present(pte);
  }
@@ -1098,9 +1098,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/mm/fault.c linux-2.6.38.2/arch/ia64/mm/fault
  	/*
  	 * If for any reason at all we couldn't handle the fault, make
  	 * sure we exit gracefully rather than endlessly redo the
-diff -urNp linux-2.6.38.2/arch/ia64/mm/hugetlbpage.c linux-2.6.38.2/arch/ia64/mm/hugetlbpage.c
---- linux-2.6.38.2/arch/ia64/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/mm/hugetlbpage.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/mm/hugetlbpage.c linux-2.6.38.7/arch/ia64/mm/hugetlbpage.c
+--- linux-2.6.38.7/arch/ia64/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/mm/hugetlbpage.c	2011-04-28 19:34:14.000000000 -0400
 @@ -171,7 +171,7 @@ unsigned long hugetlb_get_unmapped_area(
  		/* At this point:  (!vmm || addr < vmm->vm_end). */
  		if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
@@ -1110,9 +1110,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/mm/hugetlbpage.c linux-2.6.38.2/arch/ia64/mm
  			return addr;
  		addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
  	}
-diff -urNp linux-2.6.38.2/arch/ia64/mm/init.c linux-2.6.38.2/arch/ia64/mm/init.c
---- linux-2.6.38.2/arch/ia64/mm/init.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/mm/init.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/mm/init.c linux-2.6.38.7/arch/ia64/mm/init.c
+--- linux-2.6.38.7/arch/ia64/mm/init.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/mm/init.c	2011-04-28 19:34:14.000000000 -0400
 @@ -122,6 +122,19 @@ ia64_init_addr_space (void)
  		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
  		vma->vm_end = vma->vm_start + PAGE_SIZE;
@@ -1133,9 +1133,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/mm/init.c linux-2.6.38.2/arch/ia64/mm/init.c
  		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  		down_write(&current->mm->mmap_sem);
  		if (insert_vm_struct(current->mm, vma)) {
-diff -urNp linux-2.6.38.2/arch/ia64/sn/pci/pci_dma.c linux-2.6.38.2/arch/ia64/sn/pci/pci_dma.c
---- linux-2.6.38.2/arch/ia64/sn/pci/pci_dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/ia64/sn/pci/pci_dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/ia64/sn/pci/pci_dma.c linux-2.6.38.7/arch/ia64/sn/pci/pci_dma.c
+--- linux-2.6.38.7/arch/ia64/sn/pci/pci_dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/ia64/sn/pci/pci_dma.c	2011-04-28 19:34:14.000000000 -0400
 @@ -465,7 +465,7 @@ int sn_pci_legacy_write(struct pci_bus *
  	return ret;
  }
@@ -1145,9 +1145,9 @@ diff -urNp linux-2.6.38.2/arch/ia64/sn/pci/pci_dma.c linux-2.6.38.2/arch/ia64/sn
  	.alloc_coherent		= sn_dma_alloc_coherent,
  	.free_coherent		= sn_dma_free_coherent,
  	.map_page		= sn_dma_map_page,
-diff -urNp linux-2.6.38.2/arch/m32r/lib/usercopy.c linux-2.6.38.2/arch/m32r/lib/usercopy.c
---- linux-2.6.38.2/arch/m32r/lib/usercopy.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/m32r/lib/usercopy.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/m32r/lib/usercopy.c linux-2.6.38.7/arch/m32r/lib/usercopy.c
+--- linux-2.6.38.7/arch/m32r/lib/usercopy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/m32r/lib/usercopy.c	2011-04-28 19:34:14.000000000 -0400
 @@ -14,6 +14,9 @@
  unsigned long
  __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
@@ -1168,9 +1168,9 @@ diff -urNp linux-2.6.38.2/arch/m32r/lib/usercopy.c linux-2.6.38.2/arch/m32r/lib/
  	prefetchw(to);
  	if (access_ok(VERIFY_READ, from, n))
  		__copy_user_zeroing(to,from,n);
-diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/device.h linux-2.6.38.2/arch/microblaze/include/asm/device.h
---- linux-2.6.38.2/arch/microblaze/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/include/asm/device.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/include/asm/device.h linux-2.6.38.7/arch/microblaze/include/asm/device.h
+--- linux-2.6.38.7/arch/microblaze/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/include/asm/device.h	2011-04-28 19:34:14.000000000 -0400
 @@ -13,7 +13,7 @@ struct device_node;
  
  struct dev_archdata {
@@ -1180,9 +1180,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/device.h linux-2.6.38.2/ar
  	void                    *dma_data;
  };
  
-diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/dma-mapping.h linux-2.6.38.2/arch/microblaze/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/microblaze/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/include/asm/dma-mapping.h linux-2.6.38.7/arch/microblaze/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/microblaze/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -43,14 +43,14 @@ static inline unsigned long device_to_ma
  	return 0xfffffffful;
  }
@@ -1254,9 +1254,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/dma-mapping.h linux-2.6.38
  
  	BUG_ON(!ops);
  	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/pci.h linux-2.6.38.2/arch/microblaze/include/asm/pci.h
---- linux-2.6.38.2/arch/microblaze/include/asm/pci.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/include/asm/pci.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/include/asm/pci.h linux-2.6.38.7/arch/microblaze/include/asm/pci.h
+--- linux-2.6.38.7/arch/microblaze/include/asm/pci.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/include/asm/pci.h	2011-04-28 19:34:14.000000000 -0400
 @@ -54,8 +54,8 @@ static inline void pcibios_penalize_isa_
  }
  
@@ -1268,9 +1268,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/include/asm/pci.h linux-2.6.38.2/arch/
  #else	/* CONFIG_PCI */
  #define set_pci_dma_ops(d)
  #define get_pci_dma_ops()	NULL
-diff -urNp linux-2.6.38.2/arch/microblaze/kernel/dma.c linux-2.6.38.2/arch/microblaze/kernel/dma.c
---- linux-2.6.38.2/arch/microblaze/kernel/dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/kernel/dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/kernel/dma.c linux-2.6.38.7/arch/microblaze/kernel/dma.c
+--- linux-2.6.38.7/arch/microblaze/kernel/dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/kernel/dma.c	2011-04-28 19:34:14.000000000 -0400
 @@ -133,7 +133,7 @@ static inline void dma_direct_unmap_page
  	__dma_sync_page(dma_address, 0 , size, direction);
  }
@@ -1280,9 +1280,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/kernel/dma.c linux-2.6.38.2/arch/micro
  	.alloc_coherent	= dma_direct_alloc_coherent,
  	.free_coherent	= dma_direct_free_coherent,
  	.map_sg		= dma_direct_map_sg,
-diff -urNp linux-2.6.38.2/arch/microblaze/kernel/kgdb.c linux-2.6.38.2/arch/microblaze/kernel/kgdb.c
---- linux-2.6.38.2/arch/microblaze/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/kernel/kgdb.c linux-2.6.38.7/arch/microblaze/kernel/kgdb.c
+--- linux-2.6.38.7/arch/microblaze/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -141,10 +141,11 @@ void kgdb_arch_exit(void)
  /*
   * Global data
@@ -1296,9 +1296,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/kernel/kgdb.c linux-2.6.38.2/arch/micr
  	.gdb_bpt_instr = {0xba, 0x0c, 0x00, 0x18}, /* brki r16, 0x18 */
  #endif
  };
-diff -urNp linux-2.6.38.2/arch/microblaze/pci/pci-common.c linux-2.6.38.2/arch/microblaze/pci/pci-common.c
---- linux-2.6.38.2/arch/microblaze/pci/pci-common.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/microblaze/pci/pci-common.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/microblaze/pci/pci-common.c linux-2.6.38.7/arch/microblaze/pci/pci-common.c
+--- linux-2.6.38.7/arch/microblaze/pci/pci-common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/microblaze/pci/pci-common.c	2011-04-28 19:34:14.000000000 -0400
 @@ -47,14 +47,14 @@ resource_size_t isa_mem_base;
  /* Default PCI flags is 0 on ppc32, modified at boot on ppc64 */
  unsigned int pci_flags;
@@ -1317,9 +1317,9 @@ diff -urNp linux-2.6.38.2/arch/microblaze/pci/pci-common.c linux-2.6.38.2/arch/m
  {
  	return pci_dma_ops;
  }
-diff -urNp linux-2.6.38.2/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.38.2/arch/mips/cavium-octeon/dma-octeon.c
---- linux-2.6.38.2/arch/mips/cavium-octeon/dma-octeon.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/cavium-octeon/dma-octeon.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.38.7/arch/mips/cavium-octeon/dma-octeon.c
+--- linux-2.6.38.7/arch/mips/cavium-octeon/dma-octeon.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/cavium-octeon/dma-octeon.c	2011-04-28 19:34:14.000000000 -0400
 @@ -202,7 +202,7 @@ static phys_addr_t octeon_unity_dma_to_p
  }
  
@@ -1338,9 +1338,9 @@ diff -urNp linux-2.6.38.2/arch/mips/cavium-octeon/dma-octeon.c linux-2.6.38.2/ar
  
  void __init octeon_pci_dma_init(void)
  {
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/device.h linux-2.6.38.2/arch/mips/include/asm/device.h
---- linux-2.6.38.2/arch/mips/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/device.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/device.h linux-2.6.38.7/arch/mips/include/asm/device.h
+--- linux-2.6.38.7/arch/mips/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/device.h	2011-04-28 19:34:14.000000000 -0400
 @@ -10,7 +10,7 @@ struct dma_map_ops;
  
  struct dev_archdata {
@@ -1350,9 +1350,9 @@ diff -urNp linux-2.6.38.2/arch/mips/include/asm/device.h linux-2.6.38.2/arch/mip
  };
  
  struct pdev_archdata {
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/dma-mapping.h linux-2.6.38.2/arch/mips/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/mips/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/dma-mapping.h linux-2.6.38.7/arch/mips/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/mips/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -7,9 +7,9 @@
  
  #include <dma-coherence.h>
@@ -1399,18 +1399,18 @@ diff -urNp linux-2.6.38.2/arch/mips/include/asm/dma-mapping.h linux-2.6.38.2/arc
  
  	ops->free_coherent(dev, size, vaddr, dma_handle);
  
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/elf.h linux-2.6.38.2/arch/mips/include/asm/elf.h
---- linux-2.6.38.2/arch/mips/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/elf.h linux-2.6.38.7/arch/mips/include/asm/elf.h
+--- linux-2.6.38.7/arch/mips/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/elf.h	2011-04-30 19:58:48.000000000 -0400
 @@ -372,13 +372,16 @@ extern const char *__elf_platform;
  #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
  #endif
  
 +#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++#define PAX_ELF_ET_DYN_BASE	(TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
 +
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_MMAP_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
 +#endif
 +
  #define ARCH_HAS_SETUP_ADDITIONAL_PAGES 1
@@ -1423,9 +1423,9 @@ diff -urNp linux-2.6.38.2/arch/mips/include/asm/elf.h linux-2.6.38.2/arch/mips/i
 -#define arch_randomize_brk arch_randomize_brk
 -
  #endif /* _ASM_ELF_H */
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.38.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
---- linux-2.6.38.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h linux-2.6.38.7/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h
+--- linux-2.6.38.7/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/mach-cavium-octeon/dma-coherence.h	2011-04-28 19:34:14.000000000 -0400
 @@ -66,7 +66,7 @@ dma_addr_t phys_to_dma(struct device *de
  phys_addr_t dma_to_phys(struct device *dev, dma_addr_t daddr);
  
@@ -1435,9 +1435,9 @@ diff -urNp linux-2.6.38.2/arch/mips/include/asm/mach-cavium-octeon/dma-coherence
  extern char *octeon_swiotlb;
  
  #endif /* __ASM_MACH_CAVIUM_OCTEON_DMA_COHERENCE_H */
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/page.h linux-2.6.38.2/arch/mips/include/asm/page.h
---- linux-2.6.38.2/arch/mips/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/page.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/page.h linux-2.6.38.7/arch/mips/include/asm/page.h
+--- linux-2.6.38.7/arch/mips/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/page.h	2011-04-28 19:34:14.000000000 -0400
 @@ -93,7 +93,7 @@ extern void copy_user_highpage(struct pa
    #ifdef CONFIG_CPU_MIPS32
      typedef struct { unsigned long pte_low, pte_high; } pte_t;
@@ -1447,62 +1447,54 @@ diff -urNp linux-2.6.38.2/arch/mips/include/asm/page.h linux-2.6.38.2/arch/mips/
    #else
       typedef struct { unsigned long long pte; } pte_t;
       #define pte_val(x)	((x).pte)
-diff -urNp linux-2.6.38.2/arch/mips/include/asm/system.h linux-2.6.38.2/arch/mips/include/asm/system.h
---- linux-2.6.38.2/arch/mips/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/include/asm/system.h	2011-03-21 18:31:35.000000000 -0400
-@@ -23,6 +23,7 @@
- #include <asm/dsp.h>
- #include <asm/watch.h>
- #include <asm/war.h>
-+#include <asm/asm.h>
- 
- 
- /*
-@@ -230,6 +231,6 @@ extern void per_cpu_trap_init(void);
+diff -urNp linux-2.6.38.7/arch/mips/include/asm/system.h linux-2.6.38.7/arch/mips/include/asm/system.h
+--- linux-2.6.38.7/arch/mips/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/include/asm/system.h	2011-04-28 19:34:14.000000000 -0400
+@@ -230,6 +230,6 @@ extern void per_cpu_trap_init(void);
   */
  #define __ARCH_WANT_UNLOCKED_CTXSW
  
 -extern unsigned long arch_align_stack(unsigned long sp);
-+#define arch_align_stack(x) ((x) & ALMASK)
++#define arch_align_stack(x) ((x) & ~0xfUL)
  
  #endif /* _ASM_SYSTEM_H */
-diff -urNp linux-2.6.38.2/arch/mips/kernel/binfmt_elfn32.c linux-2.6.38.2/arch/mips/kernel/binfmt_elfn32.c
---- linux-2.6.38.2/arch/mips/kernel/binfmt_elfn32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/kernel/binfmt_elfn32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/kernel/binfmt_elfn32.c linux-2.6.38.7/arch/mips/kernel/binfmt_elfn32.c
+--- linux-2.6.38.7/arch/mips/kernel/binfmt_elfn32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/kernel/binfmt_elfn32.c	2011-04-30 19:58:48.000000000 -0400
 @@ -50,6 +50,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
  #undef ELF_ET_DYN_BASE
  #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
  
 +#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++#define PAX_ELF_ET_DYN_BASE	(TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
 +
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_MMAP_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
 +#endif
 +
  #include <asm/processor.h>
  #include <linux/module.h>
  #include <linux/elfcore.h>
-diff -urNp linux-2.6.38.2/arch/mips/kernel/binfmt_elfo32.c linux-2.6.38.2/arch/mips/kernel/binfmt_elfo32.c
---- linux-2.6.38.2/arch/mips/kernel/binfmt_elfo32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/kernel/binfmt_elfo32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/kernel/binfmt_elfo32.c linux-2.6.38.7/arch/mips/kernel/binfmt_elfo32.c
+--- linux-2.6.38.7/arch/mips/kernel/binfmt_elfo32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/kernel/binfmt_elfo32.c	2011-04-30 19:58:48.000000000 -0400
 @@ -52,6 +52,13 @@ typedef elf_fpreg_t elf_fpregset_t[ELF_N
  #undef ELF_ET_DYN_BASE
  #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
  
 +#ifdef CONFIG_PAX_ASLR
-+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
++#define PAX_ELF_ET_DYN_BASE	(TASK_IS_32BIT_ADDR ? 0x00400000UL : 0x00400000UL)
 +
-+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
-+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_MMAP_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
++#define PAX_DELTA_STACK_LEN	(TASK_IS_32BIT_ADDR ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
 +#endif
 +
  #include <asm/processor.h>
  
  /*
-diff -urNp linux-2.6.38.2/arch/mips/kernel/kgdb.c linux-2.6.38.2/arch/mips/kernel/kgdb.c
---- linux-2.6.38.2/arch/mips/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/kernel/kgdb.c linux-2.6.38.7/arch/mips/kernel/kgdb.c
+--- linux-2.6.38.7/arch/mips/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -351,7 +351,7 @@ int kgdb_arch_handle_exception(int vecto
  	return -1;
  }
@@ -1512,9 +1504,9 @@ diff -urNp linux-2.6.38.2/arch/mips/kernel/kgdb.c linux-2.6.38.2/arch/mips/kerne
  
  /*
   * We use kgdb_early_setup so that functions we need to call now don't
-diff -urNp linux-2.6.38.2/arch/mips/kernel/process.c linux-2.6.38.2/arch/mips/kernel/process.c
---- linux-2.6.38.2/arch/mips/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/kernel/process.c linux-2.6.38.7/arch/mips/kernel/process.c
+--- linux-2.6.38.7/arch/mips/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -473,15 +473,3 @@ unsigned long get_wchan(struct task_stru
  out:
  	return pc;
@@ -1531,9 +1523,9 @@ diff -urNp linux-2.6.38.2/arch/mips/kernel/process.c linux-2.6.38.2/arch/mips/ke
 -
 -	return sp & ALMASK;
 -}
-diff -urNp linux-2.6.38.2/arch/mips/kernel/syscall.c linux-2.6.38.2/arch/mips/kernel/syscall.c
---- linux-2.6.38.2/arch/mips/kernel/syscall.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/kernel/syscall.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/kernel/syscall.c linux-2.6.38.7/arch/mips/kernel/syscall.c
+--- linux-2.6.38.7/arch/mips/kernel/syscall.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/kernel/syscall.c	2011-04-30 19:58:48.000000000 -0400
 @@ -108,14 +108,18 @@ unsigned long arch_get_unmapped_area(str
  	do_color_align = 0;
  	if (filp || (flags & MAP_SHARED))
@@ -1564,10 +1556,24 @@ diff -urNp linux-2.6.38.2/arch/mips/kernel/syscall.c linux-2.6.38.2/arch/mips/ke
  			return addr;
  		addr = vmm->vm_end;
  		if (do_color_align)
-@@ -168,19 +172,6 @@ static inline unsigned long brk_rnd(void
- 	return rnd;
+@@ -154,33 +158,6 @@ void arch_pick_mmap_layout(struct mm_str
+ 	mm->unmap_area = arch_unmap_area;
  }
  
+-static inline unsigned long brk_rnd(void)
+-{
+-	unsigned long rnd = get_random_int();
+-
+-	rnd = rnd << PAGE_SHIFT;
+-	/* 8MB for 32bit, 256MB for 64bit */
+-	if (TASK_IS_32BIT_ADDR)
+-		rnd = rnd & 0x7ffffful;
+-	else
+-		rnd = rnd & 0xffffffful;
+-
+-	return rnd;
+-}
+-
 -unsigned long arch_randomize_brk(struct mm_struct *mm)
 -{
 -	unsigned long base = mm->brk;
@@ -1584,9 +1590,9 @@ diff -urNp linux-2.6.38.2/arch/mips/kernel/syscall.c linux-2.6.38.2/arch/mips/ke
  SYSCALL_DEFINE6(mips_mmap, unsigned long, addr, unsigned long, len,
  	unsigned long, prot, unsigned long, flags, unsigned long,
  	fd, off_t, offset)
-diff -urNp linux-2.6.38.2/arch/mips/mm/dma-default.c linux-2.6.38.2/arch/mips/mm/dma-default.c
---- linux-2.6.38.2/arch/mips/mm/dma-default.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/mm/dma-default.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/mm/dma-default.c linux-2.6.38.7/arch/mips/mm/dma-default.c
+--- linux-2.6.38.7/arch/mips/mm/dma-default.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/mm/dma-default.c	2011-04-28 19:34:14.000000000 -0400
 @@ -300,7 +300,7 @@ void dma_cache_sync(struct device *dev, 
  
  EXPORT_SYMBOL(dma_cache_sync);
@@ -1605,9 +1611,9 @@ diff -urNp linux-2.6.38.2/arch/mips/mm/dma-default.c linux-2.6.38.2/arch/mips/mm
  EXPORT_SYMBOL(mips_dma_map_ops);
  
  #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
-diff -urNp linux-2.6.38.2/arch/mips/mm/fault.c linux-2.6.38.2/arch/mips/mm/fault.c
---- linux-2.6.38.2/arch/mips/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/mips/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/mips/mm/fault.c linux-2.6.38.7/arch/mips/mm/fault.c
+--- linux-2.6.38.7/arch/mips/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/mips/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -28,6 +28,23 @@
  #include <asm/highmem.h>		/* For VMALLOC_END */
  #include <linux/kdebug.h>
@@ -1632,9 +1638,9 @@ diff -urNp linux-2.6.38.2/arch/mips/mm/fault.c linux-2.6.38.2/arch/mips/mm/fault
  /*
   * This routine handles page faults.  It determines the address,
   * and the problem, and then passes it off to one of the appropriate
-diff -urNp linux-2.6.38.2/arch/parisc/include/asm/elf.h linux-2.6.38.2/arch/parisc/include/asm/elf.h
---- linux-2.6.38.2/arch/parisc/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/include/asm/elf.h linux-2.6.38.7/arch/parisc/include/asm/elf.h
+--- linux-2.6.38.7/arch/parisc/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -342,6 +342,13 @@ struct pt_regs;	/* forward declaration..
  
  #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
@@ -1649,9 +1655,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/include/asm/elf.h linux-2.6.38.2/arch/pari
  /* This yields a mask that user programs can use to figure out what
     instruction set this CPU supports.  This could be done in user space,
     but it's not easy, and we've already done it here.  */
-diff -urNp linux-2.6.38.2/arch/parisc/include/asm/pgtable.h linux-2.6.38.2/arch/parisc/include/asm/pgtable.h
---- linux-2.6.38.2/arch/parisc/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/include/asm/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/include/asm/pgtable.h linux-2.6.38.7/arch/parisc/include/asm/pgtable.h
+--- linux-2.6.38.7/arch/parisc/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/include/asm/pgtable.h	2011-04-28 19:34:14.000000000 -0400
 @@ -209,6 +209,17 @@ struct vm_area_struct;
  #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
  #define PAGE_COPY       PAGE_EXECREAD
@@ -1670,9 +1676,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/include/asm/pgtable.h linux-2.6.38.2/arch/
  #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
  #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
  #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
-diff -urNp linux-2.6.38.2/arch/parisc/kernel/module.c linux-2.6.38.2/arch/parisc/kernel/module.c
---- linux-2.6.38.2/arch/parisc/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/kernel/module.c linux-2.6.38.7/arch/parisc/kernel/module.c
+--- linux-2.6.38.7/arch/parisc/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -96,16 +96,38 @@
  
  /* three functions to determine where in the module core
@@ -1773,9 +1779,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/kernel/module.c linux-2.6.38.2/arch/parisc
  
  	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
  	       me->arch.unwind_section, table, end, gp);
-diff -urNp linux-2.6.38.2/arch/parisc/kernel/sys_parisc.c linux-2.6.38.2/arch/parisc/kernel/sys_parisc.c
---- linux-2.6.38.2/arch/parisc/kernel/sys_parisc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/kernel/sys_parisc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/kernel/sys_parisc.c linux-2.6.38.7/arch/parisc/kernel/sys_parisc.c
+--- linux-2.6.38.7/arch/parisc/kernel/sys_parisc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/kernel/sys_parisc.c	2011-04-28 19:34:14.000000000 -0400
 @@ -43,7 +43,7 @@ static unsigned long get_unshared_area(u
  		/* At this point:  (!vma || addr < vma->vm_end). */
  		if (TASK_SIZE - len < addr)
@@ -1803,9 +1809,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/kernel/sys_parisc.c linux-2.6.38.2/arch/pa
  
  	if (filp) {
  		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
-diff -urNp linux-2.6.38.2/arch/parisc/kernel/traps.c linux-2.6.38.2/arch/parisc/kernel/traps.c
---- linux-2.6.38.2/arch/parisc/kernel/traps.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/kernel/traps.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/kernel/traps.c linux-2.6.38.7/arch/parisc/kernel/traps.c
+--- linux-2.6.38.7/arch/parisc/kernel/traps.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/kernel/traps.c	2011-04-28 19:34:14.000000000 -0400
 @@ -733,9 +733,7 @@ void notrace handle_interruption(int cod
  
  			down_read(&current->mm->mmap_sem);
@@ -1817,9 +1823,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/kernel/traps.c linux-2.6.38.2/arch/parisc/
  				fault_address = regs->iaoq[0];
  				fault_space = regs->iasq[0];
  
-diff -urNp linux-2.6.38.2/arch/parisc/mm/fault.c linux-2.6.38.2/arch/parisc/mm/fault.c
---- linux-2.6.38.2/arch/parisc/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/parisc/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/parisc/mm/fault.c linux-2.6.38.7/arch/parisc/mm/fault.c
+--- linux-2.6.38.7/arch/parisc/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/parisc/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -15,6 +15,7 @@
  #include <linux/sched.h>
  #include <linux/interrupt.h>
@@ -1989,9 +1995,9 @@ diff -urNp linux-2.6.38.2/arch/parisc/mm/fault.c linux-2.6.38.2/arch/parisc/mm/f
  
  	/*
  	 * If for any reason at all we couldn't handle the fault, make
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/device.h linux-2.6.38.2/arch/powerpc/include/asm/device.h
---- linux-2.6.38.2/arch/powerpc/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/device.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/device.h linux-2.6.38.7/arch/powerpc/include/asm/device.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/device.h	2011-04-28 19:34:14.000000000 -0400
 @@ -17,7 +17,7 @@ struct device_node;
   */
  struct dev_archdata {
@@ -2001,9 +2007,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/device.h linux-2.6.38.2/arch/
  
  	/*
  	 * When an iommu is in use, dma_data is used as a ptr to the base of the
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/dma-mapping.h linux-2.6.38.2/arch/powerpc/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/powerpc/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/dma-mapping.h linux-2.6.38.7/arch/powerpc/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -66,12 +66,13 @@ static inline unsigned long device_to_ma
  /*
   * Available generic sets of operations
@@ -2066,9 +2072,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/dma-mapping.h linux-2.6.38.2/
  
  	if (dma_ops->mapping_error)
  		return dma_ops->mapping_error(dev, dma_addr);
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/elf.h linux-2.6.38.2/arch/powerpc/include/asm/elf.h
---- linux-2.6.38.2/arch/powerpc/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/elf.h linux-2.6.38.7/arch/powerpc/include/asm/elf.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -178,8 +178,19 @@ typedef elf_fpreg_t elf_vsrreghalf_t32[E
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
@@ -2101,9 +2107,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/elf.h linux-2.6.38.2/arch/pow
  #endif /* __KERNEL__ */
  
  /*
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/iommu.h linux-2.6.38.2/arch/powerpc/include/asm/iommu.h
---- linux-2.6.38.2/arch/powerpc/include/asm/iommu.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/iommu.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/iommu.h linux-2.6.38.7/arch/powerpc/include/asm/iommu.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/iommu.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/iommu.h	2011-04-28 19:34:14.000000000 -0400
 @@ -116,6 +116,9 @@ extern void iommu_init_early_iSeries(voi
  extern void iommu_init_early_dart(void);
  extern void iommu_init_early_pasemi(void);
@@ -2114,9 +2120,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/iommu.h linux-2.6.38.2/arch/p
  #ifdef CONFIG_PCI
  extern void pci_iommu_init(void);
  extern void pci_direct_iommu_init(void);
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/kmap_types.h linux-2.6.38.2/arch/powerpc/include/asm/kmap_types.h
---- linux-2.6.38.2/arch/powerpc/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/kmap_types.h linux-2.6.38.7/arch/powerpc/include/asm/kmap_types.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/kmap_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -27,6 +27,7 @@ enum km_type {
  	KM_PPC_SYNC_PAGE,
  	KM_PPC_SYNC_ICACHE,
@@ -2125,9 +2131,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/kmap_types.h linux-2.6.38.2/a
  	KM_TYPE_NR
  };
  
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/page_64.h linux-2.6.38.2/arch/powerpc/include/asm/page_64.h
---- linux-2.6.38.2/arch/powerpc/include/asm/page_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/page_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/page_64.h linux-2.6.38.7/arch/powerpc/include/asm/page_64.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/page_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/page_64.h	2011-04-28 19:34:14.000000000 -0400
 @@ -172,15 +172,18 @@ do {						\
   * stack by default, so in the absense of a PT_GNU_STACK program header
   * we turn execute permission off.
@@ -2149,9 +2155,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/page_64.h linux-2.6.38.2/arch
  
  #include <asm-generic/getorder.h>
  
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/page.h linux-2.6.38.2/arch/powerpc/include/asm/page.h
---- linux-2.6.38.2/arch/powerpc/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/page.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/page.h linux-2.6.38.7/arch/powerpc/include/asm/page.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/page.h	2011-04-28 19:34:14.000000000 -0400
 @@ -129,8 +129,9 @@ extern phys_addr_t kernstart_addr;
   * and needs to be executable.  This means the whole heap ends
   * up being executable.
@@ -2174,9 +2180,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/page.h linux-2.6.38.2/arch/po
  #ifndef __ASSEMBLY__
  
  #undef STRICT_MM_TYPECHECKS
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pci.h linux-2.6.38.2/arch/powerpc/include/asm/pci.h
---- linux-2.6.38.2/arch/powerpc/include/asm/pci.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/pci.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/pci.h linux-2.6.38.7/arch/powerpc/include/asm/pci.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/pci.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/pci.h	2011-04-28 19:34:14.000000000 -0400
 @@ -65,8 +65,8 @@ static inline int pci_get_legacy_ide_irq
  }
  
@@ -2188,9 +2194,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pci.h linux-2.6.38.2/arch/pow
  #else	/* CONFIG_PCI */
  #define set_pci_dma_ops(d)
  #define get_pci_dma_ops()	NULL
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pgtable.h linux-2.6.38.2/arch/powerpc/include/asm/pgtable.h
---- linux-2.6.38.2/arch/powerpc/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/pgtable.h linux-2.6.38.7/arch/powerpc/include/asm/pgtable.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/pgtable.h	2011-04-28 19:34:14.000000000 -0400
 @@ -2,6 +2,7 @@
  #define _ASM_POWERPC_PGTABLE_H
  #ifdef __KERNEL__
@@ -2199,9 +2205,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pgtable.h linux-2.6.38.2/arch
  #ifndef __ASSEMBLY__
  #include <asm/processor.h>		/* For TASK_SIZE */
  #include <asm/mmu.h>
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pte-hash32.h linux-2.6.38.2/arch/powerpc/include/asm/pte-hash32.h
---- linux-2.6.38.2/arch/powerpc/include/asm/pte-hash32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/pte-hash32.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/pte-hash32.h linux-2.6.38.7/arch/powerpc/include/asm/pte-hash32.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/pte-hash32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/pte-hash32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -21,6 +21,7 @@
  #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
  #define _PAGE_USER	0x004	/* usermode access allowed */
@@ -2210,9 +2216,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/pte-hash32.h linux-2.6.38.2/a
  #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
  #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
  #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/reg.h linux-2.6.38.2/arch/powerpc/include/asm/reg.h
---- linux-2.6.38.2/arch/powerpc/include/asm/reg.h	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/reg.h	2011-03-23 17:21:43.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/reg.h linux-2.6.38.7/arch/powerpc/include/asm/reg.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/reg.h	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/reg.h	2011-04-28 19:34:14.000000000 -0400
 @@ -191,6 +191,7 @@
  #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
  #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
@@ -2221,9 +2227,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/reg.h linux-2.6.38.2/arch/pow
  #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
  #define   DSISR_ISSTORE		0x02000000	/* access was a store */
  #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/swiotlb.h linux-2.6.38.2/arch/powerpc/include/asm/swiotlb.h
---- linux-2.6.38.2/arch/powerpc/include/asm/swiotlb.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/swiotlb.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/swiotlb.h linux-2.6.38.7/arch/powerpc/include/asm/swiotlb.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/swiotlb.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/swiotlb.h	2011-04-28 19:34:14.000000000 -0400
 @@ -13,7 +13,7 @@
  
  #include <linux/swiotlb.h>
@@ -2233,9 +2239,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/swiotlb.h linux-2.6.38.2/arch
  
  static inline void dma_mark_clean(void *addr, size_t size) {}
  
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/system.h linux-2.6.38.2/arch/powerpc/include/asm/system.h
---- linux-2.6.38.2/arch/powerpc/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/system.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/system.h linux-2.6.38.7/arch/powerpc/include/asm/system.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/system.h	2011-04-28 19:34:14.000000000 -0400
 @@ -533,7 +533,7 @@ __cmpxchg_local(volatile void *ptr, unsi
  #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
  #endif
@@ -2245,9 +2251,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/system.h linux-2.6.38.2/arch/
  
  /* Used in very early kernel initialization. */
  extern unsigned long reloc_offset(void);
-diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/uaccess.h linux-2.6.38.2/arch/powerpc/include/asm/uaccess.h
---- linux-2.6.38.2/arch/powerpc/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/include/asm/uaccess.h linux-2.6.38.7/arch/powerpc/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/powerpc/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -13,6 +13,8 @@
  #define VERIFY_READ	0
  #define VERIFY_WRITE	1
@@ -2425,9 +2431,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/include/asm/uaccess.h linux-2.6.38.2/arch
  extern unsigned long __clear_user(void __user *addr, unsigned long size);
  
  static inline unsigned long clear_user(void __user *addr, unsigned long size)
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma.c linux-2.6.38.2/arch/powerpc/kernel/dma.c
---- linux-2.6.38.2/arch/powerpc/kernel/dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/dma.c linux-2.6.38.7/arch/powerpc/kernel/dma.c
+--- linux-2.6.38.7/arch/powerpc/kernel/dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/dma.c	2011-04-28 19:34:14.000000000 -0400
 @@ -136,7 +136,7 @@ static inline void dma_direct_sync_singl
  }
  #endif
@@ -2446,9 +2452,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma.c linux-2.6.38.2/arch/powerpc/
  
  	if (ppc_md.dma_set_mask)
  		return ppc_md.dma_set_mask(dev, dma_mask);
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma-iommu.c linux-2.6.38.2/arch/powerpc/kernel/dma-iommu.c
---- linux-2.6.38.2/arch/powerpc/kernel/dma-iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/dma-iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/dma-iommu.c linux-2.6.38.7/arch/powerpc/kernel/dma-iommu.c
+--- linux-2.6.38.7/arch/powerpc/kernel/dma-iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/dma-iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -70,7 +70,7 @@ static void dma_iommu_unmap_sg(struct de
  }
  
@@ -2467,9 +2473,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma-iommu.c linux-2.6.38.2/arch/po
  	.alloc_coherent	= dma_iommu_alloc_coherent,
  	.free_coherent	= dma_iommu_free_coherent,
  	.map_sg		= dma_iommu_map_sg,
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.38.2/arch/powerpc/kernel/dma-swiotlb.c
---- linux-2.6.38.2/arch/powerpc/kernel/dma-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/dma-swiotlb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.38.7/arch/powerpc/kernel/dma-swiotlb.c
+--- linux-2.6.38.7/arch/powerpc/kernel/dma-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/dma-swiotlb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -31,7 +31,7 @@ unsigned int ppc_swiotlb_enable;
   * map_page, and unmap_page on highmem, use normal dma_ops
   * for everything else.
@@ -2479,9 +2485,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.38.2/arch/
  	.alloc_coherent = dma_direct_alloc_coherent,
  	.free_coherent = dma_direct_free_coherent,
  	.map_sg = swiotlb_map_sg_attrs,
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/exceptions-64e.S linux-2.6.38.2/arch/powerpc/kernel/exceptions-64e.S
---- linux-2.6.38.2/arch/powerpc/kernel/exceptions-64e.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/exceptions-64e.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/exceptions-64e.S linux-2.6.38.7/arch/powerpc/kernel/exceptions-64e.S
+--- linux-2.6.38.7/arch/powerpc/kernel/exceptions-64e.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/exceptions-64e.S	2011-04-28 19:34:14.000000000 -0400
 @@ -495,6 +495,7 @@ storage_fault_common:
  	std	r14,_DAR(r1)
  	std	r15,_DSISR(r1)
@@ -2500,9 +2506,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/exceptions-64e.S linux-2.6.38.2/ar
  	addi	r3,r1,STACK_FRAME_OVERHEAD
  	ld	r4,_DAR(r1)
  	bl	.bad_page_fault
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/exceptions-64s.S linux-2.6.38.2/arch/powerpc/kernel/exceptions-64s.S
---- linux-2.6.38.2/arch/powerpc/kernel/exceptions-64s.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/exceptions-64s.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/exceptions-64s.S linux-2.6.38.7/arch/powerpc/kernel/exceptions-64s.S
+--- linux-2.6.38.7/arch/powerpc/kernel/exceptions-64s.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/exceptions-64s.S	2011-04-28 19:34:14.000000000 -0400
 @@ -848,10 +848,10 @@ handle_page_fault:
  11:	ld	r4,_DAR(r1)
  	ld	r5,_DSISR(r1)
@@ -2515,9 +2521,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/exceptions-64s.S linux-2.6.38.2/ar
  	mr	r5,r3
  	addi	r3,r1,STACK_FRAME_OVERHEAD
  	lwz	r4,_DAR(r1)
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/ibmebus.c linux-2.6.38.2/arch/powerpc/kernel/ibmebus.c
---- linux-2.6.38.2/arch/powerpc/kernel/ibmebus.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/ibmebus.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/ibmebus.c linux-2.6.38.7/arch/powerpc/kernel/ibmebus.c
+--- linux-2.6.38.7/arch/powerpc/kernel/ibmebus.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/ibmebus.c	2011-04-28 19:34:14.000000000 -0400
 @@ -128,7 +128,7 @@ static int ibmebus_dma_supported(struct 
  	return 1;
  }
@@ -2527,9 +2533,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/ibmebus.c linux-2.6.38.2/arch/powe
  	.alloc_coherent = ibmebus_alloc_coherent,
  	.free_coherent  = ibmebus_free_coherent,
  	.map_sg         = ibmebus_map_sg,
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/kgdb.c linux-2.6.38.2/arch/powerpc/kernel/kgdb.c
---- linux-2.6.38.2/arch/powerpc/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/kgdb.c linux-2.6.38.7/arch/powerpc/kernel/kgdb.c
+--- linux-2.6.38.7/arch/powerpc/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -422,7 +422,7 @@ int kgdb_arch_handle_exception(int vecto
  /*
   * Global data
@@ -2539,9 +2545,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/kgdb.c linux-2.6.38.2/arch/powerpc
  	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
  };
  
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/module_32.c linux-2.6.38.2/arch/powerpc/kernel/module_32.c
---- linux-2.6.38.2/arch/powerpc/kernel/module_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/module_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/module_32.c linux-2.6.38.7/arch/powerpc/kernel/module_32.c
+--- linux-2.6.38.7/arch/powerpc/kernel/module_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/module_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -162,7 +162,7 @@ int module_frob_arch_sections(Elf32_Ehdr
  			me->arch.core_plt_section = i;
  	}
@@ -2571,9 +2577,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/module_32.c linux-2.6.38.2/arch/po
  
  	/* Find this entry, or if that fails, the next avail. entry */
  	while (entry->jump[0]) {
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/module.c linux-2.6.38.2/arch/powerpc/kernel/module.c
---- linux-2.6.38.2/arch/powerpc/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/module.c linux-2.6.38.7/arch/powerpc/kernel/module.c
+--- linux-2.6.38.7/arch/powerpc/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -31,11 +31,24 @@
  
  LIST_HEAD(module_bug_list);
@@ -2613,9 +2619,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/module.c linux-2.6.38.2/arch/power
  static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
  				    const Elf_Shdr *sechdrs,
  				    const char *name)
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/pci-common.c linux-2.6.38.2/arch/powerpc/kernel/pci-common.c
---- linux-2.6.38.2/arch/powerpc/kernel/pci-common.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/pci-common.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/pci-common.c linux-2.6.38.7/arch/powerpc/kernel/pci-common.c
+--- linux-2.6.38.7/arch/powerpc/kernel/pci-common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/pci-common.c	2011-04-28 19:34:14.000000000 -0400
 @@ -52,14 +52,14 @@ resource_size_t isa_mem_base;
  unsigned int ppc_pci_flags = 0;
  
@@ -2634,9 +2640,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/pci-common.c linux-2.6.38.2/arch/p
  {
  	return pci_dma_ops;
  }
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/process.c linux-2.6.38.2/arch/powerpc/kernel/process.c
---- linux-2.6.38.2/arch/powerpc/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/process.c linux-2.6.38.7/arch/powerpc/kernel/process.c
+--- linux-2.6.38.7/arch/powerpc/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -655,8 +655,8 @@ void show_regs(struct pt_regs * regs)
  	 * Lookup NIP late so we have the best change of getting the
  	 * above info out without failing
@@ -2729,9 +2735,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/process.c linux-2.6.38.2/arch/powe
 -
 -	return ret;
 -}
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/signal_32.c linux-2.6.38.2/arch/powerpc/kernel/signal_32.c
---- linux-2.6.38.2/arch/powerpc/kernel/signal_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/signal_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/signal_32.c linux-2.6.38.7/arch/powerpc/kernel/signal_32.c
+--- linux-2.6.38.7/arch/powerpc/kernel/signal_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/signal_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -858,7 +858,7 @@ int handle_rt_signal32(unsigned long sig
  	/* Save user registers on the stack */
  	frame = &rt_sf->uc.uc_mcontext;
@@ -2741,9 +2747,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/signal_32.c linux-2.6.38.2/arch/po
  		if (save_user_regs(regs, frame, 0, 1))
  			goto badframe;
  		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/signal_64.c linux-2.6.38.2/arch/powerpc/kernel/signal_64.c
---- linux-2.6.38.2/arch/powerpc/kernel/signal_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/signal_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/signal_64.c linux-2.6.38.7/arch/powerpc/kernel/signal_64.c
+--- linux-2.6.38.7/arch/powerpc/kernel/signal_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/signal_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -429,7 +429,7 @@ int handle_rt_signal64(int signr, struct
  	current->thread.fpscr.val = 0;
  
@@ -2753,9 +2759,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/signal_64.c linux-2.6.38.2/arch/po
  		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
  	} else {
  		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/vdso.c linux-2.6.38.2/arch/powerpc/kernel/vdso.c
---- linux-2.6.38.2/arch/powerpc/kernel/vdso.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/vdso.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/vdso.c linux-2.6.38.7/arch/powerpc/kernel/vdso.c
+--- linux-2.6.38.7/arch/powerpc/kernel/vdso.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/vdso.c	2011-04-28 19:34:14.000000000 -0400
 @@ -36,6 +36,7 @@
  #include <asm/firmware.h>
  #include <asm/vdso.h>
@@ -2782,9 +2788,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/vdso.c linux-2.6.38.2/arch/powerpc
  	if (IS_ERR_VALUE(vdso_base)) {
  		rc = vdso_base;
  		goto fail_mmapsem;
-diff -urNp linux-2.6.38.2/arch/powerpc/kernel/vio.c linux-2.6.38.2/arch/powerpc/kernel/vio.c
---- linux-2.6.38.2/arch/powerpc/kernel/vio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/kernel/vio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/kernel/vio.c linux-2.6.38.7/arch/powerpc/kernel/vio.c
+--- linux-2.6.38.7/arch/powerpc/kernel/vio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/kernel/vio.c	2011-04-28 19:34:14.000000000 -0400
 @@ -605,11 +605,12 @@ static int vio_dma_iommu_dma_supported(s
          return dma_iommu_ops.dma_supported(dev, mask);
  }
@@ -2799,9 +2805,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/kernel/vio.c linux-2.6.38.2/arch/powerpc/
  	.map_page       = vio_dma_iommu_map_page,
  	.unmap_page     = vio_dma_iommu_unmap_page,
  	.dma_supported  = vio_dma_iommu_dma_supported,
-diff -urNp linux-2.6.38.2/arch/powerpc/lib/usercopy_64.c linux-2.6.38.2/arch/powerpc/lib/usercopy_64.c
---- linux-2.6.38.2/arch/powerpc/lib/usercopy_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/lib/usercopy_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/lib/usercopy_64.c linux-2.6.38.7/arch/powerpc/lib/usercopy_64.c
+--- linux-2.6.38.7/arch/powerpc/lib/usercopy_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/lib/usercopy_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -9,22 +9,6 @@
  #include <linux/module.h>
  #include <asm/uaccess.h>
@@ -2833,9 +2839,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/lib/usercopy_64.c linux-2.6.38.2/arch/pow
 -EXPORT_SYMBOL(copy_to_user);
  EXPORT_SYMBOL(copy_in_user);
  
-diff -urNp linux-2.6.38.2/arch/powerpc/mm/fault.c linux-2.6.38.2/arch/powerpc/mm/fault.c
---- linux-2.6.38.2/arch/powerpc/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/mm/fault.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/mm/fault.c linux-2.6.38.7/arch/powerpc/mm/fault.c
+--- linux-2.6.38.7/arch/powerpc/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/mm/fault.c	2011-04-28 19:34:14.000000000 -0400
 @@ -31,6 +31,10 @@
  #include <linux/kdebug.h>
  #include <linux/perf_event.h>
@@ -2940,9 +2946,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/mm/fault.c linux-2.6.38.2/arch/powerpc/mm
  		_exception(SIGSEGV, regs, code, address);
  		return 0;
  	}
-diff -urNp linux-2.6.38.2/arch/powerpc/mm/mmap_64.c linux-2.6.38.2/arch/powerpc/mm/mmap_64.c
---- linux-2.6.38.2/arch/powerpc/mm/mmap_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/mm/mmap_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/mm/mmap_64.c linux-2.6.38.7/arch/powerpc/mm/mmap_64.c
+--- linux-2.6.38.7/arch/powerpc/mm/mmap_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/mm/mmap_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -99,10 +99,22 @@ void arch_pick_mmap_layout(struct mm_str
  	 */
  	if (mmap_is_legacy()) {
@@ -2966,9 +2972,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/mm/mmap_64.c linux-2.6.38.2/arch/powerpc/
  		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
-diff -urNp linux-2.6.38.2/arch/powerpc/mm/slice.c linux-2.6.38.2/arch/powerpc/mm/slice.c
---- linux-2.6.38.2/arch/powerpc/mm/slice.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/mm/slice.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/mm/slice.c linux-2.6.38.7/arch/powerpc/mm/slice.c
+--- linux-2.6.38.7/arch/powerpc/mm/slice.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/mm/slice.c	2011-04-28 19:34:14.000000000 -0400
 @@ -98,7 +98,7 @@ static int slice_area_is_free(struct mm_
  	if ((mm->task_size - len) < addr)
  		return 0;
@@ -3035,9 +3041,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/mm/slice.c linux-2.6.38.2/arch/powerpc/mm
  	/* If hint, make sure it matches our alignment restrictions */
  	if (!fixed && addr) {
  		addr = _ALIGN_UP(addr, 1ul << pshift);
-diff -urNp linux-2.6.38.2/arch/powerpc/platforms/cell/iommu.c linux-2.6.38.2/arch/powerpc/platforms/cell/iommu.c
---- linux-2.6.38.2/arch/powerpc/platforms/cell/iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/platforms/cell/iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/platforms/cell/iommu.c linux-2.6.38.7/arch/powerpc/platforms/cell/iommu.c
+--- linux-2.6.38.7/arch/powerpc/platforms/cell/iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/platforms/cell/iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -642,7 +642,7 @@ static int dma_fixed_dma_supported(struc
  
  static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
@@ -3047,9 +3053,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/platforms/cell/iommu.c linux-2.6.38.2/arc
  	.alloc_coherent = dma_fixed_alloc_coherent,
  	.free_coherent  = dma_fixed_free_coherent,
  	.map_sg         = dma_fixed_map_sg,
-diff -urNp linux-2.6.38.2/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.38.2/arch/powerpc/platforms/ps3/system-bus.c
---- linux-2.6.38.2/arch/powerpc/platforms/ps3/system-bus.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/platforms/ps3/system-bus.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.38.7/arch/powerpc/platforms/ps3/system-bus.c
+--- linux-2.6.38.7/arch/powerpc/platforms/ps3/system-bus.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/platforms/ps3/system-bus.c	2011-04-28 19:34:14.000000000 -0400
 @@ -695,7 +695,7 @@ static int ps3_dma_supported(struct devi
  	return mask >= DMA_BIT_MASK(32);
  }
@@ -3068,9 +3074,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.38.2
  	.alloc_coherent = ps3_alloc_coherent,
  	.free_coherent = ps3_free_coherent,
  	.map_sg = ps3_ioc0_map_sg,
-diff -urNp linux-2.6.38.2/arch/powerpc/sysdev/ppc4xx_cpm.c linux-2.6.38.2/arch/powerpc/sysdev/ppc4xx_cpm.c
---- linux-2.6.38.2/arch/powerpc/sysdev/ppc4xx_cpm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/powerpc/sysdev/ppc4xx_cpm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/powerpc/sysdev/ppc4xx_cpm.c linux-2.6.38.7/arch/powerpc/sysdev/ppc4xx_cpm.c
+--- linux-2.6.38.7/arch/powerpc/sysdev/ppc4xx_cpm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/powerpc/sysdev/ppc4xx_cpm.c	2011-04-28 19:34:14.000000000 -0400
 @@ -240,7 +240,7 @@ static int cpm_suspend_enter(suspend_sta
  	return 0;
  }
@@ -3080,9 +3086,9 @@ diff -urNp linux-2.6.38.2/arch/powerpc/sysdev/ppc4xx_cpm.c linux-2.6.38.2/arch/p
  	.valid		= cpm_suspend_valid,
  	.enter		= cpm_suspend_enter,
  };
-diff -urNp linux-2.6.38.2/arch/s390/include/asm/elf.h linux-2.6.38.2/arch/s390/include/asm/elf.h
---- linux-2.6.38.2/arch/s390/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/include/asm/elf.h linux-2.6.38.7/arch/s390/include/asm/elf.h
+--- linux-2.6.38.7/arch/s390/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -162,8 +162,14 @@ extern unsigned int vdso_enabled;
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
@@ -3108,9 +3114,9 @@ diff -urNp linux-2.6.38.2/arch/s390/include/asm/elf.h linux-2.6.38.2/arch/s390/i
 -#define arch_randomize_brk arch_randomize_brk
 -
  #endif
-diff -urNp linux-2.6.38.2/arch/s390/include/asm/system.h linux-2.6.38.2/arch/s390/include/asm/system.h
---- linux-2.6.38.2/arch/s390/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/include/asm/system.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/include/asm/system.h linux-2.6.38.7/arch/s390/include/asm/system.h
+--- linux-2.6.38.7/arch/s390/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/include/asm/system.h	2011-04-28 19:34:14.000000000 -0400
 @@ -449,7 +449,7 @@ extern void (*_machine_restart)(char *co
  extern void (*_machine_halt)(void);
  extern void (*_machine_power_off)(void);
@@ -3120,9 +3126,9 @@ diff -urNp linux-2.6.38.2/arch/s390/include/asm/system.h linux-2.6.38.2/arch/s39
  
  static inline int tprot(unsigned long addr)
  {
-diff -urNp linux-2.6.38.2/arch/s390/include/asm/uaccess.h linux-2.6.38.2/arch/s390/include/asm/uaccess.h
---- linux-2.6.38.2/arch/s390/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/include/asm/uaccess.h linux-2.6.38.7/arch/s390/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/s390/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -234,6 +234,10 @@ static inline unsigned long __must_check
  copy_to_user(void __user *to, const void *from, unsigned long n)
  {
@@ -3155,9 +3161,9 @@ diff -urNp linux-2.6.38.2/arch/s390/include/asm/uaccess.h linux-2.6.38.2/arch/s3
  	if (unlikely(sz != -1 && sz < n)) {
  		copy_from_user_overflow();
  		return n;
-diff -urNp linux-2.6.38.2/arch/s390/Kconfig linux-2.6.38.2/arch/s390/Kconfig
---- linux-2.6.38.2/arch/s390/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/Kconfig linux-2.6.38.7/arch/s390/Kconfig
+--- linux-2.6.38.7/arch/s390/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/Kconfig	2011-04-28 19:34:14.000000000 -0400
 @@ -233,11 +233,9 @@ config S390_EXEC_PROTECT
  	prompt "Data execute protection"
  	help
@@ -3173,9 +3179,9 @@ diff -urNp linux-2.6.38.2/arch/s390/Kconfig linux-2.6.38.2/arch/s390/Kconfig
  
  comment "Code generation options"
  
-diff -urNp linux-2.6.38.2/arch/s390/kernel/module.c linux-2.6.38.2/arch/s390/kernel/module.c
---- linux-2.6.38.2/arch/s390/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/kernel/module.c linux-2.6.38.7/arch/s390/kernel/module.c
+--- linux-2.6.38.7/arch/s390/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -168,11 +168,11 @@ module_frob_arch_sections(Elf_Ehdr *hdr,
  
  	/* Increase core size by size of got & plt and set start
@@ -3247,9 +3253,9 @@ diff -urNp linux-2.6.38.2/arch/s390/kernel/module.c linux-2.6.38.2/arch/s390/ker
  			rela->r_addend - loc;
  		if (r_type == R_390_GOTPC)
  			*(unsigned int *) loc = val;
-diff -urNp linux-2.6.38.2/arch/s390/kernel/process.c linux-2.6.38.2/arch/s390/kernel/process.c
---- linux-2.6.38.2/arch/s390/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/kernel/process.c linux-2.6.38.7/arch/s390/kernel/process.c
+--- linux-2.6.38.7/arch/s390/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -334,39 +334,3 @@ unsigned long get_wchan(struct task_stru
  	}
  	return 0;
@@ -3290,9 +3296,9 @@ diff -urNp linux-2.6.38.2/arch/s390/kernel/process.c linux-2.6.38.2/arch/s390/ke
 -		return base;
 -	return ret;
 -}
-diff -urNp linux-2.6.38.2/arch/s390/kernel/setup.c linux-2.6.38.2/arch/s390/kernel/setup.c
---- linux-2.6.38.2/arch/s390/kernel/setup.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/kernel/setup.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/kernel/setup.c linux-2.6.38.7/arch/s390/kernel/setup.c
+--- linux-2.6.38.7/arch/s390/kernel/setup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/kernel/setup.c	2011-04-28 19:34:14.000000000 -0400
 @@ -281,7 +281,7 @@ static int __init early_parse_mem(char *
  }
  early_param("mem", early_parse_mem);
@@ -3341,9 +3347,9 @@ diff -urNp linux-2.6.38.2/arch/s390/kernel/setup.c linux-2.6.38.2/arch/s390/kern
  static void setup_addressing_mode(void)
  {
  	if (user_mode == SECONDARY_SPACE_MODE) {
-diff -urNp linux-2.6.38.2/arch/s390/mm/maccess.c linux-2.6.38.2/arch/s390/mm/maccess.c
---- linux-2.6.38.2/arch/s390/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/mm/maccess.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/mm/maccess.c linux-2.6.38.7/arch/s390/mm/maccess.c
+--- linux-2.6.38.7/arch/s390/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/mm/maccess.c	2011-04-28 19:34:14.000000000 -0400
 @@ -45,7 +45,7 @@ static long probe_kernel_write_odd(void 
  	return rc ? rc : count;
  }
@@ -3353,9 +3359,9 @@ diff -urNp linux-2.6.38.2/arch/s390/mm/maccess.c linux-2.6.38.2/arch/s390/mm/mac
  {
  	long copied = 0;
  
-diff -urNp linux-2.6.38.2/arch/s390/mm/mmap.c linux-2.6.38.2/arch/s390/mm/mmap.c
---- linux-2.6.38.2/arch/s390/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/s390/mm/mmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/s390/mm/mmap.c linux-2.6.38.7/arch/s390/mm/mmap.c
+--- linux-2.6.38.7/arch/s390/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/s390/mm/mmap.c	2011-04-28 19:34:14.000000000 -0400
 @@ -91,10 +91,22 @@ void arch_pick_mmap_layout(struct mm_str
  	 */
  	if (mmap_is_legacy()) {
@@ -3402,9 +3408,9 @@ diff -urNp linux-2.6.38.2/arch/s390/mm/mmap.c linux-2.6.38.2/arch/s390/mm/mmap.c
  		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
-diff -urNp linux-2.6.38.2/arch/score/include/asm/system.h linux-2.6.38.2/arch/score/include/asm/system.h
---- linux-2.6.38.2/arch/score/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/score/include/asm/system.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/score/include/asm/system.h linux-2.6.38.7/arch/score/include/asm/system.h
+--- linux-2.6.38.7/arch/score/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/score/include/asm/system.h	2011-04-28 19:34:14.000000000 -0400
 @@ -17,7 +17,7 @@ do {								\
  #define finish_arch_switch(prev)	do {} while (0)
  
@@ -3414,9 +3420,9 @@ diff -urNp linux-2.6.38.2/arch/score/include/asm/system.h linux-2.6.38.2/arch/sc
  
  #define mb()		barrier()
  #define rmb()		barrier()
-diff -urNp linux-2.6.38.2/arch/score/kernel/process.c linux-2.6.38.2/arch/score/kernel/process.c
---- linux-2.6.38.2/arch/score/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/score/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/score/kernel/process.c linux-2.6.38.7/arch/score/kernel/process.c
+--- linux-2.6.38.7/arch/score/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/score/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -161,8 +161,3 @@ unsigned long get_wchan(struct task_stru
  
  	return task_pt_regs(task)->cp0_epc;
@@ -3426,9 +3432,9 @@ diff -urNp linux-2.6.38.2/arch/score/kernel/process.c linux-2.6.38.2/arch/score/
 -{
 -	return sp;
 -}
-diff -urNp linux-2.6.38.2/arch/sh/include/asm/dma-mapping.h linux-2.6.38.2/arch/sh/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/sh/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sh/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sh/include/asm/dma-mapping.h linux-2.6.38.7/arch/sh/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/sh/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sh/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -1,10 +1,10 @@
  #ifndef __ASM_SH_DMA_MAPPING_H
  #define __ASM_SH_DMA_MAPPING_H
@@ -3487,9 +3493,9 @@ diff -urNp linux-2.6.38.2/arch/sh/include/asm/dma-mapping.h linux-2.6.38.2/arch/
  
  	if (dma_release_from_coherent(dev, get_order(size), vaddr))
  		return;
-diff -urNp linux-2.6.38.2/arch/sh/kernel/dma-nommu.c linux-2.6.38.2/arch/sh/kernel/dma-nommu.c
---- linux-2.6.38.2/arch/sh/kernel/dma-nommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sh/kernel/dma-nommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sh/kernel/dma-nommu.c linux-2.6.38.7/arch/sh/kernel/dma-nommu.c
+--- linux-2.6.38.7/arch/sh/kernel/dma-nommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sh/kernel/dma-nommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -62,7 +62,7 @@ static void nommu_sync_sg(struct device 
  }
  #endif
@@ -3499,9 +3505,9 @@ diff -urNp linux-2.6.38.2/arch/sh/kernel/dma-nommu.c linux-2.6.38.2/arch/sh/kern
  	.alloc_coherent		= dma_generic_alloc_coherent,
  	.free_coherent		= dma_generic_free_coherent,
  	.map_page		= nommu_map_page,
-diff -urNp linux-2.6.38.2/arch/sh/kernel/kgdb.c linux-2.6.38.2/arch/sh/kernel/kgdb.c
---- linux-2.6.38.2/arch/sh/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sh/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sh/kernel/kgdb.c linux-2.6.38.7/arch/sh/kernel/kgdb.c
+--- linux-2.6.38.7/arch/sh/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sh/kernel/kgdb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -319,7 +319,7 @@ void kgdb_arch_exit(void)
  	unregister_die_notifier(&kgdb_notifier);
  }
@@ -3511,9 +3517,9 @@ diff -urNp linux-2.6.38.2/arch/sh/kernel/kgdb.c linux-2.6.38.2/arch/sh/kernel/kg
  	/* Breakpoint instruction: trapa #0x3c */
  #ifdef CONFIG_CPU_LITTLE_ENDIAN
  	.gdb_bpt_instr		= { 0x3c, 0xc3 },
-diff -urNp linux-2.6.38.2/arch/sh/mm/consistent.c linux-2.6.38.2/arch/sh/mm/consistent.c
---- linux-2.6.38.2/arch/sh/mm/consistent.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sh/mm/consistent.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sh/mm/consistent.c linux-2.6.38.7/arch/sh/mm/consistent.c
+--- linux-2.6.38.7/arch/sh/mm/consistent.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sh/mm/consistent.c	2011-04-28 19:34:14.000000000 -0400
 @@ -22,7 +22,7 @@
  
  #define PREALLOC_DMA_DEBUG_ENTRIES	4096
@@ -3523,9 +3529,9 @@ diff -urNp linux-2.6.38.2/arch/sh/mm/consistent.c linux-2.6.38.2/arch/sh/mm/cons
  EXPORT_SYMBOL(dma_ops);
  
  static int __init dma_init(void)
-diff -urNp linux-2.6.38.2/arch/sh/mm/mmap.c linux-2.6.38.2/arch/sh/mm/mmap.c
---- linux-2.6.38.2/arch/sh/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sh/mm/mmap.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sh/mm/mmap.c linux-2.6.38.7/arch/sh/mm/mmap.c
+--- linux-2.6.38.7/arch/sh/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sh/mm/mmap.c	2011-04-28 19:34:14.000000000 -0400
 @@ -74,8 +74,7 @@ unsigned long arch_get_unmapped_area(str
  			addr = PAGE_ALIGN(addr);
  
@@ -3600,9 +3606,9 @@ diff -urNp linux-2.6.38.2/arch/sh/mm/mmap.c linux-2.6.38.2/arch/sh/mm/mmap.c
  
  bottomup:
  	/*
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h
---- linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/atomic_64.h linux-2.6.38.7/arch/sparc/include/asm/atomic_64.h
+--- linux-2.6.38.7/arch/sparc/include/asm/atomic_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/atomic_64.h	2011-04-28 19:57:25.000000000 -0400
 @@ -14,18 +14,40 @@
  #define ATOMIC64_INIT(i)	{ (i) }
  
@@ -3669,7 +3675,15 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h linux-2.6.38.2/arch
  #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
  
  /*
-@@ -59,10 +93,26 @@ extern long atomic64_sub_ret(long, atomi
+@@ -50,6 +84,7 @@ extern long atomic64_sub_ret(long, atomi
+  * other cases.
+  */
+ #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
++#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
+ #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
+ 
+ #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
+@@ -59,30 +94,59 @@ extern long atomic64_sub_ret(long, atomi
  #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
  
  #define atomic_inc(v) atomic_add(1, v)
@@ -3696,7 +3710,11 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h linux-2.6.38.2/arch
  
  #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
  #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
-@@ -72,17 +122,28 @@ extern long atomic64_sub_ret(long, atomi
+ 
+ #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
++#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
+ #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
++#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
  
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -3729,7 +3747,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h linux-2.6.38.2/arch
  }
  
  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -93,17 +154,28 @@ static inline int atomic_add_unless(atom
+@@ -93,17 +157,28 @@ static inline int atomic_add_unless(atom
  
  static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
  {
@@ -3762,9 +3780,21 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/atomic_64.h linux-2.6.38.2/arch
  }
  
  #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/dma-mapping.h linux-2.6.38.2/arch/sparc/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/sparc/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/cache.h linux-2.6.38.7/arch/sparc/include/asm/cache.h
+--- linux-2.6.38.7/arch/sparc/include/asm/cache.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/cache.h	2011-05-17 19:31:43.000000000 -0400
+@@ -10,7 +10,7 @@
+ #define ARCH_SLAB_MINALIGN	__alignof__(unsigned long long)
+ 
+ #define L1_CACHE_SHIFT 5
+-#define L1_CACHE_BYTES 32
++#define L1_CACHE_BYTES 32U
+ 
+ #ifdef CONFIG_SPARC32
+ #define SMP_CACHE_BYTES_SHIFT 5
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/dma-mapping.h linux-2.6.38.7/arch/sparc/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/sparc/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,10 +12,10 @@ extern int dma_supported(struct device *
  #define dma_alloc_noncoherent(d, s, h, f) dma_alloc_coherent(d, s, h, f)
  #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
@@ -3796,9 +3826,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/dma-mapping.h linux-2.6.38.2/ar
  
  	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
  	ops->free_coherent(dev, size, cpu_addr, dma_handle);
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/elf_32.h linux-2.6.38.2/arch/sparc/include/asm/elf_32.h
---- linux-2.6.38.2/arch/sparc/include/asm/elf_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/elf_32.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/elf_32.h linux-2.6.38.7/arch/sparc/include/asm/elf_32.h
+--- linux-2.6.38.7/arch/sparc/include/asm/elf_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/elf_32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -114,6 +114,13 @@ typedef struct {
  
  #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
@@ -3813,9 +3843,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/elf_32.h linux-2.6.38.2/arch/sp
  /* This yields a mask that user programs can use to figure out what
     instruction set this cpu supports.  This can NOT be done in userspace
     on Sparc.  */
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/elf_64.h linux-2.6.38.2/arch/sparc/include/asm/elf_64.h
---- linux-2.6.38.2/arch/sparc/include/asm/elf_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/elf_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/elf_64.h linux-2.6.38.7/arch/sparc/include/asm/elf_64.h
+--- linux-2.6.38.7/arch/sparc/include/asm/elf_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/elf_64.h	2011-04-28 19:34:14.000000000 -0400
 @@ -162,6 +162,12 @@ typedef struct {
  #define ELF_ET_DYN_BASE		0x0000010000000000UL
  #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
@@ -3829,9 +3859,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/elf_64.h linux-2.6.38.2/arch/sp
  
  /* This yields a mask that user programs can use to figure out what
     instruction set this cpu supports.  */
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/pgtable_32.h linux-2.6.38.2/arch/sparc/include/asm/pgtable_32.h
---- linux-2.6.38.2/arch/sparc/include/asm/pgtable_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/pgtable_32.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/pgtable_32.h linux-2.6.38.7/arch/sparc/include/asm/pgtable_32.h
+--- linux-2.6.38.7/arch/sparc/include/asm/pgtable_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/pgtable_32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -43,6 +43,13 @@ BTFIXUPDEF_SIMM13(user_ptrs_per_pgd)
  BTFIXUPDEF_INT(page_none)
  BTFIXUPDEF_INT(page_copy)
@@ -3863,9 +3893,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/pgtable_32.h linux-2.6.38.2/arc
  extern unsigned long page_kernel;
  
  #ifdef MODULE
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.38.2/arch/sparc/include/asm/pgtsrmmu.h
---- linux-2.6.38.2/arch/sparc/include/asm/pgtsrmmu.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/pgtsrmmu.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.38.7/arch/sparc/include/asm/pgtsrmmu.h
+--- linux-2.6.38.7/arch/sparc/include/asm/pgtsrmmu.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/pgtsrmmu.h	2011-04-28 19:34:14.000000000 -0400
 @@ -115,6 +115,13 @@
  				    SRMMU_EXEC | SRMMU_REF)
  #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
@@ -3880,10 +3910,18 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.38.2/arch/
  #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
  				    SRMMU_DIRTY | SRMMU_REF)
  
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h
---- linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h	2011-03-21 18:31:35.000000000 -0400
-@@ -99,7 +99,12 @@ static void inline arch_read_lock(arch_r
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.7/arch/sparc/include/asm/spinlock_64.h
+--- linux-2.6.38.7/arch/sparc/include/asm/spinlock_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/spinlock_64.h	2011-04-28 19:57:25.000000000 -0400
+@@ -92,14 +92,19 @@ static inline void arch_spin_lock_flags(
+ 
+ /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
+ 
+-static void inline arch_read_lock(arch_rwlock_t *lock)
++static inline void arch_read_lock(arch_rwlock_t *lock)
+ {
+ 	unsigned long tmp1, tmp2;
+ 
  	__asm__ __volatile__ (
  "1:	ldsw		[%2], %0\n"
  "	brlz,pn		%0, 2f\n"
@@ -3897,7 +3935,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.2/ar
  "	cas		[%2], %0, %1\n"
  "	cmp		%0, %1\n"
  "	bne,pn		%%icc, 1b\n"
-@@ -112,7 +117,7 @@ static void inline arch_read_lock(arch_r
+@@ -112,10 +117,10 @@ static void inline arch_read_lock(arch_r
  "	.previous"
  	: "=&r" (tmp1), "=&r" (tmp2)
  	: "r" (lock)
@@ -3905,7 +3943,11 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.2/ar
 +	: "memory", "cc");
  }
  
- static int inline arch_read_trylock(arch_rwlock_t *lock)
+-static int inline arch_read_trylock(arch_rwlock_t *lock)
++static inline int arch_read_trylock(arch_rwlock_t *lock)
+ {
+ 	int tmp1, tmp2;
+ 
 @@ -123,7 +128,12 @@ static int inline arch_read_trylock(arch
  "1:	ldsw		[%2], %0\n"
  "	brlz,a,pn	%0, 2f\n"
@@ -3920,7 +3962,14 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.2/ar
  "	cas		[%2], %0, %1\n"
  "	cmp		%0, %1\n"
  "	bne,pn		%%icc, 1b\n"
-@@ -142,7 +152,12 @@ static void inline arch_read_unlock(arch
+@@ -136,13 +146,18 @@ static int inline arch_read_trylock(arch
+ 	return tmp1;
+ }
+ 
+-static void inline arch_read_unlock(arch_rwlock_t *lock)
++static inline void arch_read_unlock(arch_rwlock_t *lock)
+ {
+ 	unsigned long tmp1, tmp2;
  
  	__asm__ __volatile__(
  "1:	lduw	[%2], %0\n"
@@ -3934,9 +3983,36 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/spinlock_64.h linux-2.6.38.2/ar
  "	cas	[%2], %0, %1\n"
  "	cmp	%0, %1\n"
  "	bne,pn	%%xcc, 1b\n"
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess_32.h linux-2.6.38.2/arch/sparc/include/asm/uaccess_32.h
---- linux-2.6.38.2/arch/sparc/include/asm/uaccess_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/uaccess_32.h	2011-03-21 18:31:35.000000000 -0400
+@@ -152,7 +167,7 @@ static void inline arch_read_unlock(arch
+ 	: "memory");
+ }
+ 
+-static void inline arch_write_lock(arch_rwlock_t *lock)
++static inline void arch_write_lock(arch_rwlock_t *lock)
+ {
+ 	unsigned long mask, tmp1, tmp2;
+ 
+@@ -177,7 +192,7 @@ static void inline arch_write_lock(arch_
+ 	: "memory");
+ }
+ 
+-static void inline arch_write_unlock(arch_rwlock_t *lock)
++static inline void arch_write_unlock(arch_rwlock_t *lock)
+ {
+ 	__asm__ __volatile__(
+ "	stw		%%g0, [%0]"
+@@ -186,7 +201,7 @@ static void inline arch_write_unlock(arc
+ 	: "memory");
+ }
+ 
+-static int inline arch_write_trylock(arch_rwlock_t *lock)
++static inline int arch_write_trylock(arch_rwlock_t *lock)
+ {
+ 	unsigned long mask, tmp1, tmp2, result;
+ 
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/uaccess_32.h linux-2.6.38.7/arch/sparc/include/asm/uaccess_32.h
+--- linux-2.6.38.7/arch/sparc/include/asm/uaccess_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/uaccess_32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -249,27 +249,46 @@ extern unsigned long __copy_user(void __
  
  static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
@@ -3988,9 +4064,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess_32.h linux-2.6.38.2/arc
  	return __copy_user((__force void __user *) to, from, n);
  }
  
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess_64.h linux-2.6.38.2/arch/sparc/include/asm/uaccess_64.h
---- linux-2.6.38.2/arch/sparc/include/asm/uaccess_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/uaccess_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/uaccess_64.h linux-2.6.38.7/arch/sparc/include/asm/uaccess_64.h
+--- linux-2.6.38.7/arch/sparc/include/asm/uaccess_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/uaccess_64.h	2011-04-28 19:34:14.000000000 -0400
 @@ -10,6 +10,7 @@
  #include <linux/compiler.h>
  #include <linux/string.h>
@@ -4033,9 +4109,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess_64.h linux-2.6.38.2/arc
  	if (unlikely(ret))
  		ret = copy_to_user_fixup(to, from, size);
  	return ret;
-diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess.h linux-2.6.38.2/arch/sparc/include/asm/uaccess.h
---- linux-2.6.38.2/arch/sparc/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/include/asm/uaccess.h linux-2.6.38.7/arch/sparc/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/sparc/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -1,5 +1,13 @@
  #ifndef ___ASM_SPARC_UACCESS_H
  #define ___ASM_SPARC_UACCESS_H
@@ -4050,10 +4126,10 @@ diff -urNp linux-2.6.38.2/arch/sparc/include/asm/uaccess.h linux-2.6.38.2/arch/s
  #if defined(__sparc__) && defined(__arch64__)
  #include <asm/uaccess_64.h>
  #else
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/iommu.c linux-2.6.38.2/arch/sparc/kernel/iommu.c
---- linux-2.6.38.2/arch/sparc/kernel/iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/iommu.c	2011-03-21 18:31:35.000000000 -0400
-@@ -827,7 +827,7 @@ static void dma_4u_sync_sg_for_cpu(struc
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/iommu.c linux-2.6.38.7/arch/sparc/kernel/iommu.c
+--- linux-2.6.38.7/arch/sparc/kernel/iommu.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/iommu.c	2011-04-28 19:34:14.000000000 -0400
+@@ -824,7 +824,7 @@ static void dma_4u_sync_sg_for_cpu(struc
  	spin_unlock_irqrestore(&iommu->lock, flags);
  }
  
@@ -4062,7 +4138,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/iommu.c linux-2.6.38.2/arch/sparc/ke
  	.alloc_coherent		= dma_4u_alloc_coherent,
  	.free_coherent		= dma_4u_free_coherent,
  	.map_page		= dma_4u_map_page,
-@@ -838,7 +838,7 @@ static struct dma_map_ops sun4u_dma_ops 
+@@ -835,7 +835,7 @@ static struct dma_map_ops sun4u_dma_ops 
  	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
  };
  
@@ -4071,9 +4147,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/iommu.c linux-2.6.38.2/arch/sparc/ke
  EXPORT_SYMBOL(dma_ops);
  
  extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/ioport.c linux-2.6.38.2/arch/sparc/kernel/ioport.c
---- linux-2.6.38.2/arch/sparc/kernel/ioport.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/ioport.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/ioport.c linux-2.6.38.7/arch/sparc/kernel/ioport.c
+--- linux-2.6.38.7/arch/sparc/kernel/ioport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/ioport.c	2011-04-28 19:34:14.000000000 -0400
 @@ -397,7 +397,7 @@ static void sbus_sync_sg_for_device(stru
  	BUG();
  }
@@ -4101,9 +4177,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/ioport.c linux-2.6.38.2/arch/sparc/k
  	.alloc_coherent		= pci32_alloc_coherent,
  	.free_coherent		= pci32_free_coherent,
  	.map_page		= pci32_map_page,
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/kgdb_32.c linux-2.6.38.2/arch/sparc/kernel/kgdb_32.c
---- linux-2.6.38.2/arch/sparc/kernel/kgdb_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/kgdb_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/kgdb_32.c linux-2.6.38.7/arch/sparc/kernel/kgdb_32.c
+--- linux-2.6.38.7/arch/sparc/kernel/kgdb_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/kgdb_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -164,7 +164,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
  	regs->npc = regs->pc + 4;
  }
@@ -4113,9 +4189,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/kgdb_32.c linux-2.6.38.2/arch/sparc/
  	/* Breakpoint instruction: ta 0x7d */
  	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
  };
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/kgdb_64.c linux-2.6.38.2/arch/sparc/kernel/kgdb_64.c
---- linux-2.6.38.2/arch/sparc/kernel/kgdb_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/kgdb_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/kgdb_64.c linux-2.6.38.7/arch/sparc/kernel/kgdb_64.c
+--- linux-2.6.38.7/arch/sparc/kernel/kgdb_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/kgdb_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -187,7 +187,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
  	regs->tnpc = regs->tpc + 4;
  }
@@ -4125,9 +4201,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/kgdb_64.c linux-2.6.38.2/arch/sparc/
  	/* Breakpoint instruction: ta 0x72 */
  	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
  };
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/Makefile linux-2.6.38.2/arch/sparc/kernel/Makefile
---- linux-2.6.38.2/arch/sparc/kernel/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/Makefile linux-2.6.38.7/arch/sparc/kernel/Makefile
+--- linux-2.6.38.7/arch/sparc/kernel/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/Makefile	2011-04-28 19:34:14.000000000 -0400
 @@ -3,7 +3,7 @@
  #
  
@@ -4137,9 +4213,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/Makefile linux-2.6.38.2/arch/sparc/k
  
  extra-y     := head_$(BITS).o
  extra-y     += init_task.o
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/pci_sun4v.c linux-2.6.38.2/arch/sparc/kernel/pci_sun4v.c
---- linux-2.6.38.2/arch/sparc/kernel/pci_sun4v.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/pci_sun4v.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/pci_sun4v.c linux-2.6.38.7/arch/sparc/kernel/pci_sun4v.c
+--- linux-2.6.38.7/arch/sparc/kernel/pci_sun4v.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/pci_sun4v.c	2011-04-28 19:34:14.000000000 -0400
 @@ -525,7 +525,7 @@ static void dma_4v_unmap_sg(struct devic
  	spin_unlock_irqrestore(&iommu->lock, flags);
  }
@@ -4149,9 +4225,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/pci_sun4v.c linux-2.6.38.2/arch/spar
  	.alloc_coherent			= dma_4v_alloc_coherent,
  	.free_coherent			= dma_4v_free_coherent,
  	.map_page			= dma_4v_map_page,
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/process_32.c linux-2.6.38.2/arch/sparc/kernel/process_32.c
---- linux-2.6.38.2/arch/sparc/kernel/process_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/process_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/process_32.c linux-2.6.38.7/arch/sparc/kernel/process_32.c
+--- linux-2.6.38.7/arch/sparc/kernel/process_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/process_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -196,7 +196,7 @@ void __show_backtrace(unsigned long fp)
  		       rw->ins[4], rw->ins[5],
  		       rw->ins[6],
@@ -4187,9 +4263,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/process_32.c linux-2.6.38.2/arch/spa
  		fp = rw->ins[6];
  	} while (++count < 16);
  	printk("\n");
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/process_64.c linux-2.6.38.2/arch/sparc/kernel/process_64.c
---- linux-2.6.38.2/arch/sparc/kernel/process_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/process_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/process_64.c linux-2.6.38.7/arch/sparc/kernel/process_64.c
+--- linux-2.6.38.7/arch/sparc/kernel/process_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/process_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -180,14 +180,14 @@ static void show_regwindow(struct pt_reg
  	printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
  	       rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
@@ -4225,9 +4301,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/process_64.c linux-2.6.38.2/arch/spa
  			       (void *) gp->tpc,
  			       (void *) gp->o7,
  			       (void *) gp->i7,
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/sys_sparc_32.c linux-2.6.38.2/arch/sparc/kernel/sys_sparc_32.c
---- linux-2.6.38.2/arch/sparc/kernel/sys_sparc_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/sys_sparc_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/sys_sparc_32.c linux-2.6.38.7/arch/sparc/kernel/sys_sparc_32.c
+--- linux-2.6.38.7/arch/sparc/kernel/sys_sparc_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/sys_sparc_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -56,7 +56,7 @@ unsigned long arch_get_unmapped_area(str
  	if (ARCH_SUN4C && len > 0x20000000)
  		return -ENOMEM;
@@ -4246,9 +4322,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/sys_sparc_32.c linux-2.6.38.2/arch/s
  			return addr;
  		addr = vmm->vm_end;
  		if (flags & MAP_SHARED)
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/sys_sparc_64.c linux-2.6.38.2/arch/sparc/kernel/sys_sparc_64.c
---- linux-2.6.38.2/arch/sparc/kernel/sys_sparc_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/sys_sparc_64.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/sys_sparc_64.c linux-2.6.38.7/arch/sparc/kernel/sys_sparc_64.c
+--- linux-2.6.38.7/arch/sparc/kernel/sys_sparc_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/sys_sparc_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(str
  		/* We do not accept a shared mapping if it would violate
  		 * cache aliasing constraints.
@@ -4396,9 +4472,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/sys_sparc_64.c linux-2.6.38.2/arch/s
  		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_32.c linux-2.6.38.2/arch/sparc/kernel/traps_32.c
---- linux-2.6.38.2/arch/sparc/kernel/traps_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/traps_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/traps_32.c linux-2.6.38.7/arch/sparc/kernel/traps_32.c
+--- linux-2.6.38.7/arch/sparc/kernel/traps_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/traps_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -76,7 +76,7 @@ void die_if_kernel(char *str, struct pt_
  		      count++ < 30				&&
                        (((unsigned long) rw) >= PAGE_OFFSET)	&&
@@ -4408,9 +4484,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_32.c linux-2.6.38.2/arch/sparc
  			       (void *) rw->ins[7]);
  			rw = (struct reg_window32 *)rw->ins[6];
  		}
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_64.c linux-2.6.38.2/arch/sparc/kernel/traps_64.c
---- linux-2.6.38.2/arch/sparc/kernel/traps_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/traps_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/traps_64.c linux-2.6.38.7/arch/sparc/kernel/traps_64.c
+--- linux-2.6.38.7/arch/sparc/kernel/traps_64.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/traps_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -75,7 +75,7 @@ static void dump_tl1_traplog(struct tl1_
  		       i + 1,
  		       p->trapstack[i].tstate, p->trapstack[i].tpc,
@@ -4502,7 +4578,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_64.c linux-2.6.38.2/arch/sparc
  	       (void *) regs->u_regs[UREG_I7]);
  	printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
  	       "pte[%lx] error[%lx]\n",
-@@ -2196,13 +2207,13 @@ void show_stack(struct task_struct *tsk,
+@@ -2195,13 +2206,13 @@ void show_stack(struct task_struct *tsk,
  			fp = (unsigned long)sf->fp + STACK_BIAS;
  		}
  
@@ -4518,7 +4594,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_64.c linux-2.6.38.2/arch/sparc
  				graph++;
  			}
  		}
-@@ -2255,7 +2266,7 @@ void die_if_kernel(char *str, struct pt_
+@@ -2254,7 +2265,7 @@ void die_if_kernel(char *str, struct pt_
  		while (rw &&
  		       count++ < 30 &&
  		       kstack_valid(tp, (unsigned long) rw)) {
@@ -4527,9 +4603,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/traps_64.c linux-2.6.38.2/arch/sparc
  			       (void *) rw->ins[7]);
  
  			rw = kernel_stack_up(rw);
-diff -urNp linux-2.6.38.2/arch/sparc/kernel/unaligned_64.c linux-2.6.38.2/arch/sparc/kernel/unaligned_64.c
---- linux-2.6.38.2/arch/sparc/kernel/unaligned_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/kernel/unaligned_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/kernel/unaligned_64.c linux-2.6.38.7/arch/sparc/kernel/unaligned_64.c
+--- linux-2.6.38.7/arch/sparc/kernel/unaligned_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/kernel/unaligned_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -278,7 +278,7 @@ static void log_unaligned(struct pt_regs
  	static DEFINE_RATELIMIT_STATE(ratelimit, 5 * HZ, 5);
  
@@ -4539,9 +4615,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/kernel/unaligned_64.c linux-2.6.38.2/arch/s
  		       regs->tpc, (void *) regs->tpc);
  	}
  }
-diff -urNp linux-2.6.38.2/arch/sparc/lib/atomic_64.S linux-2.6.38.2/arch/sparc/lib/atomic_64.S
---- linux-2.6.38.2/arch/sparc/lib/atomic_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/lib/atomic_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/lib/atomic_64.S linux-2.6.38.7/arch/sparc/lib/atomic_64.S
+--- linux-2.6.38.7/arch/sparc/lib/atomic_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/lib/atomic_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -18,7 +18,12 @@
  atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
  	BACKOFF_SETUP(%o2)
@@ -4776,9 +4852,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/lib/atomic_64.S linux-2.6.38.2/arch/sparc/l
  	casx	[%o1], %g1, %g7
  	cmp	%g1, %g7
  	bne,pn	%xcc, BACKOFF_LABEL(2f, 1b)
-diff -urNp linux-2.6.38.2/arch/sparc/lib/ksyms.c linux-2.6.38.2/arch/sparc/lib/ksyms.c
---- linux-2.6.38.2/arch/sparc/lib/ksyms.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/lib/ksyms.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/lib/ksyms.c linux-2.6.38.7/arch/sparc/lib/ksyms.c
+--- linux-2.6.38.7/arch/sparc/lib/ksyms.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/lib/ksyms.c	2011-04-28 19:34:14.000000000 -0400
 @@ -142,12 +142,17 @@ EXPORT_SYMBOL(__downgrade_write);
  
  /* Atomic counter implementation. */
@@ -4797,9 +4873,21 @@ diff -urNp linux-2.6.38.2/arch/sparc/lib/ksyms.c linux-2.6.38.2/arch/sparc/lib/k
  EXPORT_SYMBOL(atomic64_sub_ret);
  
  /* Atomic bit operations. */
-diff -urNp linux-2.6.38.2/arch/sparc/Makefile linux-2.6.38.2/arch/sparc/Makefile
---- linux-2.6.38.2/arch/sparc/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/lib/Makefile linux-2.6.38.7/arch/sparc/lib/Makefile
+--- linux-2.6.38.7/arch/sparc/lib/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/lib/Makefile	2011-05-17 19:31:43.000000000 -0400
+@@ -2,7 +2,7 @@
+ #
+ 
+ asflags-y := -ansi -DST_DIV0=0x02
+-ccflags-y := -Werror
++#ccflags-y := -Werror
+ 
+ lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
+ lib-$(CONFIG_SPARC32) += memcpy.o memset.o
+diff -urNp linux-2.6.38.7/arch/sparc/Makefile linux-2.6.38.7/arch/sparc/Makefile
+--- linux-2.6.38.7/arch/sparc/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/Makefile	2011-04-28 19:34:14.000000000 -0400
 @@ -75,7 +75,7 @@ drivers-$(CONFIG_OPROFILE)	+= arch/sparc
  # Export what is needed by arch/sparc/boot/Makefile
  export VMLINUX_INIT VMLINUX_MAIN
@@ -4809,9 +4897,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/Makefile linux-2.6.38.2/arch/sparc/Makefile
  VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
  VMLINUX_MAIN += $(drivers-y) $(net-y)
  
-diff -urNp linux-2.6.38.2/arch/sparc/mm/fault_32.c linux-2.6.38.2/arch/sparc/mm/fault_32.c
---- linux-2.6.38.2/arch/sparc/mm/fault_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/fault_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/fault_32.c linux-2.6.38.7/arch/sparc/mm/fault_32.c
+--- linux-2.6.38.7/arch/sparc/mm/fault_32.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/fault_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -22,6 +22,9 @@
  #include <linux/interrupt.h>
  #include <linux/module.h>
@@ -5091,7 +5179,7 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/fault_32.c linux-2.6.38.2/arch/sparc/mm/
  static noinline void do_fault_siginfo(int code, int sig, struct pt_regs *regs,
  				      int text_fault)
  {
-@@ -282,6 +547,24 @@ good_area:
+@@ -281,6 +546,24 @@ good_area:
  		if(!(vma->vm_flags & VM_WRITE))
  			goto bad_area;
  	} else {
@@ -5116,9 +5204,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/fault_32.c linux-2.6.38.2/arch/sparc/mm/
  		/* Allow reads even for write-only mappings */
  		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
  			goto bad_area;
-diff -urNp linux-2.6.38.2/arch/sparc/mm/fault_64.c linux-2.6.38.2/arch/sparc/mm/fault_64.c
---- linux-2.6.38.2/arch/sparc/mm/fault_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/fault_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/fault_64.c linux-2.6.38.7/arch/sparc/mm/fault_64.c
+--- linux-2.6.38.7/arch/sparc/mm/fault_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/fault_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -21,6 +21,9 @@
  #include <linux/kprobes.h>
  #include <linux/kdebug.h>
@@ -5626,9 +5714,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/fault_64.c linux-2.6.38.2/arch/sparc/mm/
  	/* Pure DTLB misses do not tell us whether the fault causing
  	 * load/store/atomic was a write or not, it only says that there
  	 * was no match.  So in such a case we (carefully) read the
-diff -urNp linux-2.6.38.2/arch/sparc/mm/hugetlbpage.c linux-2.6.38.2/arch/sparc/mm/hugetlbpage.c
---- linux-2.6.38.2/arch/sparc/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/hugetlbpage.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/hugetlbpage.c linux-2.6.38.7/arch/sparc/mm/hugetlbpage.c
+--- linux-2.6.38.7/arch/sparc/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/hugetlbpage.c	2011-04-28 19:34:14.000000000 -0400
 @@ -68,7 +68,7 @@ full_search:
  			}
  			return -ENOMEM;
@@ -5688,9 +5776,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/hugetlbpage.c linux-2.6.38.2/arch/sparc/
  			return addr;
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.38.2/arch/sparc/mm/init_32.c linux-2.6.38.2/arch/sparc/mm/init_32.c
---- linux-2.6.38.2/arch/sparc/mm/init_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/init_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/init_32.c linux-2.6.38.7/arch/sparc/mm/init_32.c
+--- linux-2.6.38.7/arch/sparc/mm/init_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/init_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -318,6 +318,9 @@ extern void device_scan(void);
  pgprot_t PAGE_SHARED __read_mostly;
  EXPORT_SYMBOL(PAGE_SHARED);
@@ -5725,9 +5813,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/init_32.c linux-2.6.38.2/arch/sparc/mm/i
  	protection_map[12] = PAGE_READONLY;
  	protection_map[13] = PAGE_READONLY;
  	protection_map[14] = PAGE_SHARED;
-diff -urNp linux-2.6.38.2/arch/sparc/mm/Makefile linux-2.6.38.2/arch/sparc/mm/Makefile
---- linux-2.6.38.2/arch/sparc/mm/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/Makefile linux-2.6.38.7/arch/sparc/mm/Makefile
+--- linux-2.6.38.7/arch/sparc/mm/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/Makefile	2011-04-28 19:34:14.000000000 -0400
 @@ -2,7 +2,7 @@
  #
  
@@ -5737,9 +5825,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/Makefile linux-2.6.38.2/arch/sparc/mm/Ma
  
  obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
  obj-y                   += fault_$(BITS).o
-diff -urNp linux-2.6.38.2/arch/sparc/mm/srmmu.c linux-2.6.38.2/arch/sparc/mm/srmmu.c
---- linux-2.6.38.2/arch/sparc/mm/srmmu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/sparc/mm/srmmu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/sparc/mm/srmmu.c linux-2.6.38.7/arch/sparc/mm/srmmu.c
+--- linux-2.6.38.7/arch/sparc/mm/srmmu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/sparc/mm/srmmu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -2200,6 +2200,13 @@ void __init ld_mmu_srmmu(void)
  	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
  	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
@@ -5754,9 +5842,9 @@ diff -urNp linux-2.6.38.2/arch/sparc/mm/srmmu.c linux-2.6.38.2/arch/sparc/mm/srm
  	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
  	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
  
-diff -urNp linux-2.6.38.2/arch/um/include/asm/kmap_types.h linux-2.6.38.2/arch/um/include/asm/kmap_types.h
---- linux-2.6.38.2/arch/um/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/um/include/asm/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/um/include/asm/kmap_types.h linux-2.6.38.7/arch/um/include/asm/kmap_types.h
+--- linux-2.6.38.7/arch/um/include/asm/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/um/include/asm/kmap_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -23,6 +23,7 @@ enum km_type {
  	KM_IRQ1,
  	KM_SOFTIRQ0,
@@ -5765,9 +5853,9 @@ diff -urNp linux-2.6.38.2/arch/um/include/asm/kmap_types.h linux-2.6.38.2/arch/u
  	KM_TYPE_NR
  };
  
-diff -urNp linux-2.6.38.2/arch/um/include/asm/page.h linux-2.6.38.2/arch/um/include/asm/page.h
---- linux-2.6.38.2/arch/um/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/um/include/asm/page.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/um/include/asm/page.h linux-2.6.38.7/arch/um/include/asm/page.h
+--- linux-2.6.38.7/arch/um/include/asm/page.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/um/include/asm/page.h	2011-04-28 19:34:14.000000000 -0400
 @@ -14,6 +14,9 @@
  #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
  #define PAGE_MASK	(~(PAGE_SIZE-1))
@@ -5778,9 +5866,9 @@ diff -urNp linux-2.6.38.2/arch/um/include/asm/page.h linux-2.6.38.2/arch/um/incl
  #ifndef __ASSEMBLY__
  
  struct page;
-diff -urNp linux-2.6.38.2/arch/um/kernel/process.c linux-2.6.38.2/arch/um/kernel/process.c
---- linux-2.6.38.2/arch/um/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/um/kernel/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/um/kernel/process.c linux-2.6.38.7/arch/um/kernel/process.c
+--- linux-2.6.38.7/arch/um/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/um/kernel/process.c	2011-04-28 19:34:14.000000000 -0400
 @@ -404,22 +404,6 @@ int singlestepping(void * t)
  	return 2;
  }
@@ -5804,9 +5892,9 @@ diff -urNp linux-2.6.38.2/arch/um/kernel/process.c linux-2.6.38.2/arch/um/kernel
  unsigned long get_wchan(struct task_struct *p)
  {
  	unsigned long stack_page, sp, ip;
-diff -urNp linux-2.6.38.2/arch/um/sys-i386/syscalls.c linux-2.6.38.2/arch/um/sys-i386/syscalls.c
---- linux-2.6.38.2/arch/um/sys-i386/syscalls.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/um/sys-i386/syscalls.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/um/sys-i386/syscalls.c linux-2.6.38.7/arch/um/sys-i386/syscalls.c
+--- linux-2.6.38.7/arch/um/sys-i386/syscalls.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/um/sys-i386/syscalls.c	2011-04-28 19:34:14.000000000 -0400
 @@ -11,6 +11,21 @@
  #include "asm/uaccess.h"
  #include "asm/unistd.h"
@@ -5829,9 +5917,9 @@ diff -urNp linux-2.6.38.2/arch/um/sys-i386/syscalls.c linux-2.6.38.2/arch/um/sys
  /*
   * The prototype on i386 is:
   *
-diff -urNp linux-2.6.38.2/arch/x86/boot/bitops.h linux-2.6.38.2/arch/x86/boot/bitops.h
---- linux-2.6.38.2/arch/x86/boot/bitops.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/bitops.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/bitops.h linux-2.6.38.7/arch/x86/boot/bitops.h
+--- linux-2.6.38.7/arch/x86/boot/bitops.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/bitops.h	2011-04-28 19:34:14.000000000 -0400
 @@ -26,7 +26,7 @@ static inline int variable_test_bit(int 
  	u8 v;
  	const u32 *p = (const u32 *)addr;
@@ -5850,9 +5938,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/bitops.h linux-2.6.38.2/arch/x86/boot/bi
  }
  
  #endif /* BOOT_BITOPS_H */
-diff -urNp linux-2.6.38.2/arch/x86/boot/boot.h linux-2.6.38.2/arch/x86/boot/boot.h
---- linux-2.6.38.2/arch/x86/boot/boot.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/boot.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/boot.h linux-2.6.38.7/arch/x86/boot/boot.h
+--- linux-2.6.38.7/arch/x86/boot/boot.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/boot.h	2011-04-28 19:34:14.000000000 -0400
 @@ -85,7 +85,7 @@ static inline void io_delay(void)
  static inline u16 ds(void)
  {
@@ -5871,9 +5959,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/boot.h linux-2.6.38.2/arch/x86/boot/boot
  	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
  	return diff;
  }
-diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/head_32.S linux-2.6.38.2/arch/x86/boot/compressed/head_32.S
---- linux-2.6.38.2/arch/x86/boot/compressed/head_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/compressed/head_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/compressed/head_32.S linux-2.6.38.7/arch/x86/boot/compressed/head_32.S
+--- linux-2.6.38.7/arch/x86/boot/compressed/head_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/compressed/head_32.S	2011-04-28 19:34:14.000000000 -0400
 @@ -76,7 +76,7 @@ ENTRY(startup_32)
  	notl	%eax
  	andl    %eax, %ebx
@@ -5902,9 +5990,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/head_32.S linux-2.6.38.2/arch
  	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
  	jmp	1b
  2:
-diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/head_64.S linux-2.6.38.2/arch/x86/boot/compressed/head_64.S
---- linux-2.6.38.2/arch/x86/boot/compressed/head_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/compressed/head_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/compressed/head_64.S linux-2.6.38.7/arch/x86/boot/compressed/head_64.S
+--- linux-2.6.38.7/arch/x86/boot/compressed/head_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/compressed/head_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -91,7 +91,7 @@ ENTRY(startup_32)
  	notl	%eax
  	andl	%eax, %ebx
@@ -5923,9 +6011,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/head_64.S linux-2.6.38.2/arch
  #endif
  
  	/* Target address to relocate to for decompression */
-diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/misc.c linux-2.6.38.2/arch/x86/boot/compressed/misc.c
---- linux-2.6.38.2/arch/x86/boot/compressed/misc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/compressed/misc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/compressed/misc.c linux-2.6.38.7/arch/x86/boot/compressed/misc.c
+--- linux-2.6.38.7/arch/x86/boot/compressed/misc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/compressed/misc.c	2011-04-28 19:34:14.000000000 -0400
 @@ -310,7 +310,7 @@ static void parse_elf(void *output)
  		case PT_LOAD:
  #ifdef CONFIG_RELOCATABLE
@@ -5944,9 +6032,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/misc.c linux-2.6.38.2/arch/x8
  		error("Wrong destination address");
  #endif
  
-diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/relocs.c linux-2.6.38.2/arch/x86/boot/compressed/relocs.c
---- linux-2.6.38.2/arch/x86/boot/compressed/relocs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/compressed/relocs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/compressed/relocs.c linux-2.6.38.7/arch/x86/boot/compressed/relocs.c
+--- linux-2.6.38.7/arch/x86/boot/compressed/relocs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/compressed/relocs.c	2011-04-28 19:34:14.000000000 -0400
 @@ -13,8 +13,11 @@
  
  static void die(char *fmt, ...);
@@ -6139,9 +6227,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/compressed/relocs.c linux-2.6.38.2/arch/
  	read_shdrs(fp);
  	read_strtabs(fp);
  	read_symtabs(fp);
-diff -urNp linux-2.6.38.2/arch/x86/boot/cpucheck.c linux-2.6.38.2/arch/x86/boot/cpucheck.c
---- linux-2.6.38.2/arch/x86/boot/cpucheck.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/cpucheck.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/cpucheck.c linux-2.6.38.7/arch/x86/boot/cpucheck.c
+--- linux-2.6.38.7/arch/x86/boot/cpucheck.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/cpucheck.c	2011-04-28 19:34:14.000000000 -0400
 @@ -74,7 +74,7 @@ static int has_fpu(void)
  	u16 fcw = -1, fsw = -1;
  	u32 cr0;
@@ -6237,9 +6325,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/cpucheck.c linux-2.6.38.2/arch/x86/boot/
  
  		err = check_flags();
  	}
-diff -urNp linux-2.6.38.2/arch/x86/boot/header.S linux-2.6.38.2/arch/x86/boot/header.S
---- linux-2.6.38.2/arch/x86/boot/header.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/header.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/header.S linux-2.6.38.7/arch/x86/boot/header.S
+--- linux-2.6.38.7/arch/x86/boot/header.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/header.S	2011-04-28 19:34:14.000000000 -0400
 @@ -224,7 +224,7 @@ setup_data:		.quad 0			# 64-bit physical
  						# single linked list of
  						# struct setup_data
@@ -6249,9 +6337,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/header.S linux-2.6.38.2/arch/x86/boot/he
  
  #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
  #define VO_INIT_SIZE	(VO__end - VO__text)
-diff -urNp linux-2.6.38.2/arch/x86/boot/memory.c linux-2.6.38.2/arch/x86/boot/memory.c
---- linux-2.6.38.2/arch/x86/boot/memory.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/memory.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/memory.c linux-2.6.38.7/arch/x86/boot/memory.c
+--- linux-2.6.38.7/arch/x86/boot/memory.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/memory.c	2011-04-28 19:34:14.000000000 -0400
 @@ -19,7 +19,7 @@
  
  static int detect_memory_e820(void)
@@ -6261,9 +6349,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/memory.c linux-2.6.38.2/arch/x86/boot/me
  	struct biosregs ireg, oreg;
  	struct e820entry *desc = boot_params.e820_map;
  	static struct e820entry buf; /* static so it is zeroed */
-diff -urNp linux-2.6.38.2/arch/x86/boot/video.c linux-2.6.38.2/arch/x86/boot/video.c
---- linux-2.6.38.2/arch/x86/boot/video.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/video.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/video.c linux-2.6.38.7/arch/x86/boot/video.c
+--- linux-2.6.38.7/arch/x86/boot/video.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/video.c	2011-04-28 19:34:14.000000000 -0400
 @@ -96,7 +96,7 @@ static void store_mode_params(void)
  static unsigned int get_entry(void)
  {
@@ -6273,9 +6361,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/video.c linux-2.6.38.2/arch/x86/boot/vid
  	int key;
  	unsigned int v;
  
-diff -urNp linux-2.6.38.2/arch/x86/boot/video-vesa.c linux-2.6.38.2/arch/x86/boot/video-vesa.c
---- linux-2.6.38.2/arch/x86/boot/video-vesa.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/boot/video-vesa.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/boot/video-vesa.c linux-2.6.38.7/arch/x86/boot/video-vesa.c
+--- linux-2.6.38.7/arch/x86/boot/video-vesa.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/boot/video-vesa.c	2011-04-28 19:34:14.000000000 -0400
 @@ -200,6 +200,7 @@ static void vesa_store_pm_info(void)
  
  	boot_params.screen_info.vesapm_seg = oreg.es;
@@ -6284,9 +6372,9 @@ diff -urNp linux-2.6.38.2/arch/x86/boot/video-vesa.c linux-2.6.38.2/arch/x86/boo
  }
  
  /*
-diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32_aout.c linux-2.6.38.2/arch/x86/ia32/ia32_aout.c
---- linux-2.6.38.2/arch/x86/ia32/ia32_aout.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/ia32/ia32_aout.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/ia32/ia32_aout.c linux-2.6.38.7/arch/x86/ia32/ia32_aout.c
+--- linux-2.6.38.7/arch/x86/ia32/ia32_aout.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/ia32/ia32_aout.c	2011-04-28 19:34:14.000000000 -0400
 @@ -162,6 +162,8 @@ static int aout_core_dump(long signr, st
  	unsigned long dump_start, dump_size;
  	struct user32 dump;
@@ -6296,9 +6384,9 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32_aout.c linux-2.6.38.2/arch/x86/ia32
  	fs = get_fs();
  	set_fs(KERNEL_DS);
  	has_dumped = 1;
-diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32/ia32entry.S
---- linux-2.6.38.2/arch/x86/ia32/ia32entry.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/ia32/ia32entry.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/ia32/ia32entry.S linux-2.6.38.7/arch/x86/ia32/ia32entry.S
+--- linux-2.6.38.7/arch/x86/ia32/ia32entry.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/ia32/ia32entry.S	2011-05-22 23:15:39.000000000 -0400
 @@ -13,6 +13,7 @@
  #include <asm/thread_info.h>	
  #include <asm/segment.h>
@@ -6307,7 +6395,7 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  #include <linux/linkage.h>
  
  /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
-@@ -93,6 +94,18 @@ ENTRY(native_irq_enable_sysexit)
+@@ -93,6 +94,32 @@ ENTRY(native_irq_enable_sysexit)
  ENDPROC(native_irq_enable_sysexit)
  #endif
  
@@ -6321,20 +6409,45 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	call pax_exit_kernel_user
 +#endif
++#ifdef CONFIG_PAX_RANDKSTACK
++	pushq %rax
++	call pax_randomize_kstack
++	popq %rax
++#endif
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	call pax_erase_kstack
++#endif
++	.endm
++
++	.macro pax_erase_kstack
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	call pax_erase_kstack
++#endif
 +	.endm
 +
  /*
   * 32bit SYSENTER instruction entry.
   *
-@@ -120,6 +133,7 @@ ENTRY(ia32_sysenter_target)
+@@ -119,7 +146,7 @@ ENTRY(ia32_sysenter_target)
+ 	CFI_REGISTER	rsp,rbp
  	SWAPGS_UNSAFE_STACK
  	movq	PER_CPU_VAR(kernel_stack), %rsp
- 	addq	$(KERNEL_STACK_OFFSET),%rsp
+-	addq	$(KERNEL_STACK_OFFSET),%rsp
 +	pax_enter_kernel_user
  	/*
  	 * No need to follow this irqs on/off section: the syscall
  	 * disabled irqs, here we enable it straight after entry:
-@@ -150,6 +164,12 @@ ENTRY(ia32_sysenter_target)
+@@ -135,7 +162,8 @@ ENTRY(ia32_sysenter_target)
+ 	pushfq
+ 	CFI_ADJUST_CFA_OFFSET 8
+ 	/*CFI_REL_OFFSET rflags,0*/
+-	movl	8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
++	GET_THREAD_INFO(%r10)
++	movl	TI_sysenter_return(%r10), %r10d
+ 	CFI_REGISTER rip,r10
+ 	pushq	$__USER32_CS
+ 	CFI_ADJUST_CFA_OFFSET 8
+@@ -150,6 +178,12 @@ ENTRY(ia32_sysenter_target)
  	SAVE_ARGS 0,0,1
   	/* no need to do an access_ok check here because rbp has been
   	   32bit zero extended */ 
@@ -6347,7 +6460,7 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  1:	movl	(%rbp),%ebp
   	.section __ex_table,"a"
   	.quad 1b,ia32_badarg
-@@ -172,6 +192,7 @@ sysenter_dispatch:
+@@ -172,6 +206,7 @@ sysenter_dispatch:
  	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
  	jnz	sysexit_audit
  sysexit_from_sys_call:
@@ -6355,7 +6468,35 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  	andl    $~TS_COMPAT,TI_status(%r10)
  	/* clear IF, that popfq doesn't enable interrupts early */
  	andl  $~0x200,EFLAGS-R11(%rsp) 
-@@ -290,6 +311,11 @@ ENTRY(ia32_cstar_target)
+@@ -200,6 +235,9 @@ sysexit_from_sys_call:
+ 	movl %eax,%esi			/* 2nd arg: syscall number */
+ 	movl $AUDIT_ARCH_I386,%edi	/* 1st arg: audit arch */
+ 	call audit_syscall_entry
++
++	pax_erase_kstack
++
+ 	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall number */
+ 	cmpq $(IA32_NR_syscalls-1),%rax
+ 	ja ia32_badsys
+@@ -252,6 +290,9 @@ sysenter_tracesys:
+ 	movq	$-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
+ 	movq	%rsp,%rdi        /* &pt_regs -> arg1 */
+ 	call	syscall_trace_enter
++
++	pax_erase_kstack
++
+ 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+ 	cmpq	$(IA32_NR_syscalls-1),%rax
+@@ -283,19 +324,24 @@ ENDPROC(ia32_sysenter_target)
+ ENTRY(ia32_cstar_target)
+ 	CFI_STARTPROC32	simple
+ 	CFI_SIGNAL_FRAME
+-	CFI_DEF_CFA	rsp,KERNEL_STACK_OFFSET
++	CFI_DEF_CFA	rsp,0
+ 	CFI_REGISTER	rip,rcx
+ 	/*CFI_REGISTER	rflags,r11*/
+ 	SWAPGS_UNSAFE_STACK
  	movl	%esp,%r8d
  	CFI_REGISTER	rsp,r8
  	movq	PER_CPU_VAR(kernel_stack),%rsp
@@ -6367,7 +6508,14 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  	/*
  	 * No need to follow this irqs on/off section: the syscall
  	 * disabled irqs and here we enable it straight after entry:
-@@ -311,6 +337,12 @@ ENTRY(ia32_cstar_target)
+ 	 */
+ 	ENABLE_INTERRUPTS(CLBR_NONE)
+-	SAVE_ARGS 8,1,1
++	SAVE_ARGS 8*6,1,1
+ 	movl 	%eax,%eax	/* zero extension */
+ 	movq	%rax,ORIG_RAX-ARGOFFSET(%rsp)
+ 	movq	%rcx,RIP-ARGOFFSET(%rsp)
+@@ -311,6 +357,12 @@ ENTRY(ia32_cstar_target)
  	/* no need to do an access_ok check here because r8 has been
  	   32bit zero extended */ 
  	/* hardware stack frame is complete now */	
@@ -6380,7 +6528,7 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  1:	movl	(%r8),%r9d
  	.section __ex_table,"a"
  	.quad 1b,ia32_badarg
-@@ -333,6 +365,7 @@ cstar_dispatch:
+@@ -333,6 +385,7 @@ cstar_dispatch:
  	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
  	jnz sysretl_audit
  sysretl_from_sys_call:
@@ -6388,7 +6536,17 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  	andl $~TS_COMPAT,TI_status(%r10)
  	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
  	movl RIP-ARGOFFSET(%rsp),%ecx
-@@ -415,6 +448,7 @@ ENTRY(ia32_syscall)
+@@ -370,6 +423,9 @@ cstar_tracesys:
+ 	movq $-ENOSYS,RAX(%rsp)	/* ptrace can change this for a bad syscall */
+ 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
+ 	call syscall_trace_enter
++
++	pax_erase_kstack
++
+ 	LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+ 	xchgl %ebp,%r9d
+@@ -415,6 +471,7 @@ ENTRY(ia32_syscall)
  	CFI_REL_OFFSET	rip,RIP-RIP
  	PARAVIRT_ADJUST_EXCEPTION_FRAME
  	SWAPGS
@@ -6396,9 +6554,19 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32entry.S linux-2.6.38.2/arch/x86/ia32
  	/*
  	 * No need to follow this irqs on/off section: the syscall
  	 * disabled irqs and here we enable it straight after entry:
-diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32_signal.c linux-2.6.38.2/arch/x86/ia32/ia32_signal.c
---- linux-2.6.38.2/arch/x86/ia32/ia32_signal.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/ia32/ia32_signal.c	2011-03-21 18:31:35.000000000 -0400
+@@ -448,6 +505,9 @@ ia32_tracesys:			 
+ 	movq $-ENOSYS,RAX(%rsp)	/* ptrace can change this for a bad syscall */
+ 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
+ 	call syscall_trace_enter
++
++	pax_erase_kstack
++
+ 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
+ 	RESTORE_REST
+ 	cmpq $(IA32_NR_syscalls-1),%rax
+diff -urNp linux-2.6.38.7/arch/x86/ia32/ia32_signal.c linux-2.6.38.7/arch/x86/ia32/ia32_signal.c
+--- linux-2.6.38.7/arch/x86/ia32/ia32_signal.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/ia32/ia32_signal.c	2011-04-28 19:34:14.000000000 -0400
 @@ -403,7 +403,7 @@ static void __user *get_sigframe(struct 
  	sp -= frame_size;
  	/* Align the stack pointer according to the i386 ABI,
@@ -6448,9 +6616,9 @@ diff -urNp linux-2.6.38.2/arch/x86/ia32/ia32_signal.c linux-2.6.38.2/arch/x86/ia
  	} put_user_catch(err);
  
  	if (err)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/alternative.h linux-2.6.38.2/arch/x86/include/asm/alternative.h
---- linux-2.6.38.2/arch/x86/include/asm/alternative.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/alternative.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/alternative.h linux-2.6.38.7/arch/x86/include/asm/alternative.h
+--- linux-2.6.38.7/arch/x86/include/asm/alternative.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/alternative.h	2011-04-28 19:34:14.000000000 -0400
 @@ -94,7 +94,7 @@ static inline int alternatives_text_rese
        ".section .discard,\"aw\",@progbits\n"				\
        "	 .byte 0xff + (664f-663f) - (662b-661b)\n" /* rlen <= slen */	\
@@ -6460,9 +6628,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/alternative.h linux-2.6.38.2/arch
        "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
        ".previous"
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/apm.h linux-2.6.38.2/arch/x86/include/asm/apm.h
---- linux-2.6.38.2/arch/x86/include/asm/apm.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/apm.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/apm.h linux-2.6.38.7/arch/x86/include/asm/apm.h
+--- linux-2.6.38.7/arch/x86/include/asm/apm.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/apm.h	2011-04-28 19:34:14.000000000 -0400
 @@ -34,7 +34,7 @@ static inline void apm_bios_call_asm(u32
  	__asm__ __volatile__(APM_DO_ZERO_SEGS
  		"pushl %%edi\n\t"
@@ -6481,9 +6649,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/apm.h linux-2.6.38.2/arch/x86/inc
  		"setc %%bl\n\t"
  		"popl %%ebp\n\t"
  		"popl %%edi\n\t"
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic64_32.h linux-2.6.38.2/arch/x86/include/asm/atomic64_32.h
---- linux-2.6.38.2/arch/x86/include/asm/atomic64_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/atomic64_32.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/atomic64_32.h linux-2.6.38.7/arch/x86/include/asm/atomic64_32.h
+--- linux-2.6.38.7/arch/x86/include/asm/atomic64_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/atomic64_32.h	2011-05-11 18:35:16.000000000 -0400
 @@ -12,6 +12,14 @@ typedef struct {
  	u64 __aligned(8) counter;
  } atomic64_t;
@@ -6499,9 +6667,143 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic64_32.h linux-2.6.38.2/arch
  #define ATOMIC64_INIT(val)	{ (val) }
  
  #ifdef CONFIG_X86_CMPXCHG64
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h
---- linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h	2011-03-21 18:31:35.000000000 -0400
+@@ -38,6 +46,21 @@ static inline long long atomic64_cmpxchg
+ }
+ 
+ /**
++ * atomic64_cmpxchg_unchecked - cmpxchg atomic64 variable
++ * @p: pointer to type atomic64_unchecked_t
++ * @o: expected value
++ * @n: new value
++ *
++ * Atomically sets @v to @n if it was equal to @o and returns
++ * the old value.
++ */
++
++static inline long long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long long o, long long n)
++{
++	return cmpxchg64(&v->counter, o, n);
++}
++
++/**
+  * atomic64_xchg - xchg atomic64 variable
+  * @v: pointer to type atomic64_t
+  * @n: value to assign
+@@ -77,6 +100,24 @@ static inline void atomic64_set(atomic64
+ }
+ 
+ /**
++ * atomic64_set_unchecked - set atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ * @n: value to assign
++ *
++ * Atomically sets the value of @v to @n.
++ */
++static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long long i)
++{
++	unsigned high = (unsigned)(i >> 32);
++	unsigned low = (unsigned)i;
++	asm volatile(ATOMIC64_ALTERNATIVE(set)
++		     : "+b" (low), "+c" (high)
++		     : "S" (v)
++		     : "eax", "edx", "memory"
++		     );
++}
++
++/**
+  * atomic64_read - read atomic64 variable
+  * @v: pointer to type atomic64_t
+  *
+@@ -93,6 +134,22 @@ static inline long long atomic64_read(at
+  }
+ 
+ /**
++ * atomic64_read_unchecked - read atomic64 variable
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically reads the value of @v and returns it.
++ */
++static inline long long atomic64_read_unchecked(atomic64_unchecked_t *v)
++{
++	long long r;
++	asm volatile(ATOMIC64_ALTERNATIVE(read_unchecked)
++		     : "=A" (r), "+c" (v)
++		     : : "memory"
++		     );
++	return r;
++ }
++
++/**
+  * atomic64_add_return - add and return
+  * @i: integer value to add
+  * @v: pointer to type atomic64_t
+@@ -108,6 +165,22 @@ static inline long long atomic64_add_ret
+ 	return i;
+ }
+ 
++/**
++ * atomic64_add_return_unchecked - add and return
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v and returns @i + *@v
++ */
++static inline long long atomic64_add_return_unchecked(long long i, atomic64_unchecked_t *v)
++{
++	asm volatile(ATOMIC64_ALTERNATIVE(add_return_unchecked)
++		     : "+A" (i), "+c" (v)
++		     : : "memory"
++		     );
++	return i;
++}
++
+ /*
+  * Other variants with different arithmetic operators:
+  */
+@@ -131,6 +204,17 @@ static inline long long atomic64_inc_ret
+ 	return a;
+ }
+ 
++static inline long long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
++{
++	long long a;
++	asm volatile(ATOMIC64_ALTERNATIVE(inc_return_unchecked)
++		     : "=A" (a)
++		     : "S" (v)
++		     : "memory", "ecx"
++		     );
++	return a;
++}
++
+ static inline long long atomic64_dec_return(atomic64_t *v)
+ {
+ 	long long a;
+@@ -159,6 +243,22 @@ static inline long long atomic64_add(lon
+ }
+ 
+ /**
++ * atomic64_add_unchecked - add integer to atomic64 variable
++ * @i: integer value to add
++ * @v: pointer to type atomic64_unchecked_t
++ *
++ * Atomically adds @i to @v.
++ */
++static inline long long atomic64_add_unchecked(long long i, atomic64_unchecked_t *v)
++{
++	asm volatile(ATOMIC64_ALTERNATIVE_(add_unchecked, add_return_unchecked)
++		     : "+A" (i), "+c" (v)
++		     : : "memory"
++		     );
++	return i;
++}
++
++/**
+  * atomic64_sub - subtract the atomic64 variable
+  * @i: integer value to subtract
+  * @v: pointer to type atomic64_t
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/atomic64_64.h linux-2.6.38.7/arch/x86/include/asm/atomic64_64.h
+--- linux-2.6.38.7/arch/x86/include/asm/atomic64_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/atomic64_64.h	2011-05-16 21:47:08.000000000 -0400
 @@ -18,7 +18,19 @@
   */
  static inline long atomic64_read(const atomic64_t *v)
@@ -6776,7 +7078,19 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h linux-2.6.38.2/arch
  #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
  
  static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -206,17 +380,30 @@ static inline long atomic64_xchg(atomic6
+@@ -190,6 +364,11 @@ static inline long atomic64_cmpxchg(atom
+ 	return cmpxchg(&v->counter, old, new);
+ }
+ 
++static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
++{
++	return cmpxchg(&v->counter, old, new);
++}
++
+ static inline long atomic64_xchg(atomic64_t *v, long new)
+ {
+ 	return xchg(&v->counter, new);
+@@ -206,17 +385,30 @@ static inline long atomic64_xchg(atomic6
   */
  static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
  {
@@ -6811,9 +7125,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic64_64.h linux-2.6.38.2/arch
  }
  
  #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/include/asm/atomic.h
---- linux-2.6.38.2/arch/x86/include/asm/atomic.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/atomic.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/atomic.h linux-2.6.38.7/arch/x86/include/asm/atomic.h
+--- linux-2.6.38.7/arch/x86/include/asm/atomic.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/atomic.h	2011-04-28 19:57:25.000000000 -0400
 @@ -22,7 +22,18 @@
   */
  static inline int atomic_read(const atomic_t *v)
@@ -6905,7 +7219,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
 +/**
 + * atomic_sub_unchecked - subtract integer from atomic variable
 + * @i: integer value to subtract
-+ * @v: pointer of type atomic_t
++ * @v: pointer of type atomic_unchecked_t
 + *
 + * Atomically subtracts @i from @v.
 + */
@@ -6981,7 +7295,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
 +
 +/**
 + * atomic_dec_unchecked - decrement atomic variable
-+ * @v: pointer of type atomic_t
++ * @v: pointer of type atomic_unchecked_t
 + *
 + * Atomically decrements @v by 1.
 + */
@@ -7009,7 +7323,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
  		     : "+m" (v->counter), "=qm" (c)
  		     : : "memory");
  	return c != 0;
-@@ -138,7 +263,16 @@ static inline int atomic_inc_and_test(at
+@@ -138,7 +263,35 @@ static inline int atomic_inc_and_test(at
  {
  	unsigned char c;
  
@@ -7024,10 +7338,29 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
 +#endif
 +
 +		     "sete %1\n"
++		     : "+m" (v->counter), "=qm" (c)
++		     : : "memory");
++	return c != 0;
++}
++
++/**
++ * atomic_inc_and_test_unchecked - increment and test
++ * @v: pointer of type atomic_unchecked_t
++ *
++ * Atomically increments @v by 1
++ * and returns true if the result is zero, or false for all
++ * other cases.
++ */
++static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
++{
++	unsigned char c;
++
++	asm volatile(LOCK_PREFIX "incl %0\n"
++		     "sete %1\n"
  		     : "+m" (v->counter), "=qm" (c)
  		     : : "memory");
  	return c != 0;
-@@ -157,7 +291,16 @@ static inline int atomic_add_negative(in
+@@ -157,7 +310,16 @@ static inline int atomic_add_negative(in
  {
  	unsigned char c;
  
@@ -7045,7 +7378,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
  		     : "+m" (v->counter), "=qm" (c)
  		     : "ir" (i) : "memory");
  	return c;
-@@ -180,6 +323,46 @@ static inline int atomic_add_return(int 
+@@ -180,6 +342,46 @@ static inline int atomic_add_return(int 
  #endif
  	/* Modern 486+ processor */
  	__i = i;
@@ -7092,7 +7425,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
  	asm volatile(LOCK_PREFIX "xaddl %0, %1"
  		     : "+r" (i), "+m" (v->counter)
  		     : : "memory");
-@@ -208,6 +391,10 @@ static inline int atomic_sub_return(int 
+@@ -208,6 +410,10 @@ static inline int atomic_sub_return(int 
  }
  
  #define atomic_inc_return(v)  (atomic_add_return(1, v))
@@ -7103,7 +7436,29 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
  
  static inline int atomic_cmpxchg(atomic_t *v, int old, int new)
-@@ -231,21 +418,77 @@ static inline int atomic_xchg(atomic_t *
+@@ -215,11 +421,21 @@ static inline int atomic_cmpxchg(atomic_
+ 	return cmpxchg(&v->counter, old, new);
+ }
+ 
++static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
++{
++	return cmpxchg(&v->counter, old, new);
++}
++
+ static inline int atomic_xchg(atomic_t *v, int new)
+ {
+ 	return xchg(&v->counter, new);
+ }
+ 
++static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
++{
++	return xchg(&v->counter, new);
++}
++
+ /**
+  * atomic_add_unless - add unless the number is already a given value
+  * @v: pointer of type atomic_t
+@@ -231,21 +447,77 @@ static inline int atomic_xchg(atomic_t *
   */
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -7185,9 +7540,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/atomic.h linux-2.6.38.2/arch/x86/
  /*
   * atomic_dec_if_positive - decrement by 1 if old value positive
   * @v: pointer of type atomic_t
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/bitops.h linux-2.6.38.2/arch/x86/include/asm/bitops.h
---- linux-2.6.38.2/arch/x86/include/asm/bitops.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/bitops.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/bitops.h linux-2.6.38.7/arch/x86/include/asm/bitops.h
+--- linux-2.6.38.7/arch/x86/include/asm/bitops.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/bitops.h	2011-04-28 19:34:14.000000000 -0400
 @@ -38,7 +38,7 @@
   * a mask operation on a byte.
   */
@@ -7197,9 +7552,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/bitops.h linux-2.6.38.2/arch/x86/
  #define CONST_MASK(nr)			(1 << ((nr) & 7))
  
  /**
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/boot.h linux-2.6.38.2/arch/x86/include/asm/boot.h
---- linux-2.6.38.2/arch/x86/include/asm/boot.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/boot.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/boot.h linux-2.6.38.7/arch/x86/include/asm/boot.h
+--- linux-2.6.38.7/arch/x86/include/asm/boot.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/boot.h	2011-04-28 19:34:14.000000000 -0400
 @@ -11,10 +11,15 @@
  #include <asm/pgtable_types.h>
  
@@ -7217,9 +7572,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/boot.h linux-2.6.38.2/arch/x86/in
  /* Minimum kernel alignment, as a power of two */
  #ifdef CONFIG_X86_64
  #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/cacheflush.h linux-2.6.38.2/arch/x86/include/asm/cacheflush.h
---- linux-2.6.38.2/arch/x86/include/asm/cacheflush.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/cacheflush.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/cacheflush.h linux-2.6.38.7/arch/x86/include/asm/cacheflush.h
+--- linux-2.6.38.7/arch/x86/include/asm/cacheflush.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/cacheflush.h	2011-04-28 19:34:14.000000000 -0400
 @@ -26,7 +26,7 @@ static inline unsigned long get_page_mem
  	unsigned long pg_flags = pg->flags & _PGMT_MASK;
  
@@ -7229,20 +7584,28 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/cacheflush.h linux-2.6.38.2/arch/
  	else if (pg_flags == _PGMT_WC)
  		return _PAGE_CACHE_WC;
  	else if (pg_flags == _PGMT_UC_MINUS)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/cache.h linux-2.6.38.2/arch/x86/include/asm/cache.h
---- linux-2.6.38.2/arch/x86/include/asm/cache.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/cache.h	2011-03-21 18:31:35.000000000 -0400
-@@ -8,6 +8,7 @@
- #define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/cache.h linux-2.6.38.7/arch/x86/include/asm/cache.h
+--- linux-2.6.38.7/arch/x86/include/asm/cache.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/cache.h	2011-04-28 19:57:25.000000000 -0400
+@@ -5,12 +5,13 @@
+ 
+ /* L1 cache line size */
+ #define L1_CACHE_SHIFT	(CONFIG_X86_L1_CACHE_SHIFT)
+-#define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
++#define L1_CACHE_BYTES	(_AC(1,U) << L1_CACHE_SHIFT)
  
  #define __read_mostly __attribute__((__section__(".data..read_mostly")))
 +#define __read_only __attribute__((__section__(".data..read_only")))
  
  #define INTERNODE_CACHE_SHIFT CONFIG_X86_INTERNODE_CACHE_SHIFT
- #define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/checksum_32.h linux-2.6.38.2/arch/x86/include/asm/checksum_32.h
---- linux-2.6.38.2/arch/x86/include/asm/checksum_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/checksum_32.h	2011-03-21 18:31:35.000000000 -0400
+-#define INTERNODE_CACHE_BYTES (1 << INTERNODE_CACHE_SHIFT)
++#define INTERNODE_CACHE_BYTES (_AC(1,U) << INTERNODE_CACHE_SHIFT)
+ 
+ #ifdef CONFIG_X86_VSMP
+ #ifdef CONFIG_SMP
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/checksum_32.h linux-2.6.38.7/arch/x86/include/asm/checksum_32.h
+--- linux-2.6.38.7/arch/x86/include/asm/checksum_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/checksum_32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -31,6 +31,14 @@ asmlinkage __wsum csum_partial_copy_gene
  					    int len, __wsum sum,
  					    int *src_err_ptr, int *dst_err_ptr);
@@ -7276,9 +7639,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/checksum_32.h linux-2.6.38.2/arch
  						 len, sum, NULL, err_ptr);
  
  	if (len)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/cpufeature.h linux-2.6.38.2/arch/x86/include/asm/cpufeature.h
---- linux-2.6.38.2/arch/x86/include/asm/cpufeature.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/cpufeature.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/cpufeature.h linux-2.6.38.7/arch/x86/include/asm/cpufeature.h
+--- linux-2.6.38.7/arch/x86/include/asm/cpufeature.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/cpufeature.h	2011-04-28 19:34:14.000000000 -0400
 @@ -349,7 +349,7 @@ static __always_inline __pure bool __sta
  			     ".section .discard,\"aw\",@progbits\n"
  			     " .byte 0xff + (4f-3f) - (2b-1b)\n" /* size check */
@@ -7288,9 +7651,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/cpufeature.h linux-2.6.38.2/arch/
  			     "3: movb $1,%0\n"
  			     "4:\n"
  			     ".previous\n"
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc_defs.h linux-2.6.38.2/arch/x86/include/asm/desc_defs.h
---- linux-2.6.38.2/arch/x86/include/asm/desc_defs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/desc_defs.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/desc_defs.h linux-2.6.38.7/arch/x86/include/asm/desc_defs.h
+--- linux-2.6.38.7/arch/x86/include/asm/desc_defs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/desc_defs.h	2011-04-28 19:34:14.000000000 -0400
 @@ -31,6 +31,12 @@ struct desc_struct {
  			unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
  			unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
@@ -7304,9 +7667,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc_defs.h linux-2.6.38.2/arch/x
  	};
  } __attribute__((packed));
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/include/asm/desc.h
---- linux-2.6.38.2/arch/x86/include/asm/desc.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/desc.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/desc.h linux-2.6.38.7/arch/x86/include/asm/desc.h
+--- linux-2.6.38.7/arch/x86/include/asm/desc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/desc.h	2011-04-28 19:34:14.000000000 -0400
 @@ -4,6 +4,7 @@
  #include <asm/desc_defs.h>
  #include <asm/ldt.h>
@@ -7361,7 +7724,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  }
  
  #endif
-@@ -115,19 +118,24 @@ static inline void paravirt_free_ldt(str
+@@ -115,13 +118,17 @@ static inline void paravirt_free_ldt(str
  static inline void native_write_idt_entry(gate_desc *idt, int entry,
  					  const gate_desc *gate)
  {
@@ -7379,14 +7742,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  }
  
  static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
- 					  const void *desc, int type)
- {
- 	unsigned int size;
-+
- 	switch (type) {
- 	case DESC_TSS:
- 		size = sizeof(tss_desc);
-@@ -139,7 +147,10 @@ static inline void native_write_gdt_entr
+@@ -139,7 +146,10 @@ static inline void native_write_gdt_entr
  		size = sizeof(struct desc_struct);
  		break;
  	}
@@ -7397,7 +7753,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  }
  
  static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
-@@ -211,7 +222,9 @@ static inline void native_set_ldt(const 
+@@ -211,7 +221,9 @@ static inline void native_set_ldt(const 
  
  static inline void native_load_tr_desc(void)
  {
@@ -7407,7 +7763,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  }
  
  static inline void native_load_gdt(const struct desc_ptr *dtr)
-@@ -246,8 +259,10 @@ static inline void native_load_tls(struc
+@@ -246,8 +258,10 @@ static inline void native_load_tls(struc
  	unsigned int i;
  	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
  
@@ -7418,7 +7774,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  }
  
  #define _LDT_empty(info)				\
-@@ -309,7 +324,7 @@ static inline void set_desc_limit(struct
+@@ -309,7 +323,7 @@ static inline void set_desc_limit(struct
  	desc->limit = (limit >> 16) & 0xf;
  }
  
@@ -7427,7 +7783,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  			     unsigned dpl, unsigned ist, unsigned seg)
  {
  	gate_desc s;
-@@ -327,7 +342,7 @@ static inline void _set_gate(int gate, u
+@@ -327,7 +341,7 @@ static inline void _set_gate(int gate, u
   * Pentium F0 0F bugfix can have resulted in the mapped
   * IDT being write-protected.
   */
@@ -7436,7 +7792,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  {
  	BUG_ON((unsigned)n > 0xFF);
  	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
-@@ -356,19 +371,19 @@ static inline void alloc_intr_gate(unsig
+@@ -356,19 +370,19 @@ static inline void alloc_intr_gate(unsig
  /*
   * This routine sets up an interrupt gate at directory privilege level 3.
   */
@@ -7459,7 +7815,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
  {
  	BUG_ON((unsigned)n > 0xFF);
  	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
-@@ -377,19 +392,31 @@ static inline void set_trap_gate(unsigne
+@@ -377,19 +391,31 @@ static inline void set_trap_gate(unsigne
  static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
  {
  	BUG_ON((unsigned)n > 0xFF);
@@ -7494,9 +7850,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/desc.h linux-2.6.38.2/arch/x86/in
 +#endif
 +
  #endif /* _ASM_X86_DESC_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/device.h linux-2.6.38.2/arch/x86/include/asm/device.h
---- linux-2.6.38.2/arch/x86/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/device.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/device.h linux-2.6.38.7/arch/x86/include/asm/device.h
+--- linux-2.6.38.7/arch/x86/include/asm/device.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/device.h	2011-04-28 19:34:14.000000000 -0400
 @@ -6,7 +6,7 @@ struct dev_archdata {
  	void	*acpi_handle;
  #endif
@@ -7506,9 +7862,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/device.h linux-2.6.38.2/arch/x86/
  #endif
  #if defined(CONFIG_DMAR) || defined(CONFIG_AMD_IOMMU)
  	void *iommu; /* hook for IOMMU specific extension */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/dma-mapping.h linux-2.6.38.2/arch/x86/include/asm/dma-mapping.h
---- linux-2.6.38.2/arch/x86/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/dma-mapping.h linux-2.6.38.7/arch/x86/include/asm/dma-mapping.h
+--- linux-2.6.38.7/arch/x86/include/asm/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/dma-mapping.h	2011-04-28 19:34:14.000000000 -0400
 @@ -26,9 +26,9 @@ extern int iommu_merge;
  extern struct device x86_dma_fallback_dev;
  extern int panic_on_overflow;
@@ -7548,9 +7904,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/dma-mapping.h linux-2.6.38.2/arch
  
  	WARN_ON(irqs_disabled());       /* for portability */
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/e820.h linux-2.6.38.2/arch/x86/include/asm/e820.h
---- linux-2.6.38.2/arch/x86/include/asm/e820.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/e820.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/e820.h linux-2.6.38.7/arch/x86/include/asm/e820.h
+--- linux-2.6.38.7/arch/x86/include/asm/e820.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/e820.h	2011-04-28 19:34:14.000000000 -0400
 @@ -69,7 +69,7 @@ struct e820map {
  #define ISA_START_ADDRESS	0xa0000
  #define ISA_END_ADDRESS		0x100000
@@ -7560,9 +7916,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/e820.h linux-2.6.38.2/arch/x86/in
  #define BIOS_END		0x00100000
  
  #define BIOS_ROM_BASE		0xffe00000
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/elf.h linux-2.6.38.2/arch/x86/include/asm/elf.h
---- linux-2.6.38.2/arch/x86/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/elf.h linux-2.6.38.7/arch/x86/include/asm/elf.h
+--- linux-2.6.38.7/arch/x86/include/asm/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/elf.h	2011-04-28 19:34:14.000000000 -0400
 @@ -237,7 +237,25 @@ extern int force_personality32;
     the loader.  We need to make sure that it is out of the way of the program
     that it will "exec", and that there is sufficient room for the brk.  */
@@ -7616,9 +7972,20 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/elf.h linux-2.6.38.2/arch/x86/inc
 -#define arch_randomize_brk arch_randomize_brk
 -
  #endif /* _ASM_X86_ELF_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/futex.h linux-2.6.38.2/arch/x86/include/asm/futex.h
---- linux-2.6.38.2/arch/x86/include/asm/futex.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/futex.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/emergency-restart.h linux-2.6.38.7/arch/x86/include/asm/emergency-restart.h
+--- linux-2.6.38.7/arch/x86/include/asm/emergency-restart.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/emergency-restart.h	2011-05-22 23:03:34.000000000 -0400
+@@ -15,6 +15,6 @@ enum reboot_type {
+ 
+ extern enum reboot_type reboot_type;
+ 
+-extern void machine_emergency_restart(void);
++extern void machine_emergency_restart(void) __noreturn;
+ 
+ #endif /* _ASM_X86_EMERGENCY_RESTART_H */
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/futex.h linux-2.6.38.7/arch/x86/include/asm/futex.h
+--- linux-2.6.38.7/arch/x86/include/asm/futex.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/futex.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,16 +12,18 @@
  #include <asm/system.h>
  
@@ -7694,9 +8061,23 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/futex.h linux-2.6.38.2/arch/x86/i
  		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
  		     : "memory"
  	);
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/i387.h linux-2.6.38.2/arch/x86/include/asm/i387.h
---- linux-2.6.38.2/arch/x86/include/asm/i387.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/i387.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/hw_irq.h linux-2.6.38.7/arch/x86/include/asm/hw_irq.h
+--- linux-2.6.38.7/arch/x86/include/asm/hw_irq.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/hw_irq.h	2011-04-28 19:57:25.000000000 -0400
+@@ -113,8 +113,8 @@ extern void setup_ioapic_dest(void);
+ extern void enable_IO_APIC(void);
+ 
+ /* Statistics */
+-extern atomic_t irq_err_count;
+-extern atomic_t irq_mis_count;
++extern atomic_unchecked_t irq_err_count;
++extern atomic_unchecked_t irq_mis_count;
+ 
+ /* EISA */
+ extern void eisa_set_level_irq(unsigned int irq);
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/i387.h linux-2.6.38.7/arch/x86/include/asm/i387.h
+--- linux-2.6.38.7/arch/x86/include/asm/i387.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/i387.h	2011-04-28 19:34:14.000000000 -0400
 @@ -92,6 +92,11 @@ static inline int fxrstor_checking(struc
  {
  	int err;
@@ -7737,9 +8118,27 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/i387.h linux-2.6.38.2/arch/x86/in
  
  /*
   * These must be called with preempt disabled
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/io.h linux-2.6.38.2/arch/x86/include/asm/io.h
---- linux-2.6.38.2/arch/x86/include/asm/io.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/io.h	2011-03-21 18:31:35.000000000 -0400
+@@ -237,7 +242,7 @@ static inline void fpu_save_init(struct 
+ 	} else if (use_fxsr()) {
+ 		fpu_fxsave(fpu);
+ 	} else {
+-		asm volatile("fsave %[fx]; fwait"
++		asm volatile("fnsave %[fx]; fwait"
+ 			     : [fx] "=m" (fpu->state->fsave));
+ 		return;
+ 	}
+@@ -312,7 +317,7 @@ static inline void kernel_fpu_begin(void
+ 	struct thread_info *me = current_thread_info();
+ 	preempt_disable();
+ 	if (me->status & TS_USEDFPU)
+-		__save_init_fpu(me->task);
++		__save_init_fpu(current);
+ 	else
+ 		clts();
+ }
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/io.h linux-2.6.38.7/arch/x86/include/asm/io.h
+--- linux-2.6.38.7/arch/x86/include/asm/io.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/io.h	2011-04-28 19:34:14.000000000 -0400
 @@ -216,6 +216,17 @@ extern void set_iounmap_nonlazy(void);
  
  #include <linux/vmalloc.h>
@@ -7758,9 +8157,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/io.h linux-2.6.38.2/arch/x86/incl
  /*
   * Convert a virtual cached pointer to an uncached pointer
   */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/iommu.h linux-2.6.38.2/arch/x86/include/asm/iommu.h
---- linux-2.6.38.2/arch/x86/include/asm/iommu.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/iommu.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/iommu.h linux-2.6.38.7/arch/x86/include/asm/iommu.h
+--- linux-2.6.38.7/arch/x86/include/asm/iommu.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/iommu.h	2011-04-28 19:34:14.000000000 -0400
 @@ -1,7 +1,7 @@
  #ifndef _ASM_X86_IOMMU_H
  #define _ASM_X86_IOMMU_H
@@ -7770,9 +8169,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/iommu.h linux-2.6.38.2/arch/x86/i
  extern int force_iommu, no_iommu;
  extern int iommu_detected;
  extern int iommu_pass_through;
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/irqflags.h linux-2.6.38.2/arch/x86/include/asm/irqflags.h
---- linux-2.6.38.2/arch/x86/include/asm/irqflags.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/irqflags.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/irqflags.h linux-2.6.38.7/arch/x86/include/asm/irqflags.h
+--- linux-2.6.38.7/arch/x86/include/asm/irqflags.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/irqflags.h	2011-04-28 19:34:14.000000000 -0400
 @@ -140,6 +140,11 @@ static inline unsigned long arch_local_i
  	sti;					\
  	sysexit
@@ -7785,9 +8184,37 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/irqflags.h linux-2.6.38.2/arch/x8
  #else
  #define INTERRUPT_RETURN		iret
  #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/kvm_host.h linux-2.6.38.2/arch/x86/include/asm/kvm_host.h
---- linux-2.6.38.2/arch/x86/include/asm/kvm_host.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/kvm_host.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/kprobes.h linux-2.6.38.7/arch/x86/include/asm/kprobes.h
+--- linux-2.6.38.7/arch/x86/include/asm/kprobes.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/kprobes.h	2011-04-28 19:34:14.000000000 -0400
+@@ -37,13 +37,8 @@ typedef u8 kprobe_opcode_t;
+ #define RELATIVEJUMP_SIZE 5
+ #define RELATIVECALL_OPCODE 0xe8
+ #define RELATIVE_ADDR_SIZE 4
+-#define MAX_STACK_SIZE 64
+-#define MIN_STACK_SIZE(ADDR)					       \
+-	(((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
+-			      THREAD_SIZE - (unsigned long)(ADDR)))    \
+-	 ? (MAX_STACK_SIZE)					       \
+-	 : (((unsigned long)current_thread_info()) +		       \
+-	    THREAD_SIZE - (unsigned long)(ADDR)))
++#define MAX_STACK_SIZE 64UL
++#define MIN_STACK_SIZE(ADDR)	min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
+ 
+ #define flush_insn_slot(p)	do { } while (0)
+ 
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/kvm_host.h linux-2.6.38.7/arch/x86/include/asm/kvm_host.h
+--- linux-2.6.38.7/arch/x86/include/asm/kvm_host.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/kvm_host.h	2011-04-28 19:57:25.000000000 -0400
+@@ -423,7 +423,7 @@ struct kvm_arch {
+ 	unsigned int n_used_mmu_pages;
+ 	unsigned int n_requested_mmu_pages;
+ 	unsigned int n_max_mmu_pages;
+-	atomic_t invlpg_counter;
++	atomic_unchecked_t invlpg_counter;
+ 	struct hlist_head mmu_page_hash[KVM_NUM_MMU_PAGES];
+ 	/*
+ 	 * Hash table of struct kvm_mmu_page.
 @@ -603,7 +603,7 @@ struct kvm_arch_async_pf {
  	bool direct_map;
  };
@@ -7797,9 +8224,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/kvm_host.h linux-2.6.38.2/arch/x8
  
  int kvm_mmu_module_init(void);
  void kvm_mmu_module_exit(void);
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/local.h linux-2.6.38.2/arch/x86/include/asm/local.h
---- linux-2.6.38.2/arch/x86/include/asm/local.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/local.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/local.h linux-2.6.38.7/arch/x86/include/asm/local.h
+--- linux-2.6.38.7/arch/x86/include/asm/local.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/local.h	2011-04-28 19:34:14.000000000 -0400
 @@ -18,26 +18,58 @@ typedef struct {
  
  static inline void local_inc(local_t *l)
@@ -7952,23 +8379,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/local.h linux-2.6.38.2/arch/x86/i
  		     : "+r" (i), "+m" (l->a.counter)
  		     : : "memory");
  	return i + __i;
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/mc146818rtc.h linux-2.6.38.2/arch/x86/include/asm/mc146818rtc.h
---- linux-2.6.38.2/arch/x86/include/asm/mc146818rtc.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/mc146818rtc.h	2011-03-21 18:31:35.000000000 -0400
-@@ -81,8 +81,8 @@ static inline unsigned char current_lock
- #else
- #define lock_cmos_prefix(reg) do {} while (0)
- #define lock_cmos_suffix(reg) do {} while (0)
--#define lock_cmos(reg)
--#define unlock_cmos()
-+#define lock_cmos(reg) do {} while (0)
-+#define unlock_cmos() do {} while (0)
- #define do_i_have_lock_cmos() 0
- #define current_lock_cmos_reg() 0
- #endif
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/mce.h linux-2.6.38.2/arch/x86/include/asm/mce.h
---- linux-2.6.38.2/arch/x86/include/asm/mce.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/mce.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/mce.h linux-2.6.38.7/arch/x86/include/asm/mce.h
+--- linux-2.6.38.7/arch/x86/include/asm/mce.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/mce.h	2011-04-28 19:34:14.000000000 -0400
 @@ -198,7 +198,7 @@ int mce_notify_irq(void);
  void mce_notify_process(void);
  
@@ -7978,9 +8391,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/mce.h linux-2.6.38.2/arch/x86/inc
  
  /*
   * Exception handler
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/microcode.h linux-2.6.38.2/arch/x86/include/asm/microcode.h
---- linux-2.6.38.2/arch/x86/include/asm/microcode.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/microcode.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/microcode.h linux-2.6.38.7/arch/x86/include/asm/microcode.h
+--- linux-2.6.38.7/arch/x86/include/asm/microcode.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/microcode.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,13 +12,13 @@ struct device;
  enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
  
@@ -8027,9 +8440,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/microcode.h linux-2.6.38.2/arch/x
  {
  	return NULL;
  }
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/mman.h linux-2.6.38.2/arch/x86/include/asm/mman.h
---- linux-2.6.38.2/arch/x86/include/asm/mman.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/mman.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/mman.h linux-2.6.38.7/arch/x86/include/asm/mman.h
+--- linux-2.6.38.7/arch/x86/include/asm/mman.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/mman.h	2011-04-28 19:34:14.000000000 -0400
 @@ -5,4 +5,14 @@
  
  #include <asm-generic/mman.h>
@@ -8045,9 +8458,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/mman.h linux-2.6.38.2/arch/x86/in
 +#endif
 +
  #endif /* _ASM_X86_MMAN_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/mmu_context.h linux-2.6.38.2/arch/x86/include/asm/mmu_context.h
---- linux-2.6.38.2/arch/x86/include/asm/mmu_context.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/mmu_context.h	2011-03-28 16:54:16.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/mmu_context.h linux-2.6.38.7/arch/x86/include/asm/mmu_context.h
+--- linux-2.6.38.7/arch/x86/include/asm/mmu_context.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/mmu_context.h	2011-04-28 19:34:14.000000000 -0400
 @@ -24,6 +24,21 @@ void destroy_context(struct mm_struct *m
  
  static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
@@ -8171,9 +8584,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/mmu_context.h linux-2.6.38.2/arch
  }
  
  #define activate_mm(prev, next)			\
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/mmu.h linux-2.6.38.2/arch/x86/include/asm/mmu.h
---- linux-2.6.38.2/arch/x86/include/asm/mmu.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/mmu.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/mmu.h linux-2.6.38.7/arch/x86/include/asm/mmu.h
+--- linux-2.6.38.7/arch/x86/include/asm/mmu.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/mmu.h	2011-04-28 19:34:14.000000000 -0400
 @@ -9,10 +9,23 @@
   * we put the segment information here.
   */
@@ -8200,40 +8613,53 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/mmu.h linux-2.6.38.2/arch/x86/inc
  } mm_context_t;
  
  #ifdef CONFIG_SMP
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/module.h linux-2.6.38.2/arch/x86/include/asm/module.h
---- linux-2.6.38.2/arch/x86/include/asm/module.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/module.h	2011-03-21 18:31:35.000000000 -0400
-@@ -59,8 +59,26 @@
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/module.h linux-2.6.38.7/arch/x86/include/asm/module.h
+--- linux-2.6.38.7/arch/x86/include/asm/module.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/module.h	2011-04-28 19:34:14.000000000 -0400
+@@ -5,6 +5,7 @@
+ 
+ #ifdef CONFIG_X86_64
+ /* X86_64 does not define MODULE_PROC_FAMILY */
++#define MODULE_PROC_FAMILY ""
+ #elif defined CONFIG_M386
+ #define MODULE_PROC_FAMILY "386 "
+ #elif defined CONFIG_M486
+@@ -59,8 +60,30 @@
  #error unknown processor family
  #endif
  
+-#ifdef CONFIG_X86_32
+-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +#define MODULE_PAX_UDEREF "UDEREF "
 +#else
 +#define MODULE_PAX_UDEREF ""
 +#endif
 +
- #ifdef CONFIG_X86_32
--# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY
-+# ifdef CONFIG_PAX_KERNEXEC
-+#  define MODULE_PAX_KERNEXEC "KERNEXEC "
-+# else
-+#  define MODULE_PAX_KERNEXEC ""
-+# endif
-+# ifdef CONFIG_GRKERNSEC
-+#  define MODULE_GRSEC "GRSECURITY "
-+# else
-+#  define MODULE_GRSEC ""
-+# endif
-+# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF
++#ifdef CONFIG_PAX_KERNEXEC
++#define MODULE_PAX_KERNEXEC "KERNEXEC "
 +#else
-+# define MODULE_ARCH_VERMAGIC MODULE_PAX_UDEREF
++#define MODULE_PAX_KERNEXEC ""
  #endif
  
++#ifdef CONFIG_PAX_REFCOUNT
++#define MODULE_PAX_REFCOUNT "REFCOUNT "
++#else
++#define MODULE_PAX_REFCOUNT ""
++#endif
++
++#ifdef CONFIG_GRKERNSEC
++#define MODULE_GRSEC "GRSECURITY "
++#else
++#define MODULE_GRSEC ""
++#endif
++
++#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
++
  #endif /* _ASM_X86_MODULE_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/page_64_types.h linux-2.6.38.2/arch/x86/include/asm/page_64_types.h
---- linux-2.6.38.2/arch/x86/include/asm/page_64_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/page_64_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/page_64_types.h linux-2.6.38.7/arch/x86/include/asm/page_64_types.h
+--- linux-2.6.38.7/arch/x86/include/asm/page_64_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/page_64_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -56,7 +56,7 @@ void copy_page(void *to, void *from);
  
  /* duplicated to the one in bootmem.h */
@@ -8243,9 +8669,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/page_64_types.h linux-2.6.38.2/ar
  
  extern unsigned long __phys_addr(unsigned long);
  #define __phys_reloc_hide(x)	(x)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/paravirt.h linux-2.6.38.2/arch/x86/include/asm/paravirt.h
---- linux-2.6.38.2/arch/x86/include/asm/paravirt.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/paravirt.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/paravirt.h linux-2.6.38.7/arch/x86/include/asm/paravirt.h
+--- linux-2.6.38.7/arch/x86/include/asm/paravirt.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/paravirt.h	2011-04-28 19:34:14.000000000 -0400
 @@ -739,6 +739,21 @@ static inline void __set_fixmap(unsigned
  	pv_mmu_ops.set_fixmap(idx, phys, flags);
  }
@@ -8299,9 +8725,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/paravirt.h linux-2.6.38.2/arch/x8
  #endif	/* CONFIG_X86_32 */
  
  #endif /* __ASSEMBLY__ */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/paravirt_types.h linux-2.6.38.2/arch/x86/include/asm/paravirt_types.h
---- linux-2.6.38.2/arch/x86/include/asm/paravirt_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/paravirt_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/paravirt_types.h linux-2.6.38.7/arch/x86/include/asm/paravirt_types.h
+--- linux-2.6.38.7/arch/x86/include/asm/paravirt_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/paravirt_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -317,6 +317,12 @@ struct pv_mmu_ops {
  	   an mfn.  We can tell which is which from the index. */
  	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
@@ -8315,9 +8741,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/paravirt_types.h linux-2.6.38.2/a
  };
  
  struct arch_spinlock;
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pci_x86.h linux-2.6.38.2/arch/x86/include/asm/pci_x86.h
---- linux-2.6.38.2/arch/x86/include/asm/pci_x86.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pci_x86.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pci_x86.h linux-2.6.38.7/arch/x86/include/asm/pci_x86.h
+--- linux-2.6.38.7/arch/x86/include/asm/pci_x86.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pci_x86.h	2011-04-28 19:34:14.000000000 -0400
 @@ -93,16 +93,16 @@ extern int (*pcibios_enable_irq)(struct 
  extern void (*pcibios_disable_irq)(struct pci_dev *dev);
  
@@ -8340,9 +8766,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pci_x86.h linux-2.6.38.2/arch/x86
  extern bool port_cf9_safe;
  
  /* arch_initcall level */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgalloc.h linux-2.6.38.2/arch/x86/include/asm/pgalloc.h
---- linux-2.6.38.2/arch/x86/include/asm/pgalloc.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgalloc.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgalloc.h linux-2.6.38.7/arch/x86/include/asm/pgalloc.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgalloc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgalloc.h	2011-04-28 19:34:14.000000000 -0400
 @@ -63,6 +63,13 @@ static inline void pmd_populate_kernel(s
  				       pmd_t *pmd, pte_t *pte)
  {
@@ -8357,9 +8783,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgalloc.h linux-2.6.38.2/arch/x86
  	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable-2level.h linux-2.6.38.2/arch/x86/include/asm/pgtable-2level.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable-2level.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable-2level.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable-2level.h linux-2.6.38.7/arch/x86/include/asm/pgtable-2level.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable-2level.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable-2level.h	2011-04-28 19:34:14.000000000 -0400
 @@ -18,7 +18,9 @@ static inline void native_set_pte(pte_t 
  
  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
@@ -8370,9 +8796,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable-2level.h linux-2.6.38.2/a
  }
  
  static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_32.h linux-2.6.38.2/arch/x86/include/asm/pgtable_32.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable_32.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable_32.h linux-2.6.38.7/arch/x86/include/asm/pgtable_32.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable_32.h	2011-04-28 19:34:14.000000000 -0400
 @@ -25,9 +25,6 @@
  struct mm_struct;
  struct vm_area_struct;
@@ -8416,9 +8842,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_32.h linux-2.6.38.2/arch/
  /*
   * kern_addr_valid() is (1) for FLATMEM and (0) for
   * SPARSEMEM and DISCONTIGMEM
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_32_types.h linux-2.6.38.2/arch/x86/include/asm/pgtable_32_types.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable_32_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable_32_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable_32_types.h linux-2.6.38.7/arch/x86/include/asm/pgtable_32_types.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable_32_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable_32_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -8,7 +8,7 @@
   */
  #ifdef CONFIG_X86_PAE
@@ -8448,9 +8874,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_32_types.h linux-2.6.38.2
  #define MODULES_VADDR	VMALLOC_START
  #define MODULES_END	VMALLOC_END
  #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable-3level.h linux-2.6.38.2/arch/x86/include/asm/pgtable-3level.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable-3level.h	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable-3level.h	2011-03-23 17:21:43.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable-3level.h linux-2.6.38.7/arch/x86/include/asm/pgtable-3level.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable-3level.h	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable-3level.h	2011-04-28 19:34:14.000000000 -0400
 @@ -38,12 +38,16 @@ static inline void native_set_pte_atomic
  
  static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
@@ -8468,9 +8894,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable-3level.h linux-2.6.38.2/a
  }
  
  /*
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_64.h linux-2.6.38.2/arch/x86/include/asm/pgtable_64.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable_64.h linux-2.6.38.7/arch/x86/include/asm/pgtable_64.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable_64.h	2011-04-28 19:34:14.000000000 -0400
 @@ -16,10 +16,13 @@
  
  extern pud_t level3_kernel_pgt[512];
@@ -8507,9 +8933,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_64.h linux-2.6.38.2/arch/
  }
  
  static inline void native_pgd_clear(pgd_t *pgd)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_64_types.h linux-2.6.38.2/arch/x86/include/asm/pgtable_64_types.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable_64_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable_64_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable_64_types.h linux-2.6.38.7/arch/x86/include/asm/pgtable_64_types.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable_64_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable_64_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -59,5 +59,10 @@ typedef struct { pteval_t pte; } pte_t;
  #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
  #define MODULES_END      _AC(0xffffffffff000000, UL)
@@ -8521,9 +8947,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_64_types.h linux-2.6.38.2
 +#define ktva_ktla(addr)		(addr)
  
  #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable.h linux-2.6.38.2/arch/x86/include/asm/pgtable.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable.h linux-2.6.38.7/arch/x86/include/asm/pgtable.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable.h	2011-04-28 19:34:14.000000000 -0400
 @@ -81,12 +81,51 @@ extern struct mm_struct *pgd_page_get_mm
  
  #define arch_end_context_switch(prev)	do {} while(0)
@@ -8693,9 +9119,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable.h linux-2.6.38.2/arch/x86
  
  #include <asm-generic/pgtable.h>
  #endif	/* __ASSEMBLY__ */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_types.h linux-2.6.38.2/arch/x86/include/asm/pgtable_types.h
---- linux-2.6.38.2/arch/x86/include/asm/pgtable_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/pgtable_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/pgtable_types.h linux-2.6.38.7/arch/x86/include/asm/pgtable_types.h
+--- linux-2.6.38.7/arch/x86/include/asm/pgtable_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/pgtable_types.h	2011-04-28 19:34:14.000000000 -0400
 @@ -16,13 +16,12 @@
  #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
  #define _PAGE_BIT_PAT		7	/* on 4KB pages */
@@ -8809,9 +9235,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/pgtable_types.h linux-2.6.38.2/ar
  
  #define pgprot_writecombine	pgprot_writecombine
  extern pgprot_t pgprot_writecombine(pgprot_t prot);
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x86/include/asm/processor.h
---- linux-2.6.38.2/arch/x86/include/asm/processor.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/processor.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/processor.h linux-2.6.38.7/arch/x86/include/asm/processor.h
+--- linux-2.6.38.7/arch/x86/include/asm/processor.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/processor.h	2011-05-11 18:34:57.000000000 -0400
 @@ -270,7 +270,7 @@ struct tss_struct {
  
  } ____cacheline_aligned;
@@ -8821,7 +9247,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x
  
  /*
   * Save the original ist values for checking stack pointers during debugging
-@@ -864,8 +864,15 @@ static inline void spin_lock_prefetch(co
+@@ -864,11 +864,18 @@ static inline void spin_lock_prefetch(co
   */
  #define TASK_SIZE		PAGE_OFFSET
  #define TASK_SIZE_MAX		TASK_SIZE
@@ -8837,7 +9263,11 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x
 +#define STACK_TOP_MAX		TASK_SIZE
  
  #define INIT_THREAD  {							  \
- 	.sp0			= sizeof(init_stack) + (long)&init_stack, \
+-	.sp0			= sizeof(init_stack) + (long)&init_stack, \
++	.sp0			= sizeof(init_stack) + (long)&init_stack - 8, \
+ 	.vm86_info		= NULL,					  \
+ 	.sysenter_cs		= __KERNEL_CS,				  \
+ 	.io_bitmap_ptr		= NULL,					  \
 @@ -882,7 +889,7 @@ static inline void spin_lock_prefetch(co
   */
  #define INIT_TSS  {							  \
@@ -8856,7 +9286,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x
 -       unsigned long *__ptr = (unsigned long *)(info);                 \
 -       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
 -})
-+#define KSTK_TOP(info)         ((info)->task.thread.sp0)
++#define KSTK_TOP(info)         ((container_of(info, struct task_struct, tinfo))->thread.sp0)
  
  /*
   * The below -8 is to reserve 8 bytes on top of the ring0 stack.
@@ -8885,6 +9315,20 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x
  
  #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
  					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
+@@ -939,11 +942,11 @@ extern unsigned long thread_saved_pc(str
+ #define STACK_TOP_MAX		TASK_SIZE_MAX
+ 
+ #define INIT_THREAD  { \
+-	.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
++	.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
+ }
+ 
+ #define INIT_TSS  { \
+-	.x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
++	.x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
+ }
+ 
+ /*
 @@ -965,6 +968,10 @@ extern void start_thread(struct pt_regs 
   */
  #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
@@ -8896,9 +9340,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/processor.h linux-2.6.38.2/arch/x
  #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
  
  /* Get/set a process' ability to use the timestamp counter instruction */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/ptrace.h linux-2.6.38.2/arch/x86/include/asm/ptrace.h
---- linux-2.6.38.2/arch/x86/include/asm/ptrace.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/ptrace.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/ptrace.h linux-2.6.38.7/arch/x86/include/asm/ptrace.h
+--- linux-2.6.38.7/arch/x86/include/asm/ptrace.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/ptrace.h	2011-04-28 19:34:14.000000000 -0400
 @@ -152,28 +152,29 @@ static inline unsigned long regs_return_
  }
  
@@ -8935,21 +9379,37 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/ptrace.h linux-2.6.38.2/arch/x86/
  #endif
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/reboot.h linux-2.6.38.2/arch/x86/include/asm/reboot.h
---- linux-2.6.38.2/arch/x86/include/asm/reboot.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/reboot.h	2011-03-21 18:31:35.000000000 -0400
-@@ -18,7 +18,7 @@ extern struct machine_ops machine_ops;
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/reboot.h linux-2.6.38.7/arch/x86/include/asm/reboot.h
+--- linux-2.6.38.7/arch/x86/include/asm/reboot.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/reboot.h	2011-05-22 23:03:34.000000000 -0400
+@@ -6,19 +6,19 @@
+ struct pt_regs;
+ 
+ struct machine_ops {
+-	void (*restart)(char *cmd);
+-	void (*halt)(void);
+-	void (*power_off)(void);
++	void (* __noreturn restart)(char *cmd);
++	void (* __noreturn halt)(void);
++	void (* __noreturn power_off)(void);
+ 	void (*shutdown)(void);
+ 	void (*crash_shutdown)(struct pt_regs *);
+-	void (*emergency_restart)(void);
++	void (* __noreturn emergency_restart)(void);
+ };
+ 
+ extern struct machine_ops machine_ops;
  
  void native_machine_crash_shutdown(struct pt_regs *regs);
  void native_machine_shutdown(void);
 -void machine_real_restart(const unsigned char *code, int length);
-+void machine_real_restart(const unsigned char *code, unsigned int length);
++void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
  
  typedef void (*nmi_shootdown_cb)(int, struct die_args*);
  void nmi_shootdown_cpus(nmi_shootdown_cb callback);
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/rwsem.h linux-2.6.38.2/arch/x86/include/asm/rwsem.h
---- linux-2.6.38.2/arch/x86/include/asm/rwsem.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/rwsem.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/rwsem.h linux-2.6.38.7/arch/x86/include/asm/rwsem.h
+--- linux-2.6.38.7/arch/x86/include/asm/rwsem.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/rwsem.h	2011-04-28 19:34:14.000000000 -0400
 @@ -118,6 +118,14 @@ static inline void __down_read(struct rw
  {
  	asm volatile("# beginning down_read\n\t"
@@ -9074,9 +9534,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/rwsem.h linux-2.6.38.2/arch/x86/i
  		     : "+r" (tmp), "+m" (sem->count)
  		     : : "memory");
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/segment.h linux-2.6.38.2/arch/x86/include/asm/segment.h
---- linux-2.6.38.2/arch/x86/include/asm/segment.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/segment.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/segment.h linux-2.6.38.7/arch/x86/include/asm/segment.h
+--- linux-2.6.38.7/arch/x86/include/asm/segment.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/segment.h	2011-04-28 19:34:14.000000000 -0400
 @@ -62,8 +62,8 @@
   *  26 - ESPFIX small SS
   *  27 - per-cpu			[ offset to per-cpu data area ]
@@ -9136,9 +9596,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/segment.h linux-2.6.38.2/arch/x86
  #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS*8)
  #define __USER_DS	(GDT_ENTRY_DEFAULT_USER_DS*8+3)
  #define __USER_CS	(GDT_ENTRY_DEFAULT_USER_CS*8+3)
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/smp.h linux-2.6.38.2/arch/x86/include/asm/smp.h
---- linux-2.6.38.2/arch/x86/include/asm/smp.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/smp.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/smp.h linux-2.6.38.7/arch/x86/include/asm/smp.h
+--- linux-2.6.38.7/arch/x86/include/asm/smp.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/smp.h	2011-04-28 19:34:14.000000000 -0400
 @@ -24,7 +24,7 @@ extern unsigned int num_processors;
  DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
  DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
@@ -9148,9 +9608,26 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/smp.h linux-2.6.38.2/arch/x86/inc
  
  static inline struct cpumask *cpu_sibling_mask(int cpu)
  {
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/spinlock.h linux-2.6.38.2/arch/x86/include/asm/spinlock.h
---- linux-2.6.38.2/arch/x86/include/asm/spinlock.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/spinlock.h	2011-03-21 18:31:35.000000000 -0400
+@@ -172,14 +172,8 @@ extern unsigned disabled_cpus __cpuinitd
+ extern int safe_smp_processor_id(void);
+ 
+ #elif defined(CONFIG_X86_64_SMP)
+-#define raw_smp_processor_id() (percpu_read(cpu_number))
+-
+-#define stack_smp_processor_id()					\
+-({								\
+-	struct thread_info *ti;						\
+-	__asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK));	\
+-	ti->cpu;							\
+-})
++#define raw_smp_processor_id()		(percpu_read(cpu_number))
++#define stack_smp_processor_id()	raw_smp_processor_id()
+ #define safe_smp_processor_id()		smp_processor_id()
+ 
+ #endif
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/spinlock.h linux-2.6.38.7/arch/x86/include/asm/spinlock.h
+--- linux-2.6.38.7/arch/x86/include/asm/spinlock.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/spinlock.h	2011-04-28 19:34:14.000000000 -0400
 @@ -249,6 +249,14 @@ static inline int arch_write_can_lock(ar
  static inline void arch_read_lock(arch_rwlock_t *rw)
  {
@@ -9213,9 +9690,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/spinlock.h linux-2.6.38.2/arch/x8
  		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/stackprotector.h linux-2.6.38.2/arch/x86/include/asm/stackprotector.h
---- linux-2.6.38.2/arch/x86/include/asm/stackprotector.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/stackprotector.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/stackprotector.h linux-2.6.38.7/arch/x86/include/asm/stackprotector.h
+--- linux-2.6.38.7/arch/x86/include/asm/stackprotector.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/stackprotector.h	2011-04-28 19:34:14.000000000 -0400
 @@ -113,7 +113,7 @@ static inline void setup_stack_canary_se
  
  static inline void load_stack_canary_segment(void)
@@ -9225,9 +9702,80 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/stackprotector.h linux-2.6.38.2/a
  	asm volatile ("mov %0, %%gs" : : "r" (0));
  #endif
  }
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/system.h linux-2.6.38.2/arch/x86/include/asm/system.h
---- linux-2.6.38.2/arch/x86/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/system.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/stacktrace.h linux-2.6.38.7/arch/x86/include/asm/stacktrace.h
+--- linux-2.6.38.7/arch/x86/include/asm/stacktrace.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/stacktrace.h	2011-04-28 19:34:14.000000000 -0400
+@@ -11,28 +11,20 @@
+ 
+ extern int kstack_depth_to_print;
+ 
+-struct thread_info;
++struct task_struct;
+ struct stacktrace_ops;
+ 
+-typedef unsigned long (*walk_stack_t)(struct thread_info *tinfo,
+-				      unsigned long *stack,
+-				      unsigned long bp,
+-				      const struct stacktrace_ops *ops,
+-				      void *data,
+-				      unsigned long *end,
+-				      int *graph);
+-
+-extern unsigned long
+-print_context_stack(struct thread_info *tinfo,
+-		    unsigned long *stack, unsigned long bp,
+-		    const struct stacktrace_ops *ops, void *data,
+-		    unsigned long *end, int *graph);
+-
+-extern unsigned long
+-print_context_stack_bp(struct thread_info *tinfo,
+-		       unsigned long *stack, unsigned long bp,
+-		       const struct stacktrace_ops *ops, void *data,
+-		       unsigned long *end, int *graph);
++typedef unsigned long walk_stack_t(struct task_struct *task,
++				   void *stack_start,
++				   unsigned long *stack,
++				   unsigned long bp,
++				   const struct stacktrace_ops *ops,
++				   void *data,
++				   unsigned long *end,
++				   int *graph);
++
++extern walk_stack_t print_context_stack;
++extern walk_stack_t print_context_stack_bp;
+ 
+ /* Generic stack tracer with callbacks */
+ 
+@@ -43,7 +35,7 @@ struct stacktrace_ops {
+ 	void (*address)(void *data, unsigned long address, int reliable);
+ 	/* On negative return stop dumping */
+ 	int (*stack)(void *data, char *name);
+-	walk_stack_t	walk_stack;
++	walk_stack_t	*walk_stack;
+ };
+ 
+ void dump_trace(struct task_struct *tsk, struct pt_regs *regs,
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/system.h linux-2.6.38.7/arch/x86/include/asm/system.h
+--- linux-2.6.38.7/arch/x86/include/asm/system.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/system.h	2011-05-22 23:03:34.000000000 -0400
+@@ -131,7 +131,7 @@ do {									\
+ 	     "call __switch_to\n\t"					  \
+ 	     "movq "__percpu_arg([current_task])",%%rsi\n\t"		  \
+ 	     __switch_canary						  \
+-	     "movq %P[thread_info](%%rsi),%%r8\n\t"			  \
++	     "movq "__percpu_arg([thread_info])",%%r8\n\t"		  \
+ 	     "movq %%rax,%%rdi\n\t" 					  \
+ 	     "testl  %[_tif_fork],%P[ti_flags](%%r8)\n\t"		  \
+ 	     "jnz   ret_from_fork\n\t"					  \
+@@ -142,7 +142,7 @@ do {									\
+ 	       [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
+ 	       [ti_flags] "i" (offsetof(struct thread_info, flags)),	  \
+ 	       [_tif_fork] "i" (_TIF_FORK),			  	  \
+-	       [thread_info] "i" (offsetof(struct task_struct, stack)),   \
++	       [thread_info] "m" (current_tinfo),			  \
+ 	       [current_task] "m" (current_task)			  \
+ 	       __switch_canary_iparam					  \
+ 	     : "memory", "cc" __EXTRA_CLOBBER)
 @@ -202,7 +202,7 @@ static inline unsigned long get_limit(un
  {
  	unsigned long __limit;
@@ -9237,7 +9785,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/system.h linux-2.6.38.2/arch/x86/
  }
  
  static inline void native_clts(void)
-@@ -342,7 +342,7 @@ void enable_hlt(void);
+@@ -342,12 +342,12 @@ void enable_hlt(void);
  
  void cpu_idle_wait(void);
  
@@ -9246,20 +9794,178 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/system.h linux-2.6.38.2/arch/x86/
  extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
  
  void default_idle(void);
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h
---- linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h	2011-03-21 18:31:35.000000000 -0400
-@@ -44,6 +44,9 @@ unsigned long __must_check __copy_from_u
+ 
+-void stop_this_cpu(void *dummy);
++void stop_this_cpu(void *dummy) __noreturn;
+ 
+ /*
+  * Force strict CPU ordering.
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/thread_info.h linux-2.6.38.7/arch/x86/include/asm/thread_info.h
+--- linux-2.6.38.7/arch/x86/include/asm/thread_info.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/thread_info.h	2011-05-17 19:31:43.000000000 -0400
+@@ -10,6 +10,7 @@
+ #include <linux/compiler.h>
+ #include <asm/page.h>
+ #include <asm/types.h>
++#include <asm/percpu.h>
+ 
+ /*
+  * low level task data that entry.S needs immediate access to
+@@ -24,7 +25,6 @@ struct exec_domain;
+ #include <asm/atomic.h>
+ 
+ struct thread_info {
+-	struct task_struct	*task;		/* main task structure */
+ 	struct exec_domain	*exec_domain;	/* execution domain */
+ 	__u32			flags;		/* low level flags */
+ 	__u32			status;		/* thread synchronous flags */
+@@ -34,18 +34,12 @@ struct thread_info {
+ 	mm_segment_t		addr_limit;
+ 	struct restart_block    restart_block;
+ 	void __user		*sysenter_return;
+-#ifdef CONFIG_X86_32
+-	unsigned long           previous_esp;   /* ESP of the previous stack in
+-						   case of nested (IRQ) stacks
+-						*/
+-	__u8			supervisor_stack[0];
+-#endif
++	unsigned long		lowest_stack;
+ 	int			uaccess_err;
+ };
+ 
+-#define INIT_THREAD_INFO(tsk)			\
++#define INIT_THREAD_INFO			\
+ {						\
+-	.task		= &tsk,			\
+ 	.exec_domain	= &default_exec_domain,	\
+ 	.flags		= 0,			\
+ 	.cpu		= 0,			\
+@@ -56,7 +50,7 @@ struct thread_info {
+ 	},					\
+ }
+ 
+-#define init_thread_info	(init_thread_union.thread_info)
++#define init_thread_info	(init_thread_union.stack)
+ #define init_stack		(init_thread_union.stack)
+ 
+ #else /* !__ASSEMBLY__ */
+@@ -164,6 +158,23 @@ struct thread_info {
+ #define alloc_thread_info(tsk)						\
+ 	((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
+ 
++#ifdef __ASSEMBLY__
++/* how to get the thread information struct from ASM */
++#define GET_THREAD_INFO(reg)	 \
++	mov PER_CPU_VAR(current_tinfo), reg
++
++/* use this one if reg already contains %esp */
++#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
++#else
++/* how to get the thread information struct from C */
++DECLARE_PER_CPU(struct thread_info *, current_tinfo);
++
++static __always_inline struct thread_info *current_thread_info(void)
++{
++	return percpu_read_stable(current_tinfo);
++}
++#endif
++
+ #ifdef CONFIG_X86_32
+ 
+ #define STACK_WARN	(THREAD_SIZE/8)
+@@ -174,35 +185,13 @@ struct thread_info {
+  */
+ #ifndef __ASSEMBLY__
+ 
+-
+ /* how to get the current stack pointer from C */
+ register unsigned long current_stack_pointer asm("esp") __used;
+ 
+-/* how to get the thread information struct from C */
+-static inline struct thread_info *current_thread_info(void)
+-{
+-	return (struct thread_info *)
+-		(current_stack_pointer & ~(THREAD_SIZE - 1));
+-}
+-
+-#else /* !__ASSEMBLY__ */
+-
+-/* how to get the thread information struct from ASM */
+-#define GET_THREAD_INFO(reg)	 \
+-	movl $-THREAD_SIZE, reg; \
+-	andl %esp, reg
+-
+-/* use this one if reg already contains %esp */
+-#define GET_THREAD_INFO_WITH_ESP(reg) \
+-	andl $-THREAD_SIZE, reg
+-
+ #endif
+ 
+ #else /* X86_32 */
+ 
+-#include <asm/percpu.h>
+-#define KERNEL_STACK_OFFSET (5*8)
+-
+ /*
+  * macros/functions for gaining access to the thread information structure
+  * preempt_count needs to be 1 initially, until the scheduler is functional.
+@@ -210,21 +199,8 @@ static inline struct thread_info *curren
+ #ifndef __ASSEMBLY__
+ DECLARE_PER_CPU(unsigned long, kernel_stack);
+ 
+-static inline struct thread_info *current_thread_info(void)
+-{
+-	struct thread_info *ti;
+-	ti = (void *)(percpu_read_stable(kernel_stack) +
+-		      KERNEL_STACK_OFFSET - THREAD_SIZE);
+-	return ti;
+-}
+-
+-#else /* !__ASSEMBLY__ */
+-
+-/* how to get the thread information struct from ASM */
+-#define GET_THREAD_INFO(reg) \
+-	movq PER_CPU_VAR(kernel_stack),reg ; \
+-	subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
+-
++/* how to get the current stack pointer from C */
++register unsigned long current_stack_pointer asm("rsp") __used;
+ #endif
+ 
+ #endif /* !X86_32 */
+@@ -260,5 +236,16 @@ extern void arch_task_cache_init(void);
+ extern void free_thread_info(struct thread_info *ti);
+ extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
+ #define arch_task_cache_init arch_task_cache_init
++
++#define __HAVE_THREAD_FUNCTIONS
++#define task_thread_info(task)	(&(task)->tinfo)
++#define task_stack_page(task)	((task)->stack)
++#define setup_thread_stack(p, org) do {} while (0)
++#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
++
++#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
++extern struct task_struct *alloc_task_struct(void);
++extern void free_task_struct(struct task_struct *);
++
+ #endif
+ #endif /* _ASM_X86_THREAD_INFO_H */
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/uaccess_32.h linux-2.6.38.7/arch/x86/include/asm/uaccess_32.h
+--- linux-2.6.38.7/arch/x86/include/asm/uaccess_32.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/uaccess_32.h	2011-05-16 21:47:08.000000000 -0400
+@@ -44,6 +44,11 @@ unsigned long __must_check __copy_from_u
  static __always_inline unsigned long __must_check
  __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
  {
++	pax_track_stack();
++
 +	if ((long)n < 0)
 +		return n;
 +
  	if (__builtin_constant_p(n)) {
  		unsigned long ret;
  
-@@ -62,6 +65,8 @@ __copy_to_user_inatomic(void __user *to,
+@@ -62,6 +67,8 @@ __copy_to_user_inatomic(void __user *to,
  			return ret;
  		}
  	}
@@ -9268,7 +9974,14 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  	return __copy_to_user_ll(to, from, n);
  }
  
-@@ -89,6 +94,9 @@ __copy_to_user(void __user *to, const vo
+@@ -83,12 +90,16 @@ static __always_inline unsigned long __m
+ __copy_to_user(void __user *to, const void *from, unsigned long n)
+ {
+ 	might_fault();
++
+ 	return __copy_to_user_inatomic(to, from, n);
+ }
+ 
  static __always_inline unsigned long
  __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
  {
@@ -9278,18 +9991,20 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  	/* Avoid zeroing the tail if the copy fails..
  	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
  	 * but as the zeroing behaviour is only significant when n is not
-@@ -138,6 +146,10 @@ static __always_inline unsigned long
+@@ -138,6 +149,12 @@ static __always_inline unsigned long
  __copy_from_user(void *to, const void __user *from, unsigned long n)
  {
  	might_fault();
 +
++	pax_track_stack();
++
 +	if ((long)n < 0)
 +		return n;
 +
  	if (__builtin_constant_p(n)) {
  		unsigned long ret;
  
-@@ -153,6 +165,8 @@ __copy_from_user(void *to, const void __
+@@ -153,6 +170,8 @@ __copy_from_user(void *to, const void __
  			return ret;
  		}
  	}
@@ -9298,7 +10013,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  	return __copy_from_user_ll(to, from, n);
  }
  
-@@ -160,6 +174,10 @@ static __always_inline unsigned long __c
+@@ -160,6 +179,10 @@ static __always_inline unsigned long __c
  				const void __user *from, unsigned long n)
  {
  	might_fault();
@@ -9309,7 +10024,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  	if (__builtin_constant_p(n)) {
  		unsigned long ret;
  
-@@ -182,15 +200,19 @@ static __always_inline unsigned long
+@@ -182,15 +205,19 @@ static __always_inline unsigned long
  __copy_from_user_inatomic_nocache(void *to, const void __user *from,
  				  unsigned long n)
  {
@@ -9336,7 +10051,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  
  extern void copy_from_user_overflow(void)
  #ifdef CONFIG_DEBUG_STRICT_USER_COPY_CHECKS
-@@ -200,17 +222,61 @@ extern void copy_from_user_overflow(void
+@@ -200,17 +227,61 @@ extern void copy_from_user_overflow(void
  #endif
  ;
  
@@ -9405,9 +10120,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_32.h linux-2.6.38.2/arch/
  	return n;
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h
---- linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/uaccess_64.h linux-2.6.38.7/arch/x86/include/asm/uaccess_64.h
+--- linux-2.6.38.7/arch/x86/include/asm/uaccess_64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/uaccess_64.h	2011-05-16 21:47:08.000000000 -0400
 @@ -11,6 +11,9 @@
  #include <asm/alternative.h>
  #include <asm/cpufeature.h>
@@ -9458,7 +10173,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  	return n;
  }
  
-@@ -65,110 +68,174 @@ int copy_to_user(void __user *dst, const
+@@ -65,110 +68,198 @@ int copy_to_user(void __user *dst, const
  {
  	might_fault();
  
@@ -9480,6 +10195,8 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
 -	if (!__builtin_constant_p(size))
 -		return copy_user_generic(dst, (__force void *)src, size);
 +
++	pax_track_stack();
++
 +	if ((int)size < 0)
 +		return size;
 +
@@ -9497,8 +10214,12 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
 +
 +	if (!__builtin_constant_p(size)) {
 +		check_object_size(dst, size, false);
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +			src += PAX_USER_SHADOW_BASE;
++#endif
++
 +		return copy_user_generic(dst, (__force const void *)src, size);
 +	}
  	switch (size) {
@@ -9542,8 +10263,12 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  		return ret;
  	default:
 -		return copy_user_generic(dst, (__force void *)src, size);
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +			src += PAX_USER_SHADOW_BASE;
++#endif
++
 +		return copy_user_generic(dst, (__force const void *)src, size);
  	}
  }
@@ -9559,6 +10284,8 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  	might_fault();
 -	if (!__builtin_constant_p(size))
 +
++	pax_track_stack();
++
 +	if ((int)size < 0)
 +		return size;
 +
@@ -9576,8 +10303,12 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
 +
 +	if (!__builtin_constant_p(size)) {
 +		check_object_size(src, size, true);
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +			dst += PAX_USER_SHADOW_BASE;
++#endif
++
  		return copy_user_generic((__force void *)dst, src, size);
 +	}
  	switch (size) {
@@ -9620,8 +10351,12 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  			       ret, "q", "", "er", 8);
  		return ret;
  	default:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +			dst += PAX_USER_SHADOW_BASE;
++#endif
++
  		return copy_user_generic((__force void *)dst, src, size);
  	}
  }
@@ -9647,10 +10382,14 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
 +#endif
 +
 +	if (!__builtin_constant_p(size)) {
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +			src += PAX_USER_SHADOW_BASE;
 +		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +			dst += PAX_USER_SHADOW_BASE;
++#endif
++
  		return copy_user_generic((__force void *)dst,
 -					 (__force void *)src, size);
 +					 (__force const void *)src, size);
@@ -9663,7 +10402,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  			       ret, "b", "b", "=q", 1);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u8 __user *)dst,
-@@ -177,7 +244,7 @@ int __copy_in_user(void __user *dst, con
+@@ -177,7 +268,7 @@ int __copy_in_user(void __user *dst, con
  	}
  	case 2: {
  		u16 tmp;
@@ -9672,7 +10411,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  			       ret, "w", "w", "=r", 2);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u16 __user *)dst,
-@@ -187,7 +254,7 @@ int __copy_in_user(void __user *dst, con
+@@ -187,7 +278,7 @@ int __copy_in_user(void __user *dst, con
  
  	case 4: {
  		u32 tmp;
@@ -9681,7 +10420,7 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  			       ret, "l", "k", "=r", 4);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u32 __user *)dst,
-@@ -196,7 +263,7 @@ int __copy_in_user(void __user *dst, con
+@@ -196,7 +287,7 @@ int __copy_in_user(void __user *dst, con
  	}
  	case 8: {
  		u64 tmp;
@@ -9690,34 +10429,41 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  			       ret, "q", "", "=r", 8);
  		if (likely(!ret))
  			__put_user_asm(tmp, (u64 __user *)dst,
-@@ -204,8 +271,12 @@ int __copy_in_user(void __user *dst, con
+@@ -204,8 +295,16 @@ int __copy_in_user(void __user *dst, con
  		return ret;
  	}
  	default:
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +			src += PAX_USER_SHADOW_BASE;
 +		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +			dst += PAX_USER_SHADOW_BASE;
++#endif
++
  		return copy_user_generic((__force void *)dst,
 -					 (__force void *)src, size);
 +					 (__force const void *)src, size);
  	}
  }
  
-@@ -222,33 +293,68 @@ __must_check unsigned long __clear_user(
+@@ -222,33 +321,72 @@ __must_check unsigned long __clear_user(
  static __must_check __always_inline int
  __copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
  {
++	pax_track_stack();
++
 +	if ((int)size < 0)
 +		return size;
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if (!__access_ok(VERIFY_READ, src, size))
 +		return size;
-+#endif
 +
 +	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +		src += PAX_USER_SHADOW_BASE;
++#endif
++
  	return copy_user_generic(dst, (__force const void *)src, size);
  }
  
@@ -9731,10 +10477,11 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if (!__access_ok(VERIFY_WRITE, dst, size))
 +		return size;
-+#endif
 +
 +	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +		dst += PAX_USER_SHADOW_BASE;
++#endif
++
  	return copy_user_generic((__force void *)dst, src, size);
  }
  
@@ -9780,9 +10527,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess_64.h linux-2.6.38.2/arch/
  copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
  
  #endif /* _ASM_X86_UACCESS_64_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess.h linux-2.6.38.2/arch/x86/include/asm/uaccess.h
---- linux-2.6.38.2/arch/x86/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/uaccess.h linux-2.6.38.7/arch/x86/include/asm/uaccess.h
+--- linux-2.6.38.7/arch/x86/include/asm/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/uaccess.h	2011-04-28 19:34:14.000000000 -0400
 @@ -8,12 +8,15 @@
  #include <linux/thread_info.h>
  #include <linux/prefetch.h>
@@ -10001,9 +10748,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/uaccess.h linux-2.6.38.2/arch/x86
  #ifdef CONFIG_X86_32
  # include "uaccess_32.h"
  #else
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/vgtod.h linux-2.6.38.2/arch/x86/include/asm/vgtod.h
---- linux-2.6.38.2/arch/x86/include/asm/vgtod.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/vgtod.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/vgtod.h linux-2.6.38.7/arch/x86/include/asm/vgtod.h
+--- linux-2.6.38.7/arch/x86/include/asm/vgtod.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/vgtod.h	2011-04-28 19:34:14.000000000 -0400
 @@ -14,6 +14,7 @@ struct vsyscall_gtod_data {
  	int		sysctl_enabled;
  	struct timezone sys_tz;
@@ -10012,9 +10759,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/vgtod.h linux-2.6.38.2/arch/x86/i
  		cycle_t (*vread)(void);
  		cycle_t	cycle_last;
  		cycle_t	mask;
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/vsyscall.h linux-2.6.38.2/arch/x86/include/asm/vsyscall.h
---- linux-2.6.38.2/arch/x86/include/asm/vsyscall.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/vsyscall.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/vsyscall.h linux-2.6.38.7/arch/x86/include/asm/vsyscall.h
+--- linux-2.6.38.7/arch/x86/include/asm/vsyscall.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/vsyscall.h	2011-04-28 19:34:14.000000000 -0400
 @@ -15,9 +15,10 @@ enum vsyscall_num {
  
  #ifdef __KERNEL__
@@ -10045,9 +10792,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/vsyscall.h linux-2.6.38.2/arch/x8
  #endif /* __KERNEL__ */
  
  #endif /* _ASM_X86_VSYSCALL_H */
-diff -urNp linux-2.6.38.2/arch/x86/include/asm/xsave.h linux-2.6.38.2/arch/x86/include/asm/xsave.h
---- linux-2.6.38.2/arch/x86/include/asm/xsave.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/include/asm/xsave.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/include/asm/xsave.h linux-2.6.38.7/arch/x86/include/asm/xsave.h
+--- linux-2.6.38.7/arch/x86/include/asm/xsave.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/include/asm/xsave.h	2011-04-28 19:34:14.000000000 -0400
 @@ -65,6 +65,11 @@ static inline int xsave_user(struct xsav
  {
  	int err;
@@ -10072,9 +10819,9 @@ diff -urNp linux-2.6.38.2/arch/x86/include/asm/xsave.h linux-2.6.38.2/arch/x86/i
  	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
  			     "2:\n"
  			     ".section .fixup,\"ax\"\n"
-diff -urNp linux-2.6.38.2/arch/x86/Kconfig linux-2.6.38.2/arch/x86/Kconfig
---- linux-2.6.38.2/arch/x86/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/Kconfig linux-2.6.38.7/arch/x86/Kconfig
+--- linux-2.6.38.7/arch/x86/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/Kconfig	2011-04-28 19:34:14.000000000 -0400
 @@ -223,7 +223,7 @@ config X86_TRAMPOLINE
  
  config X86_32_LAZY_GS
@@ -10156,9 +10903,9 @@ diff -urNp linux-2.6.38.2/arch/x86/Kconfig linux-2.6.38.2/arch/x86/Kconfig
  	---help---
  	  Map the 32-bit VDSO to the predictable old-style address too.
  
-diff -urNp linux-2.6.38.2/arch/x86/Kconfig.cpu linux-2.6.38.2/arch/x86/Kconfig.cpu
---- linux-2.6.38.2/arch/x86/Kconfig.cpu	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/Kconfig.cpu	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/Kconfig.cpu linux-2.6.38.7/arch/x86/Kconfig.cpu
+--- linux-2.6.38.7/arch/x86/Kconfig.cpu	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/Kconfig.cpu	2011-04-28 19:34:14.000000000 -0400
 @@ -339,7 +339,7 @@ config X86_PPRO_FENCE
  
  config X86_F00F_BUG
@@ -10186,9 +10933,9 @@ diff -urNp linux-2.6.38.2/arch/x86/Kconfig.cpu linux-2.6.38.2/arch/x86/Kconfig.c
  
  config X86_MINIMUM_CPU_FAMILY
  	int
-diff -urNp linux-2.6.38.2/arch/x86/Kconfig.debug linux-2.6.38.2/arch/x86/Kconfig.debug
---- linux-2.6.38.2/arch/x86/Kconfig.debug	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/Kconfig.debug	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/Kconfig.debug linux-2.6.38.7/arch/x86/Kconfig.debug
+--- linux-2.6.38.7/arch/x86/Kconfig.debug	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/Kconfig.debug	2011-04-28 19:34:14.000000000 -0400
 @@ -101,7 +101,7 @@ config X86_PTDUMP
  config DEBUG_RODATA
  	bool "Write protect kernel read-only data structures"
@@ -10207,21 +10954,9 @@ diff -urNp linux-2.6.38.2/arch/x86/Kconfig.debug linux-2.6.38.2/arch/x86/Kconfig
  	---help---
  	  This option helps catch unintended modifications to loadable
  	  kernel module's text and read-only data. It also prevents execution
-diff -urNp linux-2.6.38.2/arch/x86/kernel/acpi/boot.c linux-2.6.38.2/arch/x86/kernel/acpi/boot.c
---- linux-2.6.38.2/arch/x86/kernel/acpi/boot.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/acpi/boot.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1472,7 +1472,7 @@ static struct dmi_system_id __initdata a
- 		     DMI_MATCH(DMI_PRODUCT_NAME, "HP Compaq 6715b"),
- 		     },
- 	 },
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- /*
-diff -urNp linux-2.6.38.2/arch/x86/kernel/acpi/sleep.c linux-2.6.38.2/arch/x86/kernel/acpi/sleep.c
---- linux-2.6.38.2/arch/x86/kernel/acpi/sleep.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/acpi/sleep.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/acpi/sleep.c linux-2.6.38.7/arch/x86/kernel/acpi/sleep.c
+--- linux-2.6.38.7/arch/x86/kernel/acpi/sleep.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/acpi/sleep.c	2011-04-28 19:34:14.000000000 -0400
 @@ -18,7 +18,7 @@
  #include "realmode/wakeup.h"
  #include "sleep.h"
@@ -10244,9 +10979,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/acpi/sleep.c linux-2.6.38.2/arch/x86/k
  	initial_gs = per_cpu_offset(smp_processor_id());
  #endif
  	initial_code = (unsigned long)wakeup_long64;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.38.2/arch/x86/kernel/acpi/wakeup_32.S
---- linux-2.6.38.2/arch/x86/kernel/acpi/wakeup_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/acpi/wakeup_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.38.7/arch/x86/kernel/acpi/wakeup_32.S
+--- linux-2.6.38.7/arch/x86/kernel/acpi/wakeup_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/acpi/wakeup_32.S	2011-04-28 19:34:14.000000000 -0400
 @@ -30,13 +30,11 @@ wakeup_pmode_return:
  	# and restore the stack ... but you need gdt for this to work
  	movl	saved_context_esp, %esp
@@ -10263,9 +10998,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.38.2/arch/x
  
  bogus_magic:
  	jmp	bogus_magic
-diff -urNp linux-2.6.38.2/arch/x86/kernel/alternative.c linux-2.6.38.2/arch/x86/kernel/alternative.c
---- linux-2.6.38.2/arch/x86/kernel/alternative.c	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/alternative.c	2011-03-28 16:55:19.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/alternative.c linux-2.6.38.7/arch/x86/kernel/alternative.c
+--- linux-2.6.38.7/arch/x86/kernel/alternative.c	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/alternative.c	2011-04-28 19:34:14.000000000 -0400
 @@ -248,7 +248,7 @@ static void alternatives_smp_lock(const 
  		if (!*poff || ptr < text || ptr >= text_end)
  			continue;
@@ -10379,9 +11114,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/alternative.c linux-2.6.38.2/arch/x86/
  #endif
  
  void __init arch_init_ideal_nop5(void)
-diff -urNp linux-2.6.38.2/arch/x86/kernel/amd_iommu.c linux-2.6.38.2/arch/x86/kernel/amd_iommu.c
---- linux-2.6.38.2/arch/x86/kernel/amd_iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/amd_iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/amd_iommu.c linux-2.6.38.7/arch/x86/kernel/amd_iommu.c
+--- linux-2.6.38.7/arch/x86/kernel/amd_iommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/amd_iommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -2286,7 +2286,7 @@ static void prealloc_protection_domains(
  	}
  }
@@ -10391,9 +11126,30 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/amd_iommu.c linux-2.6.38.2/arch/x86/ke
  	.alloc_coherent = alloc_coherent,
  	.free_coherent = free_coherent,
  	.map_page = map_page,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/apic/io_apic.c linux-2.6.38.2/arch/x86/kernel/apic/io_apic.c
---- linux-2.6.38.2/arch/x86/kernel/apic/io_apic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/apic/io_apic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/apic/apic.c linux-2.6.38.7/arch/x86/kernel/apic/apic.c
+--- linux-2.6.38.7/arch/x86/kernel/apic/apic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/apic/apic.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1819,7 +1819,7 @@ void smp_error_interrupt(struct pt_regs 
+ 	apic_write(APIC_ESR, 0);
+ 	v1 = apic_read(APIC_ESR);
+ 	ack_APIC_irq();
+-	atomic_inc(&irq_err_count);
++	atomic_inc_unchecked(&irq_err_count);
+ 
+ 	/*
+ 	 * Here is what the APIC error bits mean:
+@@ -2209,6 +2209,8 @@ static int __cpuinit apic_cluster_num(vo
+ 	u16 *bios_cpu_apicid;
+ 	DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
+ 
++	pax_track_stack();
++
+ 	bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
+ 	bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
+ 
+diff -urNp linux-2.6.38.7/arch/x86/kernel/apic/io_apic.c linux-2.6.38.7/arch/x86/kernel/apic/io_apic.c
+--- linux-2.6.38.7/arch/x86/kernel/apic/io_apic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/apic/io_apic.c	2011-04-28 19:57:25.000000000 -0400
 @@ -617,7 +617,7 @@ struct IO_APIC_route_entry **alloc_ioapi
  	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
  				GFP_KERNEL);
@@ -10430,9 +11186,27 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/apic/io_apic.c linux-2.6.38.2/arch/x86
  {
  	raw_spin_unlock(&vector_lock);
  }
-diff -urNp linux-2.6.38.2/arch/x86/kernel/apm_32.c linux-2.6.38.2/arch/x86/kernel/apm_32.c
---- linux-2.6.38.2/arch/x86/kernel/apm_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/apm_32.c	2011-03-21 18:31:35.000000000 -0400
+@@ -2409,7 +2409,7 @@ static void ack_apic_edge(struct irq_dat
+ 	ack_APIC_irq();
+ }
+ 
+-atomic_t irq_mis_count;
++atomic_unchecked_t irq_mis_count;
+ 
+ /*
+  * IO-APIC versions below 0x20 don't support EOI register.
+@@ -2517,7 +2517,7 @@ static void ack_apic_level(struct irq_da
+ 	 * at the cpu.
+ 	 */
+ 	if (!(v & (1 << (i & 0x1f)))) {
+-		atomic_inc(&irq_mis_count);
++		atomic_inc_unchecked(&irq_mis_count);
+ 
+ 		eoi_ioapic_irq(irq, cfg);
+ 	}
+diff -urNp linux-2.6.38.7/arch/x86/kernel/apm_32.c linux-2.6.38.7/arch/x86/kernel/apm_32.c
+--- linux-2.6.38.7/arch/x86/kernel/apm_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/apm_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -410,7 +410,7 @@ static DEFINE_MUTEX(apm_mutex);
   * This is for buggy BIOS's that refer to (real mode) segment 0x40
   * even though they are called in protected mode.
@@ -10497,28 +11271,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/apm_32.c linux-2.6.38.2/arch/x86/kerne
  		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
  		0x8e, 0xd0,		/* movw  ax,ss       */
  		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
-@@ -1932,7 +1946,10 @@ static const struct file_operations apm_
- static struct miscdevice apm_device = {
- 	APM_MINOR_DEV,
- 	"apm_bios",
--	&apm_bios_fops
-+	&apm_bios_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- 
-@@ -2253,7 +2270,7 @@ static struct dmi_system_id __initdata a
- 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
- 
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- /*
-@@ -2356,12 +2373,15 @@ static int __init apm_init(void)
+@@ -2356,12 +2370,15 @@ static int __init apm_init(void)
  	 * code to that CPU.
  	 */
  	gdt = get_cpu_gdt_table(0);
@@ -10534,10 +11287,27 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/apm_32.c linux-2.6.38.2/arch/x86/kerne
  
  	proc_create("apm", 0, NULL, &apm_file_ops);
  
-diff -urNp linux-2.6.38.2/arch/x86/kernel/asm-offsets_32.c linux-2.6.38.2/arch/x86/kernel/asm-offsets_32.c
---- linux-2.6.38.2/arch/x86/kernel/asm-offsets_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/asm-offsets_32.c	2011-03-21 18:31:35.000000000 -0400
-@@ -113,6 +113,11 @@ void foo(void)
+diff -urNp linux-2.6.38.7/arch/x86/kernel/asm-offsets_32.c linux-2.6.38.7/arch/x86/kernel/asm-offsets_32.c
+--- linux-2.6.38.7/arch/x86/kernel/asm-offsets_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/asm-offsets_32.c	2011-05-16 21:47:08.000000000 -0400
+@@ -51,7 +51,6 @@ void foo(void)
+ 	OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
+ 	BLANK();
+ 
+-	OFFSET(TI_task, thread_info, task);
+ 	OFFSET(TI_exec_domain, thread_info, exec_domain);
+ 	OFFSET(TI_flags, thread_info, flags);
+ 	OFFSET(TI_status, thread_info, status);
+@@ -60,6 +59,8 @@ void foo(void)
+ 	OFFSET(TI_restart_block, thread_info, restart_block);
+ 	OFFSET(TI_sysenter_return, thread_info, sysenter_return);
+ 	OFFSET(TI_cpu, thread_info, cpu);
++	OFFSET(TI_lowest_stack, thread_info, lowest_stack);
++	DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
+ 	BLANK();
+ 
+ 	OFFSET(GDS_size, desc_ptr, size);
+@@ -113,6 +114,11 @@ void foo(void)
  	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
  	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
  	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
@@ -10549,10 +11319,19 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/asm-offsets_32.c linux-2.6.38.2/arch/x
  #endif
  
  #ifdef CONFIG_XEN
-diff -urNp linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c
---- linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c	2011-03-21 18:31:35.000000000 -0400
-@@ -63,6 +63,18 @@ int main(void)
+diff -urNp linux-2.6.38.7/arch/x86/kernel/asm-offsets_64.c linux-2.6.38.7/arch/x86/kernel/asm-offsets_64.c
+--- linux-2.6.38.7/arch/x86/kernel/asm-offsets_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/asm-offsets_64.c	2011-05-16 21:47:08.000000000 -0400
+@@ -44,6 +44,8 @@ int main(void)
+ 	ENTRY(addr_limit);
+ 	ENTRY(preempt_count);
+ 	ENTRY(status);
++	ENTRY(lowest_stack);
++	DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
+ #ifdef CONFIG_IA32_EMULATION
+ 	ENTRY(sysenter_return);
+ #endif
+@@ -63,6 +65,18 @@ int main(void)
  	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
  	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
  	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
@@ -10571,7 +11350,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c linux-2.6.38.2/arch/x
  #endif
  
  
-@@ -115,6 +127,7 @@ int main(void)
+@@ -115,6 +129,7 @@ int main(void)
  	ENTRY(cr8);
  	BLANK();
  #undef ENTRY
@@ -10579,9 +11358,29 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/asm-offsets_64.c linux-2.6.38.2/arch/x
  	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
  	BLANK();
  	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/kernel/cpu/common.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/common.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/common.c	2011-03-21 18:31:35.000000000 -0400
+@@ -130,6 +145,7 @@ int main(void)
+ 
+ 	BLANK();
+ 	DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
++	DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
+ #ifdef CONFIG_XEN
+ 	BLANK();
+ 	OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/amd.c linux-2.6.38.7/arch/x86/kernel/cpu/amd.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/amd.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/amd.c	2011-05-22 23:05:54.000000000 -0400
+@@ -624,7 +624,7 @@ static unsigned int __cpuinit amd_size_c
+ 							unsigned int size)
+ {
+ 	/* AMD errata T13 (order #21922) */
+-	if ((c->x86 == 6)) {
++	if (c->x86 == 6) {
+ 		/* Duron Rev A0 */
+ 		if (c->x86_model == 3 && c->x86_mask == 0)
+ 			size = 64;
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/common.c linux-2.6.38.7/arch/x86/kernel/cpu/common.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/common.c	2011-05-11 18:34:57.000000000 -0400
 @@ -83,60 +83,6 @@ static const struct cpu_dev __cpuinitcon
  
  static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
@@ -10663,7 +11462,26 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  	/* If the model name is still unset, do table lookup. */
  	if (!c->x86_model_id[0]) {
  		const char *p;
-@@ -1084,7 +1034,7 @@ struct pt_regs * __cpuinit idle_regs(str
+@@ -1004,6 +954,9 @@ static __init int setup_disablecpuid(cha
+ }
+ __setup("clearcpuid=", setup_disablecpuid);
+ 
++DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
++EXPORT_PER_CPU_SYMBOL(current_tinfo);
++
+ #ifdef CONFIG_X86_64
+ struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
+ 
+@@ -1019,7 +972,7 @@ DEFINE_PER_CPU(struct task_struct *, cur
+ EXPORT_PER_CPU_SYMBOL(current_task);
+ 
+ DEFINE_PER_CPU(unsigned long, kernel_stack) =
+-	(unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
++	(unsigned long)&init_thread_union - 16 + THREAD_SIZE;
+ EXPORT_PER_CPU_SYMBOL(kernel_stack);
+ 
+ DEFINE_PER_CPU(char *, irq_stack_ptr) =
+@@ -1084,7 +1037,7 @@ struct pt_regs * __cpuinit idle_regs(str
  {
  	memset(regs, 0, sizeof(struct pt_regs));
  	regs->fs = __KERNEL_PERCPU;
@@ -10672,7 +11490,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  
  	return regs;
  }
-@@ -1139,7 +1089,7 @@ void __cpuinit cpu_init(void)
+@@ -1139,7 +1092,7 @@ void __cpuinit cpu_init(void)
  	int i;
  
  	cpu = stack_smp_processor_id();
@@ -10681,7 +11499,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  	oist = &per_cpu(orig_ist, cpu);
  
  #ifdef CONFIG_NUMA
-@@ -1165,7 +1115,7 @@ void __cpuinit cpu_init(void)
+@@ -1165,7 +1118,7 @@ void __cpuinit cpu_init(void)
  	switch_to_new_gdt(cpu);
  	loadsegment(fs, 0);
  
@@ -10690,7 +11508,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  
  	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
  	syscall_init();
-@@ -1174,7 +1124,6 @@ void __cpuinit cpu_init(void)
+@@ -1174,7 +1127,6 @@ void __cpuinit cpu_init(void)
  	wrmsrl(MSR_KERNEL_GS_BASE, 0);
  	barrier();
  
@@ -10698,7 +11516,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  	if (cpu != 0)
  		enable_x2apic();
  
-@@ -1228,7 +1177,7 @@ void __cpuinit cpu_init(void)
+@@ -1228,7 +1180,7 @@ void __cpuinit cpu_init(void)
  {
  	int cpu = smp_processor_id();
  	struct task_struct *curr = current;
@@ -10707,33 +11525,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/common.c linux-2.6.38.2/arch/x86/k
  	struct thread_struct *thread = &curr->thread;
  
  	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/acpi-cpufreq.c	2011-03-21 18:31:35.000000000 -0400
-@@ -481,7 +481,7 @@ static const struct dmi_system_id sw_any
- 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int acpi_cpufreq_blacklist(struct cpuinfo_x86 *c)
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/cpufreq/speedstep-centrino.c	2011-03-21 18:31:35.000000000 -0400
-@@ -226,7 +226,7 @@ static struct cpu_model models[] =
- 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
- 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
- 
--	{ NULL, }
-+	{ NULL, NULL, 0, NULL}
- };
- #undef _BANIAS
- #undef BANIAS
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/intel.c linux-2.6.38.2/arch/x86/kernel/cpu/intel.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/intel.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/intel.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/intel.c linux-2.6.38.7/arch/x86/kernel/cpu/intel.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/intel.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/intel.c	2011-04-28 19:34:14.000000000 -0400
 @@ -161,7 +161,7 @@ static void __cpuinit trap_init_f00f_bug
  	 * Update the IDT descriptor and reload the IDT so that
  	 * it uses the read-only mapped virtual address.
@@ -10743,9 +11537,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/intel.c linux-2.6.38.2/arch/x86/ke
  	load_idt(&idt_descr);
  }
  #endif
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/Makefile linux-2.6.38.2/arch/x86/kernel/cpu/Makefile
---- linux-2.6.38.2/arch/x86/kernel/cpu/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/Makefile linux-2.6.38.7/arch/x86/kernel/cpu/Makefile
+--- linux-2.6.38.7/arch/x86/kernel/cpu/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/Makefile	2011-04-28 19:34:14.000000000 -0400
 @@ -8,10 +8,6 @@ CFLAGS_REMOVE_common.o = -pg
  CFLAGS_REMOVE_perf_event.o = -pg
  endif
@@ -10757,9 +11551,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/Makefile linux-2.6.38.2/arch/x86/k
  obj-y			:= intel_cacheinfo.o scattered.o topology.o
  obj-y			+= proc.o capflags.o powerflags.o common.o
  obj-y			+= vmware.o hypervisor.o sched.o mshyperv.o
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.38.7/arch/x86/kernel/cpu/mcheck/mce.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/mcheck/mce.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/mcheck/mce.c	2011-04-28 19:57:25.000000000 -0400
 @@ -45,6 +45,7 @@
  #include <asm/ipi.h>
  #include <asm/mce.h>
@@ -10777,6 +11571,46 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.38.2/arch/x
  			print_symbol("{%s}", m->ip);
  		pr_cont("\n");
  	}
+@@ -243,10 +244,10 @@ static void print_mce(struct mce *m)
+ 
+ #define PANIC_TIMEOUT 5 /* 5 seconds */
+ 
+-static atomic_t mce_paniced;
++static atomic_unchecked_t mce_paniced;
+ 
+ static int fake_panic;
+-static atomic_t mce_fake_paniced;
++static atomic_unchecked_t mce_fake_paniced;
+ 
+ /* Panic in progress. Enable interrupts and wait for final IPI */
+ static void wait_for_panic(void)
+@@ -270,7 +271,7 @@ static void mce_panic(char *msg, struct 
+ 		/*
+ 		 * Make sure only one CPU runs in machine check panic
+ 		 */
+-		if (atomic_inc_return(&mce_paniced) > 1)
++		if (atomic_inc_return_unchecked(&mce_paniced) > 1)
+ 			wait_for_panic();
+ 		barrier();
+ 
+@@ -278,7 +279,7 @@ static void mce_panic(char *msg, struct 
+ 		console_verbose();
+ 	} else {
+ 		/* Don't log too much for fake panic */
+-		if (atomic_inc_return(&mce_fake_paniced) > 1)
++		if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
+ 			return;
+ 	}
+ 	/* First print corrected ones that are still unlogged */
+@@ -646,7 +647,7 @@ static int mce_timed_out(u64 *t)
+ 	 * might have been modified by someone else.
+ 	 */
+ 	rmb();
+-	if (atomic_read(&mce_paniced))
++	if (atomic_read_unchecked(&mce_paniced))
+ 		wait_for_panic();
+ 	if (!monarch_timeout)
+ 		goto out;
 @@ -1460,14 +1461,14 @@ void __cpuinit mcheck_cpu_init(struct cp
   */
  
@@ -10822,29 +11656,18 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.38.2/arch/x
  	.open			= mce_open,
  	.release		= mce_release,
  	.read			= mce_read,
-@@ -1673,6 +1673,7 @@ static struct miscdevice mce_log_device 
- 	MISC_MCELOG_MINOR,
- 	"mcelog",
- 	&mce_chrdev_ops,
-+	{NULL, NULL}, NULL, NULL
- };
- 
- /*
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/generic.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/generic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/generic.c	2011-03-21 18:31:35.000000000 -0400
-@@ -28,7 +28,7 @@ static struct fixed_range_block fixed_ra
- 	{ MSR_MTRRfix64K_00000, 1 }, /* one   64k MTRR  */
- 	{ MSR_MTRRfix16K_80000, 2 }, /* two   16k MTRRs */
- 	{ MSR_MTRRfix4K_C0000,  8 }, /* eight  4k MTRRs */
--	{}
-+	{ 0, 0 }
- };
- 
- static unsigned long smp_changes_mask;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/main.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/main.c	2011-03-21 18:31:35.000000000 -0400
+@@ -2171,7 +2171,7 @@ struct dentry *mce_get_debugfs_dir(void)
+ static void mce_reset(void)
+ {
+ 	cpu_missing = 0;
+-	atomic_set(&mce_fake_paniced, 0);
++	atomic_set_unchecked(&mce_fake_paniced, 0);
+ 	atomic_set(&mce_executing, 0);
+ 	atomic_set(&mce_callin, 0);
+ 	atomic_set(&global_nwo, 0);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/main.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/main.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/main.c	2011-04-28 19:34:14.000000000 -0400
 @@ -61,7 +61,7 @@ static DEFINE_MUTEX(mtrr_mutex);
  u64 size_or_mask, size_and_mask;
  static bool mtrr_aps_delayed_init;
@@ -10854,9 +11677,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.38.2/arch/x8
  
  const struct mtrr_ops *mtrr_if;
  
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/mtrr.h
---- linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/mtrr.h
+--- linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-04-28 19:34:14.000000000 -0400
 @@ -12,19 +12,19 @@
  extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
  
@@ -10885,10 +11708,19 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.38.2/arch/x8
  };
  
  extern int generic_get_free_region(unsigned long base, unsigned long size,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/perf_event.c linux-2.6.38.2/arch/x86/kernel/cpu/perf_event.c
---- linux-2.6.38.2/arch/x86/kernel/cpu/perf_event.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/cpu/perf_event.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1781,7 +1781,7 @@ perf_callchain_user(struct perf_callchai
+diff -urNp linux-2.6.38.7/arch/x86/kernel/cpu/perf_event.c linux-2.6.38.7/arch/x86/kernel/cpu/perf_event.c
+--- linux-2.6.38.7/arch/x86/kernel/cpu/perf_event.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/cpu/perf_event.c	2011-05-16 21:47:08.000000000 -0400
+@@ -674,6 +674,8 @@ static int x86_schedule_events(struct cp
+ 	int i, j, w, wmax, num = 0;
+ 	struct hw_perf_event *hwc;
+ 
++	pax_track_stack();
++
+ 	bitmap_zero(used_mask, X86_PMC_IDX_MAX);
+ 
+ 	for (i = 0; i < n; i++) {
+@@ -1781,7 +1783,7 @@ perf_callchain_user(struct perf_callchai
  			break;
  
  		perf_callchain_store(entry, frame.return_address);
@@ -10897,9 +11729,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/cpu/perf_event.c linux-2.6.38.2/arch/x
  	}
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/kernel/crash.c linux-2.6.38.2/arch/x86/kernel/crash.c
---- linux-2.6.38.2/arch/x86/kernel/crash.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/crash.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/crash.c linux-2.6.38.7/arch/x86/kernel/crash.c
+--- linux-2.6.38.7/arch/x86/kernel/crash.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/crash.c	2011-04-28 19:34:14.000000000 -0400
 @@ -42,7 +42,7 @@ static void kdump_nmi_callback(int cpu, 
  	regs = args->regs;
  
@@ -10909,9 +11741,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/crash.c linux-2.6.38.2/arch/x86/kernel
  		crash_fixup_ss_esp(&fixed_regs, regs);
  		regs = &fixed_regs;
  	}
-diff -urNp linux-2.6.38.2/arch/x86/kernel/doublefault_32.c linux-2.6.38.2/arch/x86/kernel/doublefault_32.c
---- linux-2.6.38.2/arch/x86/kernel/doublefault_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/doublefault_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/doublefault_32.c linux-2.6.38.7/arch/x86/kernel/doublefault_32.c
+--- linux-2.6.38.7/arch/x86/kernel/doublefault_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/doublefault_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -11,7 +11,7 @@
  
  #define DOUBLEFAULT_STACKSIZE (1024)
@@ -10943,10 +11775,30 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/doublefault_32.c linux-2.6.38.2/arch/x
  		.fs		= __KERNEL_PERCPU,
  
  		.__cr3		= __pa_nodebug(swapper_pg_dir),
-diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c
---- linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c	2011-03-21 18:31:35.000000000 -0400
-@@ -95,21 +95,22 @@ void show_registers(struct pt_regs *regs
+diff -urNp linux-2.6.38.7/arch/x86/kernel/dumpstack_32.c linux-2.6.38.7/arch/x86/kernel/dumpstack_32.c
+--- linux-2.6.38.7/arch/x86/kernel/dumpstack_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/dumpstack_32.c	2011-04-28 19:34:14.000000000 -0400
+@@ -37,15 +37,12 @@ void dump_trace(struct task_struct *task
+ 
+ 	bp = stack_frame(task, regs);
+ 	for (;;) {
+-		struct thread_info *context;
++		void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
++		bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
+ 
+-		context = (struct thread_info *)
+-			((unsigned long)stack & (~(THREAD_SIZE - 1)));
+-		bp = ops->walk_stack(context, stack, bp, ops, data, NULL, &graph);
+-
+-		stack = (unsigned long *)context->previous_esp;
+-		if (!stack)
++		if (stack_start == task_stack_page(task))
+ 			break;
++		stack = *(unsigned long **)stack_start;
+ 		if (ops->stack(data, "IRQ") < 0)
+ 			break;
+ 		touch_nmi_watchdog();
+@@ -95,21 +92,22 @@ void show_registers(struct pt_regs *regs
  	 * When in-kernel, we also print out the stack and code at the
  	 * time of the fault..
  	 */
@@ -10972,7 +11824,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c linux-2.6.38.2/arch/x86
  			code_len = code_len - code_prologue + 1;
  		}
  		for (i = 0; i < code_len; i++, ip++) {
-@@ -118,7 +119,7 @@ void show_registers(struct pt_regs *regs
+@@ -118,7 +116,7 @@ void show_registers(struct pt_regs *regs
  				printk(" Bad EIP value.");
  				break;
  			}
@@ -10981,7 +11833,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c linux-2.6.38.2/arch/x86
  				printk("<%02x> ", c);
  			else
  				printk("%02x ", c);
-@@ -131,6 +132,7 @@ int is_valid_bugaddr(unsigned long ip)
+@@ -131,6 +129,7 @@ int is_valid_bugaddr(unsigned long ip)
  {
  	unsigned short ud2;
  
@@ -10989,9 +11841,64 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack_32.c linux-2.6.38.2/arch/x86
  	if (ip < PAGE_OFFSET)
  		return 0;
  	if (probe_kernel_address((unsigned short *)ip, ud2))
-diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack.c linux-2.6.38.2/arch/x86/kernel/dumpstack.c
---- linux-2.6.38.2/arch/x86/kernel/dumpstack.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/dumpstack.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/dumpstack_64.c linux-2.6.38.7/arch/x86/kernel/dumpstack_64.c
+--- linux-2.6.38.7/arch/x86/kernel/dumpstack_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/dumpstack_64.c	2011-04-28 19:34:14.000000000 -0400
+@@ -147,10 +147,10 @@ void dump_trace(struct task_struct *task
+ 	unsigned long *irq_stack_end =
+ 		(unsigned long *)per_cpu(irq_stack_ptr, cpu);
+ 	unsigned used = 0;
+-	struct thread_info *tinfo;
+ 	int graph = 0;
+ 	unsigned long dummy;
+ 	unsigned long bp;
++	void *stack_start;
+ 
+ 	if (!task)
+ 		task = current;
+@@ -167,10 +167,10 @@ void dump_trace(struct task_struct *task
+ 	 * current stack address. If the stacks consist of nested
+ 	 * exceptions
+ 	 */
+-	tinfo = task_thread_info(task);
+ 	for (;;) {
+ 		char *id;
+ 		unsigned long *estack_end;
++
+ 		estack_end = in_exception_stack(cpu, (unsigned long)stack,
+ 						&used, &id);
+ 
+@@ -178,7 +178,7 @@ void dump_trace(struct task_struct *task
+ 			if (ops->stack(data, id) < 0)
+ 				break;
+ 
+-			bp = ops->walk_stack(tinfo, stack, bp, ops,
++			bp = ops->walk_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
+ 					     data, estack_end, &graph);
+ 			ops->stack(data, "<EOE>");
+ 			/*
+@@ -197,7 +197,7 @@ void dump_trace(struct task_struct *task
+ 			if (in_irq_stack(stack, irq_stack, irq_stack_end)) {
+ 				if (ops->stack(data, "IRQ") < 0)
+ 					break;
+-				bp = ops->walk_stack(tinfo, stack, bp,
++				bp = ops->walk_stack(task, irq_stack, stack, bp,
+ 					ops, data, irq_stack_end, &graph);
+ 				/*
+ 				 * We link to the next stack (which would be
+@@ -218,7 +218,8 @@ void dump_trace(struct task_struct *task
+ 	/*
+ 	 * This handles the process stack:
+ 	 */
+-	bp = ops->walk_stack(tinfo, stack, bp, ops, data, NULL, &graph);
++	stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
++	bp = ops->walk_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
+ 	put_cpu();
+ }
+ EXPORT_SYMBOL(dump_trace);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/dumpstack.c linux-2.6.38.7/arch/x86/kernel/dumpstack.c
+--- linux-2.6.38.7/arch/x86/kernel/dumpstack.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/dumpstack.c	2011-04-28 19:34:14.000000000 -0400
 @@ -2,6 +2,9 @@
   *  Copyright (C) 1991, 1992  Linus Torvalds
   *  Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
@@ -11011,7 +11918,92 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack.c linux-2.6.38.2/arch/x86/ke
  			reliable ? "" : "? ", (void *) address);
  }
  
-@@ -200,7 +203,7 @@ void dump_stack(void)
+@@ -35,9 +38,8 @@ void printk_address(unsigned long addres
+ static void
+ print_ftrace_graph_addr(unsigned long addr, void *data,
+ 			const struct stacktrace_ops *ops,
+-			struct thread_info *tinfo, int *graph)
++			struct task_struct *task, int *graph)
+ {
+-	struct task_struct *task = tinfo->task;
+ 	unsigned long ret_addr;
+ 	int index = task->curr_ret_stack;
+ 
+@@ -58,7 +60,7 @@ print_ftrace_graph_addr(unsigned long ad
+ static inline void
+ print_ftrace_graph_addr(unsigned long addr, void *data,
+ 			const struct stacktrace_ops *ops,
+-			struct thread_info *tinfo, int *graph)
++			struct task_struct *task, int *graph)
+ { }
+ #endif
+ 
+@@ -69,10 +71,8 @@ print_ftrace_graph_addr(unsigned long ad
+  * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
+  */
+ 
+-static inline int valid_stack_ptr(struct thread_info *tinfo,
+-			void *p, unsigned int size, void *end)
++static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
+ {
+-	void *t = tinfo;
+ 	if (end) {
+ 		if (p < end && p >= (end-THREAD_SIZE))
+ 			return 1;
+@@ -83,14 +83,14 @@ static inline int valid_stack_ptr(struct
+ }
+ 
+ unsigned long
+-print_context_stack(struct thread_info *tinfo,
++print_context_stack(struct task_struct *task, void *stack_start,
+ 		unsigned long *stack, unsigned long bp,
+ 		const struct stacktrace_ops *ops, void *data,
+ 		unsigned long *end, int *graph)
+ {
+ 	struct stack_frame *frame = (struct stack_frame *)bp;
+ 
+-	while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
++	while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
+ 		unsigned long addr;
+ 
+ 		addr = *stack;
+@@ -102,7 +102,7 @@ print_context_stack(struct thread_info *
+ 			} else {
+ 				ops->address(data, addr, 0);
+ 			}
+-			print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
++			print_ftrace_graph_addr(addr, data, ops, task, graph);
+ 		}
+ 		stack++;
+ 	}
+@@ -111,7 +111,7 @@ print_context_stack(struct thread_info *
+ EXPORT_SYMBOL_GPL(print_context_stack);
+ 
+ unsigned long
+-print_context_stack_bp(struct thread_info *tinfo,
++print_context_stack_bp(struct task_struct *task, void *stack_start,
+ 		       unsigned long *stack, unsigned long bp,
+ 		       const struct stacktrace_ops *ops, void *data,
+ 		       unsigned long *end, int *graph)
+@@ -119,7 +119,7 @@ print_context_stack_bp(struct thread_inf
+ 	struct stack_frame *frame = (struct stack_frame *)bp;
+ 	unsigned long *ret_addr = &frame->return_address;
+ 
+-	while (valid_stack_ptr(tinfo, ret_addr, sizeof(*ret_addr), end)) {
++	while (valid_stack_ptr(stack_start, ret_addr, sizeof(*ret_addr), end)) {
+ 		unsigned long addr = *ret_addr;
+ 
+ 		if (!__kernel_text_address(addr))
+@@ -128,7 +128,7 @@ print_context_stack_bp(struct thread_inf
+ 		ops->address(data, addr, 1);
+ 		frame = frame->next_frame;
+ 		ret_addr = &frame->return_address;
+-		print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
++		print_ftrace_graph_addr(addr, data, ops, task, graph);
+ 	}
+ 
+ 	return (unsigned long)frame;
+@@ -200,7 +200,7 @@ void dump_stack(void)
  	unsigned long stack;
  
  	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
@@ -11020,16 +12012,28 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack.c linux-2.6.38.2/arch/x86/ke
  		init_utsname()->release,
  		(int)strcspn(init_utsname()->version, " "),
  		init_utsname()->version);
-@@ -257,7 +260,7 @@ void __kprobes oops_end(unsigned long fl
+@@ -236,6 +236,8 @@ unsigned __kprobes long oops_begin(void)
+ }
+ EXPORT_SYMBOL_GPL(oops_begin);
+ 
++extern void gr_handle_kernel_exploit(void);
++
+ void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
+ {
+ 	if (regs && kexec_should_crash(current))
+@@ -257,7 +259,10 @@ void __kprobes oops_end(unsigned long fl
  		panic("Fatal exception in interrupt");
  	if (panic_on_oops)
  		panic("Fatal exception");
 -	do_exit(signr);
++
++	gr_handle_kernel_exploit();
++
 +	do_group_exit(signr);
  }
  
  int __kprobes __die(const char *str, struct pt_regs *regs, long err)
-@@ -284,7 +287,7 @@ int __kprobes __die(const char *str, str
+@@ -284,7 +289,7 @@ int __kprobes __die(const char *str, str
  
  	show_registers(regs);
  #ifdef CONFIG_X86_32
@@ -11038,7 +12042,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack.c linux-2.6.38.2/arch/x86/ke
  		sp = regs->sp;
  		ss = regs->ss & 0xffff;
  	} else {
-@@ -312,7 +315,7 @@ void die(const char *str, struct pt_regs
+@@ -312,7 +317,7 @@ void die(const char *str, struct pt_regs
  	unsigned long flags = oops_begin();
  	int sig = SIGSEGV;
  
@@ -11047,10 +12051,30 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/dumpstack.c linux-2.6.38.2/arch/x86/ke
  		report_bug(regs->ip, regs);
  
  	if (__die(str, regs, err))
-diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/kernel/entry_32.S
---- linux-2.6.38.2/arch/x86/kernel/entry_32.S	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/entry_32.S	2011-03-28 17:42:53.000000000 -0400
-@@ -183,13 +183,81 @@
+diff -urNp linux-2.6.38.7/arch/x86/kernel/early_printk.c linux-2.6.38.7/arch/x86/kernel/early_printk.c
+--- linux-2.6.38.7/arch/x86/kernel/early_printk.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/early_printk.c	2011-05-16 21:47:08.000000000 -0400
+@@ -7,6 +7,7 @@
+ #include <linux/pci_regs.h>
+ #include <linux/pci_ids.h>
+ #include <linux/errno.h>
++#include <linux/sched.h>
+ #include <asm/io.h>
+ #include <asm/processor.h>
+ #include <asm/fcntl.h>
+@@ -179,6 +180,8 @@ asmlinkage void early_printk(const char 
+ 	int n;
+ 	va_list ap;
+ 
++	pax_track_stack();
++
+ 	va_start(ap, fmt);
+ 	n = vscnprintf(buf, sizeof(buf), fmt, ap);
+ 	early_console->write(early_console, buf, n);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/entry_32.S linux-2.6.38.7/arch/x86/kernel/entry_32.S
+--- linux-2.6.38.7/arch/x86/kernel/entry_32.S	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/entry_32.S	2011-05-22 23:03:34.000000000 -0400
+@@ -183,13 +183,146 @@
  	/*CFI_REL_OFFSET gs, PT_GS*/
  .endm
  .macro SET_KERNEL_GS reg
@@ -11069,40 +12093,23 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  #endif	/* CONFIG_X86_32_LAZY_GS */
  
 -.macro SAVE_ALL
-+.macro PAX_EXIT_KERNEL
++.macro pax_enter_kernel
 +#ifdef CONFIG_PAX_KERNEXEC
-+#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx
-+#endif
-+	mov %cs, %esi
-+	cmp $__KERNEXEC_KERNEL_CS, %esi
-+	jnz 2f
-+#ifdef CONFIG_PARAVIRT
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
-+	mov %eax, %esi
-+#else
-+	mov %cr0, %esi
-+#endif
-+	btr $16, %esi
-+	ljmp $__KERNEL_CS, $1f
-+1:
-+#ifdef CONFIG_PARAVIRT
-+	mov %esi, %eax
-+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
-+#else
-+	mov %esi, %cr0
-+#endif
-+2:
-+#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
++	call pax_enter_kernel
 +#endif
++.endm
++
++.macro pax_exit_kernel
++#ifdef CONFIG_PAX_KERNEXEC
++	call pax_exit_kernel
 +#endif
 +.endm
 +
-+.macro PAX_ENTER_KERNEL
 +#ifdef CONFIG_PAX_KERNEXEC
++ENTRY(pax_enter_kernel)
 +#ifdef CONFIG_PARAVIRT
-+	push %eax; push %ecx
++	pushl %eax
++	pushl %ecx
 +	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
 +	mov %eax, %esi
 +#else
@@ -11124,16 +12131,98 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
 +#endif
 +3:
 +#ifdef CONFIG_PARAVIRT
-+	pop %ecx; pop %eax
++	popl %ecx
++	popl %eax
 +#endif
++	ret
++ENDPROC(pax_enter_kernel)
++
++ENTRY(pax_exit_kernel)
++#ifdef CONFIG_PARAVIRT
++	pushl %eax
++	pushl %ecx
++#endif
++	mov %cs, %esi
++	cmp $__KERNEXEC_KERNEL_CS, %esi
++	jnz 2f
++#ifdef CONFIG_PARAVIRT
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
++	mov %eax, %esi
++#else
++	mov %cr0, %esi
++#endif
++	btr $16, %esi
++	ljmp $__KERNEL_CS, $1f
++1:
++#ifdef CONFIG_PARAVIRT
++	mov %esi, %eax
++	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
++#else
++	mov %esi, %cr0
++#endif
++2:
++#ifdef CONFIG_PARAVIRT
++	popl %ecx
++	popl %eax
++#endif
++	ret
++ENDPROC(pax_exit_kernel)
++#endif
++
++.macro pax_erase_kstack
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	call pax_erase_kstack
 +#endif
 +.endm
 +
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++/*
++ * ebp: thread_info
++ * ecx, edx: can be clobbered
++ */
++ENTRY(pax_erase_kstack)
++	pushl %edi
++	pushl %eax
++
++	mov TI_lowest_stack(%ebp), %edi
++	mov $-0xBEEF, %eax
++	std
++
++1:	mov %edi, %ecx
++	and $THREAD_SIZE_asm - 1, %ecx
++	shr $2, %ecx
++	repne scasl
++	jecxz 2f
++
++	cmp $2*16, %ecx
++	jc 2f
++
++	mov $2*16, %ecx
++	repe scasl
++	jecxz 2f
++	jne 1b
++
++2:	cld
++	mov %esp, %ecx
++	sub %edi, %ecx
++	shr $2, %ecx
++	rep stosl
++
++	mov TI_task_thread_sp0(%ebp), %edi
++	sub $128, %edi
++	mov %edi, TI_lowest_stack(%ebp)
++
++	popl %eax
++	popl %edi
++	ret
++ENDPROC(pax_erase_kstack)
++#endif
++
 +.macro __SAVE_ALL _DS
  	cld
  	PUSH_GS
  	pushl_cfi %fs
-@@ -212,7 +280,7 @@
+@@ -212,7 +345,7 @@
  	CFI_REL_OFFSET ecx, 0
  	pushl_cfi %ebx
  	CFI_REL_OFFSET ebx, 0
@@ -11142,14 +12231,14 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	movl %edx, %ds
  	movl %edx, %es
  	movl $(__KERNEL_PERCPU), %edx
-@@ -220,6 +288,15 @@
+@@ -220,6 +353,15 @@
  	SET_KERNEL_GS %edx
  .endm
  
 +.macro SAVE_ALL
 +#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
 +	__SAVE_ALL __KERNEL_DS
-+	PAX_ENTER_KERNEL
++	pax_enter_kernel
 +#else
 +	__SAVE_ALL __USER_DS
 +#endif
@@ -11158,7 +12247,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  .macro RESTORE_INT_REGS
  	popl_cfi %ebx
  	CFI_RESTORE ebx
-@@ -330,7 +407,15 @@ check_userspace:
+@@ -330,7 +472,15 @@ check_userspace:
  	movb PT_CS(%esp), %al
  	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
  	cmpl $USER_RPL, %eax
@@ -11174,7 +12263,16 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  
  ENTRY(resume_userspace)
  	LOCKDEP_SYS_EXIT
-@@ -392,10 +477,9 @@ sysenter_past_esp:
+@@ -342,7 +492,7 @@ ENTRY(resume_userspace)
+ 	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done on
+ 					# int/exception return?
+ 	jne work_pending
+-	jmp restore_all
++	jmp restore_all_pax
+ END(ret_from_exception)
+ 
+ #ifdef CONFIG_PREEMPT
+@@ -392,23 +542,34 @@ sysenter_past_esp:
  	/*CFI_REL_OFFSET cs, 0*/
  	/*
  	 * Push current_thread_info()->sysenter_return to the stack.
@@ -11182,12 +12280,17 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
 -	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
  	 */
 -	pushl_cfi ((TI_sysenter_return)-THREAD_SIZE_asm+8+4*4)(%esp)
-+	GET_THREAD_INFO(%ebp)
-+	pushl_cfi TI_sysenter_return(%ebp)
++	pushl_cfi $0
  	CFI_REL_OFFSET eip, 0
  
  	pushl_cfi %eax
-@@ -406,9 +490,19 @@ sysenter_past_esp:
+ 	SAVE_ALL
++	GET_THREAD_INFO(%ebp)
++	movl TI_sysenter_return(%ebp),%ebp
++	movl %ebp,PT_EIP(%esp)
+ 	ENABLE_INTERRUPTS(CLBR_NONE)
+ 
+ /*
   * Load the potential sixth argument from user stack.
   * Careful about security.
   */
@@ -11207,19 +12310,19 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	movl %ebp,PT_EBP(%esp)
  .section __ex_table,"a"
  	.align 4
-@@ -431,12 +525,23 @@ sysenter_do_call:
+@@ -431,12 +592,23 @@ sysenter_do_call:
  	testl $_TIF_ALLWORK_MASK, %ecx
  	jne sysexit_audit
  sysenter_exit:
 +
 +#ifdef CONFIG_PAX_RANDKSTACK
-+	pushl %eax
-+	CFI_ADJUST_CFA_OFFSET 4
++	pushl_cfi %eax
 +	call pax_randomize_kstack
-+	popl %eax
-+	CFI_ADJUST_CFA_OFFSET -4
++	popl_cfi %eax
 +#endif
 +
++	pax_erase_kstack
++
  /* if something modifies registers it must also disable sysexit */
  	movl PT_EIP(%esp), %edx
  	movl PT_OLDESP(%esp), %ecx
@@ -11231,7 +12334,17 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	PTGS_TO_GS
  	ENABLE_INTERRUPTS_SYSEXIT
  
-@@ -479,11 +584,17 @@ sysexit_audit:
+@@ -453,6 +625,9 @@ sysenter_audit:
+ 	movl %eax,%edx			/* 2nd arg: syscall number */
+ 	movl $AUDIT_ARCH_I386,%eax	/* 1st arg: audit arch */
+ 	call audit_syscall_entry
++
++	pax_erase_kstack
++
+ 	pushl_cfi %ebx
+ 	movl PT_EAX(%esp),%eax		/* reload syscall number */
+ 	jmp sysenter_do_call
+@@ -479,11 +654,17 @@ sysexit_audit:
  
  	CFI_ENDPROC
  .pushsection .fixup,"ax"
@@ -11251,18 +12364,22 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  .popsection
  	PTGS_TO_GS_EX
  ENDPROC(ia32_sysenter_target)
-@@ -516,6 +627,10 @@ syscall_exit:
+@@ -516,6 +697,14 @@ syscall_exit:
  	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
  	jne syscall_exit_work
  
++restore_all_pax:
++
 +#ifdef CONFIG_PAX_RANDKSTACK
 +	call pax_randomize_kstack
 +#endif
 +
++	pax_erase_kstack
++
  restore_all:
  	TRACE_IRQS_IRET
  restore_all_notrace:
-@@ -575,14 +690,21 @@ ldt_ss:
+@@ -575,14 +764,21 @@ ldt_ss:
   * compensating for the offset by changing to the ESPFIX segment with
   * a base address that matches for the difference.
   */
@@ -11287,7 +12404,14 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	pushl_cfi $__ESPFIX_SS
  	pushl_cfi %eax			/* new kernel esp */
  	/* Disable interrupts, but do not irqtrace this section: we
-@@ -617,23 +739,17 @@ work_resched:
+@@ -611,29 +807,23 @@ work_resched:
+ 	movl TI_flags(%ebp), %ecx
+ 	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done other
+ 					# than syscall tracing?
+-	jz restore_all
++	jz restore_all_pax
+ 	testb $_TIF_NEED_RESCHED, %cl
+ 	jnz work_resched
  
  work_notifysig:				# deal with pending signals and
  					# notify-resume requests
@@ -11314,7 +12438,17 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  #endif
  	xorl %edx, %edx
  	call do_notify_resume
-@@ -668,6 +784,10 @@ END(syscall_exit_work)
+@@ -646,6 +836,9 @@ syscall_trace_entry:
+ 	movl $-ENOSYS,PT_EAX(%esp)
+ 	movl %esp, %eax
+ 	call syscall_trace_enter
++
++	pax_erase_kstack
++
+ 	/* What it returned is what we'll actually use.  */
+ 	cmpl $(nr_syscalls), %eax
+ 	jnae syscall_call
+@@ -668,6 +861,10 @@ END(syscall_exit_work)
  
  	RING0_INT_FRAME			# can't unwind into user space anyway
  syscall_fault:
@@ -11325,7 +12459,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	GET_THREAD_INFO(%ebp)
  	movl $-EFAULT,PT_EAX(%esp)
  	jmp resume_userspace
-@@ -750,6 +870,36 @@ ptregs_clone:
+@@ -750,6 +947,36 @@ ptregs_clone:
  	CFI_ENDPROC
  ENDPROC(ptregs_clone)
  
@@ -11362,7 +12496,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  .macro FIXUP_ESPFIX_STACK
  /*
   * Switch back for ESPFIX stack to the normal zerobased stack
-@@ -759,8 +909,15 @@ ENDPROC(ptregs_clone)
+@@ -759,8 +986,15 @@ ENDPROC(ptregs_clone)
   * normal stack and adjusts ESP with the matching offset.
   */
  	/* fixup the stack */
@@ -11380,7 +12514,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	shl $16, %eax
  	addl %esp, %eax			/* the adjusted stack pointer */
  	pushl_cfi $__KERNEL_DS
-@@ -1211,7 +1368,6 @@ return_to_handler:
+@@ -1211,7 +1445,6 @@ return_to_handler:
  	jmp *%ecx
  #endif
  
@@ -11388,7 +12522,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  #include "syscall_table_32.S"
  
  syscall_table_size=(.-sys_call_table)
-@@ -1257,9 +1413,12 @@ error_code:
+@@ -1257,9 +1490,12 @@ error_code:
  	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
  	REG_TO_PTGS %ecx
  	SET_KERNEL_GS %ecx
@@ -11397,34 +12531,34 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_32.S linux-2.6.38.2/arch/x86/ker
  	movl %ecx, %ds
  	movl %ecx, %es
 +
-+	PAX_ENTER_KERNEL
++	pax_enter_kernel
 +
  	TRACE_IRQS_OFF
  	movl %esp,%eax			# pt_regs pointer
  	call *%edi
-@@ -1344,6 +1503,9 @@ nmi_stack_correct:
+@@ -1344,6 +1580,9 @@ nmi_stack_correct:
  	xorl %edx,%edx		# zero error code
  	movl %esp,%eax		# pt_regs pointer
  	call do_nmi
 +
-+	PAX_EXIT_KERNEL
++	pax_exit_kernel
 +
  	jmp restore_all_notrace
  	CFI_ENDPROC
  
-@@ -1380,6 +1542,9 @@ nmi_espfix_stack:
+@@ -1380,6 +1619,9 @@ nmi_espfix_stack:
  	FIXUP_ESPFIX_STACK		# %eax == %esp
  	xorl %edx,%edx			# zero error code
  	call do_nmi
 +
-+	PAX_EXIT_KERNEL
++	pax_exit_kernel
 +
  	RESTORE_REGS
  	lss 12+4(%esp), %esp		# back to espfix stack
  	CFI_ADJUST_CFA_OFFSET -24
-diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/kernel/entry_64.S
---- linux-2.6.38.2/arch/x86/kernel/entry_64.S	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/entry_64.S	2011-03-23 17:21:49.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/entry_64.S linux-2.6.38.7/arch/x86/kernel/entry_64.S
+--- linux-2.6.38.7/arch/x86/kernel/entry_64.S	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/entry_64.S	2011-05-22 23:19:17.000000000 -0400
 @@ -53,6 +53,7 @@
  #include <asm/paravirt.h>
  #include <asm/ftrace.h>
@@ -11433,20 +12567,20 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  
  /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
  #include <linux/elf-em.h>
-@@ -174,6 +175,201 @@ ENTRY(native_usergs_sysret64)
+@@ -174,6 +175,259 @@ ENTRY(native_usergs_sysret64)
  ENDPROC(native_usergs_sysret64)
  #endif /* CONFIG_PARAVIRT */
  
 +	.macro ljmpq sel, off
-+#if defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
++#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
 +	.byte 0x48; ljmp *1234f(%rip)
 +	.pushsection .rodata
 +	.align 16
 +	1234: .quad \off; .word \sel
 +	.popsection
 +#else
-+	push $\sel
-+	push $\off
++	pushq $\sel
++	pushq $\off
 +	lretq
 +#endif
 +	.endm
@@ -11465,7 +12599,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +
 +#ifdef CONFIG_PAX_KERNEXEC
 +ENTRY(pax_enter_kernel)
-+	push %rdi
++	pushq %rdi
 +
 +#ifdef CONFIG_PARAVIRT
 +	PV_SAVE_REGS(CLBR_RDI)
@@ -11486,12 +12620,12 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	PV_RESTORE_REGS(CLBR_RDI)
 +#endif
 +
-+	pop %rdi
++	popq %rdi
 +	retq
 +ENDPROC(pax_enter_kernel)
 +
 +ENTRY(pax_exit_kernel)
-+	push %rdi
++	pushq %rdi
 +
 +#ifdef CONFIG_PARAVIRT
 +	PV_SAVE_REGS(CLBR_RDI)
@@ -11510,7 +12644,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	PV_RESTORE_REGS(CLBR_RDI);
 +#endif
 +
-+	pop %rdi
++	popq %rdi
 +	retq
 +ENDPROC(pax_exit_kernel)
 +#endif
@@ -11525,12 +12659,20 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	call pax_exit_kernel_user
 +#endif
++#ifdef CONFIG_PAX_RANDKSTACK
++	push %rax
++	call pax_randomize_kstack
++	pop %rax
++#endif
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	call pax_erase_kstack
++#endif
 +	.endm
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
 +ENTRY(pax_enter_kernel_user)
-+	push %rdi
-+	push %rbx
++	pushq %rdi
++	pushq %rbx
 +
 +#ifdef CONFIG_PARAVIRT
 +	PV_SAVE_REGS(CLBR_RDI)
@@ -11542,7 +12684,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	sub phys_base(%rip),%rbx
 +
 +#ifdef CONFIG_PARAVIRT
-+	push %rdi
++	pushq %rdi
 +	cmpl $0, pv_info+PARAVIRT_enabled
 +	jz 1f
 +	i = 0
@@ -11564,7 +12706,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	.endr
 +
 +#ifdef CONFIG_PARAVIRT
-+2:	pop %rdi
++2:	popq %rdi
 +#endif
 +	SET_RDI_INTO_CR3
 +
@@ -11578,8 +12720,8 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	PV_RESTORE_REGS(CLBR_RDI)
 +#endif
 +
-+	pop %rbx
-+	pop %rdi
++	popq %rbx
++	popq %rdi
 +	retq
 +ENDPROC(pax_enter_kernel_user)
 +
@@ -11587,7 +12729,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +	push %rdi
 +
 +#ifdef CONFIG_PARAVIRT
-+	push %rbx
++	pushq %rbx
 +	PV_SAVE_REGS(CLBR_RDI)
 +#endif
 +
@@ -11625,17 +12767,67 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
 +
 +#ifdef CONFIG_PARAVIRT
 +2:	PV_RESTORE_REGS(CLBR_RDI)
-+	pop %rbx
++	popq %rbx
 +#endif
 +
-+	pop %rdi
++	popq %rdi
 +	retq
 +ENDPROC(pax_exit_kernel_user)
 +#endif
++
++	.macro pax_erase_kstack
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	call pax_erase_kstack
++#endif
++	.endm
++
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++/*
++ * r10: thread_info
++ * rcx, rdx: can be clobbered
++ */
++ENTRY(pax_erase_kstack)
++	pushq %rdi
++	pushq %rax
++
++	GET_THREAD_INFO(%r10)
++	mov TI_lowest_stack(%r10), %rdi
++	mov $-0xBEEF, %rax
++	std
++
++1:	mov %edi, %ecx
++	and $THREAD_SIZE_asm - 1, %ecx
++	shr $3, %ecx
++	repne scasq
++	jecxz 2f
++
++	cmp $2*8, %ecx
++	jc 2f
++
++	mov $2*8, %ecx
++	repe scasq
++	jecxz 2f
++	jne 1b
++
++2:	cld
++	mov %esp, %ecx
++	sub %edi, %ecx
++	shr $3, %ecx
++	rep stosq
++
++	mov TI_task_thread_sp0(%r10), %rdi
++	sub $256, %rdi
++	mov %rdi, TI_lowest_stack(%r10)
++
++	popq %rax
++	popq %rdi
++	ret
++ENDPROC(pax_erase_kstack)
++#endif
  
  .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
  #ifdef CONFIG_TRACE_IRQFLAGS
-@@ -316,7 +512,7 @@ ENTRY(save_args)
+@@ -316,7 +570,7 @@ ENTRY(save_args)
  	leaq -RBP+8(%rsp),%rdi	/* arg1 for handler */
  	movq_cfi rbp, 8		/* push %rbp */
  	leaq 8(%rsp), %rbp		/* mov %rsp, %ebp */
@@ -11644,7 +12836,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	je 1f
  	SWAPGS
  	/*
-@@ -407,7 +603,7 @@ ENTRY(ret_from_fork)
+@@ -407,7 +661,7 @@ ENTRY(ret_from_fork)
  
  	RESTORE_REST
  
@@ -11653,7 +12845,16 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	je   int_ret_from_sys_call
  
  	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
-@@ -466,6 +662,7 @@ ENTRY(system_call_after_swapgs)
+@@ -453,7 +707,7 @@ END(ret_from_fork)
+ ENTRY(system_call)
+ 	CFI_STARTPROC	simple
+ 	CFI_SIGNAL_FRAME
+-	CFI_DEF_CFA	rsp,KERNEL_STACK_OFFSET
++	CFI_DEF_CFA	rsp,0
+ 	CFI_REGISTER	rip,rcx
+ 	/*CFI_REGISTER	rflags,r11*/
+ 	SWAPGS_UNSAFE_STACK
+@@ -466,12 +720,13 @@ ENTRY(system_call_after_swapgs)
  
  	movq	%rsp,PER_CPU_VAR(old_rsp)
  	movq	PER_CPU_VAR(kernel_stack),%rsp
@@ -11661,7 +12862,14 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	/*
  	 * No need to follow this irqs off/on section - it's straight
  	 * and short:
-@@ -500,6 +697,7 @@ sysret_check:
+ 	 */
+ 	ENABLE_INTERRUPTS(CLBR_NONE)
+-	SAVE_ARGS 8,1
++	SAVE_ARGS 8*6,1
+ 	movq  %rax,ORIG_RAX-ARGOFFSET(%rsp)
+ 	movq  %rcx,RIP-ARGOFFSET(%rsp)
+ 	CFI_REL_OFFSET rip,RIP-ARGOFFSET
+@@ -500,6 +755,7 @@ sysret_check:
  	andl %edi,%edx
  	jnz  sysret_careful
  	CFI_REMEMBER_STATE
@@ -11669,7 +12877,27 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	/*
  	 * sysretq will re-enable interrupts:
  	 */
-@@ -609,7 +807,7 @@ tracesys:
+@@ -558,6 +814,9 @@ auditsys:
+ 	movq %rax,%rsi			/* 2nd arg: syscall number */
+ 	movl $AUDIT_ARCH_X86_64,%edi	/* 1st arg: audit arch */
+ 	call audit_syscall_entry
++
++	pax_erase_kstack
++
+ 	LOAD_ARGS 0		/* reload call-clobbered registers */
+ 	jmp system_call_fastpath
+ 
+@@ -588,6 +847,9 @@ tracesys:
+ 	FIXUP_TOP_OF_STACK %rdi
+ 	movq %rsp,%rdi
+ 	call syscall_trace_enter
++
++	pax_erase_kstack
++
+ 	/*
+ 	 * Reload arg registers from stack in case ptrace changed them.
+ 	 * We don't reload %rax because syscall_trace_enter() returned
+@@ -609,7 +871,7 @@ tracesys:
  GLOBAL(int_ret_from_sys_call)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	TRACE_IRQS_OFF
@@ -11678,7 +12906,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	je retint_restore_args
  	movl $_TIF_ALLWORK_MASK,%edi
  	/* edi:	mask to check */
-@@ -791,6 +989,16 @@ END(interrupt)
+@@ -791,6 +1053,16 @@ END(interrupt)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-RBP
  	call save_args
  	PARTIAL_FRAME 0
@@ -11695,7 +12923,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	call \func
  	.endm
  
-@@ -823,7 +1031,7 @@ ret_from_intr:
+@@ -823,7 +1095,7 @@ ret_from_intr:
  	CFI_ADJUST_CFA_OFFSET	-8
  exit_intr:
  	GET_THREAD_INFO(%rcx)
@@ -11704,7 +12932,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	je retint_kernel
  
  	/* Interrupt came from user space */
-@@ -845,12 +1053,14 @@ retint_swapgs:		/* return to user-space 
+@@ -845,12 +1117,14 @@ retint_swapgs:		/* return to user-space 
  	 * The iretq could re-enable interrupts:
  	 */
  	DISABLE_INTERRUPTS(CLBR_ANY)
@@ -11719,7 +12947,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	/*
  	 * The iretq could re-enable interrupts:
  	 */
-@@ -1022,6 +1232,16 @@ ENTRY(\sym)
+@@ -1022,6 +1296,16 @@ ENTRY(\sym)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call error_entry
  	DEFAULT_FRAME 0
@@ -11736,7 +12964,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	movq %rsp,%rdi		/* pt_regs pointer */
  	xorl %esi,%esi		/* no error code */
  	call \do_sym
-@@ -1039,6 +1259,16 @@ ENTRY(\sym)
+@@ -1039,6 +1323,16 @@ ENTRY(\sym)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call save_paranoid
  	TRACE_IRQS_OFF
@@ -11753,7 +12981,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	movq %rsp,%rdi		/* pt_regs pointer */
  	xorl %esi,%esi		/* no error code */
  	call \do_sym
-@@ -1047,7 +1277,7 @@ ENTRY(\sym)
+@@ -1047,7 +1341,7 @@ ENTRY(\sym)
  END(\sym)
  .endm
  
@@ -11762,7 +12990,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  .macro paranoidzeroentry_ist sym do_sym ist
  ENTRY(\sym)
  	INTR_FRAME
-@@ -1057,8 +1287,24 @@ ENTRY(\sym)
+@@ -1057,8 +1351,24 @@ ENTRY(\sym)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call save_paranoid
  	TRACE_IRQS_OFF
@@ -11787,7 +13015,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	subq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
  	call \do_sym
  	addq $EXCEPTION_STKSZ, INIT_TSS_IST(\ist)
-@@ -1075,6 +1321,16 @@ ENTRY(\sym)
+@@ -1075,6 +1385,16 @@ ENTRY(\sym)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call error_entry
  	DEFAULT_FRAME 0
@@ -11804,7 +13032,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	movq %rsp,%rdi			/* pt_regs pointer */
  	movq ORIG_RAX(%rsp),%rsi	/* get error code */
  	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
-@@ -1094,6 +1350,16 @@ ENTRY(\sym)
+@@ -1094,6 +1414,16 @@ ENTRY(\sym)
  	call save_paranoid
  	DEFAULT_FRAME 0
  	TRACE_IRQS_OFF
@@ -11821,7 +13049,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	movq %rsp,%rdi			/* pt_regs pointer */
  	movq ORIG_RAX(%rsp),%rsi	/* get error code */
  	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
-@@ -1356,14 +1622,27 @@ ENTRY(paranoid_exit)
+@@ -1356,14 +1686,27 @@ ENTRY(paranoid_exit)
  	TRACE_IRQS_OFF
  	testl %ebx,%ebx				/* swapgs needed? */
  	jnz paranoid_restore
@@ -11850,7 +13078,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	TRACE_IRQS_IRETQ 0
  	RESTORE_ALL 8
  	jmp irq_return
-@@ -1421,7 +1700,7 @@ ENTRY(error_entry)
+@@ -1421,7 +1764,7 @@ ENTRY(error_entry)
  	movq_cfi r14, R14+8
  	movq_cfi r15, R15+8
  	xorl %ebx,%ebx
@@ -11859,7 +13087,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	je error_kernelspace
  error_swapgs:
  	SWAPGS
-@@ -1485,6 +1764,16 @@ ENTRY(nmi)
+@@ -1485,6 +1828,16 @@ ENTRY(nmi)
  	CFI_ADJUST_CFA_OFFSET ORIG_RAX-R15
  	call save_paranoid
  	DEFAULT_FRAME 0
@@ -11876,7 +13104,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
  	movq %rsp,%rdi
  	movq $-1,%rsi
-@@ -1495,11 +1784,25 @@ ENTRY(nmi)
+@@ -1495,11 +1848,25 @@ ENTRY(nmi)
  	DISABLE_INTERRUPTS(CLBR_NONE)
  	testl %ebx,%ebx				/* swapgs needed? */
  	jnz nmi_restore
@@ -11903,19 +13131,39 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/entry_64.S linux-2.6.38.2/arch/x86/ker
  	RESTORE_ALL 8
  	jmp irq_return
  nmi_userspace:
-diff -urNp linux-2.6.38.2/arch/x86/kernel/ftrace.c linux-2.6.38.2/arch/x86/kernel/ftrace.c
---- linux-2.6.38.2/arch/x86/kernel/ftrace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/ftrace.c	2011-03-21 18:31:35.000000000 -0400
-@@ -177,7 +177,9 @@ void ftrace_nmi_enter(void)
+diff -urNp linux-2.6.38.7/arch/x86/kernel/ftrace.c linux-2.6.38.7/arch/x86/kernel/ftrace.c
+--- linux-2.6.38.7/arch/x86/kernel/ftrace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/ftrace.c	2011-04-28 19:57:25.000000000 -0400
+@@ -126,7 +126,7 @@ static void *mod_code_ip;		/* holds the 
+ static void *mod_code_newcode;		/* holds the text to write to the IP */
+ 
+ static unsigned nmi_wait_count;
+-static atomic_t nmi_update_count = ATOMIC_INIT(0);
++static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
+ 
+ int ftrace_arch_read_dyn_info(char *buf, int size)
+ {
+@@ -134,7 +134,7 @@ int ftrace_arch_read_dyn_info(char *buf,
+ 
+ 	r = snprintf(buf, size, "%u %u",
+ 		     nmi_wait_count,
+-		     atomic_read(&nmi_update_count));
++		     atomic_read_unchecked(&nmi_update_count));
+ 	return r;
+ }
+ 
+@@ -177,8 +177,10 @@ void ftrace_nmi_enter(void)
  
  	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
  		smp_rmb();
 +		pax_open_kernel();
  		ftrace_mod_code();
+-		atomic_inc(&nmi_update_count);
 +		pax_close_kernel();
- 		atomic_inc(&nmi_update_count);
++		atomic_inc_unchecked(&nmi_update_count);
  	}
  	/* Must have previous changes seen before executions */
+ 	smp_mb();
 @@ -271,6 +273,8 @@ ftrace_modify_code(unsigned long ip, uns
  {
  	unsigned char replaced[MCOUNT_INSN_SIZE];
@@ -11943,9 +13191,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ftrace.c linux-2.6.38.2/arch/x86/kerne
  	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
  		return -EFAULT;
  
-diff -urNp linux-2.6.38.2/arch/x86/kernel/head32.c linux-2.6.38.2/arch/x86/kernel/head32.c
---- linux-2.6.38.2/arch/x86/kernel/head32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/head32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/head32.c linux-2.6.38.7/arch/x86/kernel/head32.c
+--- linux-2.6.38.7/arch/x86/kernel/head32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/head32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -19,6 +19,7 @@
  #include <asm/io_apic.h>
  #include <asm/bios_ebda.h>
@@ -11963,9 +13211,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head32.c linux-2.6.38.2/arch/x86/kerne
  
  #ifdef CONFIG_BLK_DEV_INITRD
  	/* Reserve INITRD */
-diff -urNp linux-2.6.38.2/arch/x86/kernel/head_32.S linux-2.6.38.2/arch/x86/kernel/head_32.S
---- linux-2.6.38.2/arch/x86/kernel/head_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/head_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/head_32.S linux-2.6.38.7/arch/x86/kernel/head_32.S
+--- linux-2.6.38.7/arch/x86/kernel/head_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/head_32.S	2011-05-11 18:34:57.000000000 -0400
 @@ -25,6 +25,12 @@
  /* Physical address */
  #define pa(X) ((X) - __PAGE_OFFSET)
@@ -12124,10 +13372,10 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head_32.S linux-2.6.38.2/arch/x86/kern
 -	.long lguest_entry		/* lguest hypervisor */
 -	.long xen_entry			/* Xen hypervisor */
 -	.long default_entry		/* Moorestown MID */
-+	.long pa(default_entry)		/* normal x86/PC */
-+	.long pa(lguest_entry)		/* lguest hypervisor */
-+	.long pa(xen_entry)		/* Xen hypervisor */
-+	.long pa(default_entry)		/* Moorestown MID */
++	.long ta(default_entry)		/* normal x86/PC */
++	.long ta(lguest_entry)		/* lguest hypervisor */
++	.long ta(xen_entry)		/* Xen hypervisor */
++	.long ta(default_entry)		/* Moorestown MID */
  num_subarch_entries = (. - subarch_entries) / 4
  .previous
  #else
@@ -12283,7 +13531,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head_32.S linux-2.6.38.2/arch/x86/kern
  ENTRY(initial_page_table)
  	.long	pa(initial_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
  # if KPMDS == 3
-@@ -663,13 +758,22 @@ ENTRY(initial_page_table)
+@@ -663,18 +758,27 @@ ENTRY(initial_page_table)
  #  error "Kernel PMDs should be 1, 2 or 3"
  # endif
  	.align PAGE_SIZE_asm		/* needs to be page-sized too */
@@ -12302,11 +13550,18 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head_32.S linux-2.6.38.2/arch/x86/kern
  ENTRY(stack_start)
 -	.long init_thread_union+THREAD_SIZE
 +	.long init_thread_union+THREAD_SIZE-8
++
++ready:	.byte 0
  
 +.section .rodata,"a",@progbits
  early_recursion_flag:
  	.long 0
  
+-ready:	.byte 0
+-
+ int_msg:
+ 	.asciz "Unknown interrupt or fault at: %p %p %p\n"
+ 
 @@ -707,7 +811,7 @@ fault_msg:
  	.word 0				# 32 bit align gdt_desc.address
  boot_gdt_descr:
@@ -12393,9 +13648,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head_32.S linux-2.6.38.2/arch/x86/kern
 +	/* Be sure this is zeroed to avoid false validations in Xen */
 +	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
 +	.endr
-diff -urNp linux-2.6.38.2/arch/x86/kernel/head_64.S linux-2.6.38.2/arch/x86/kernel/head_64.S
---- linux-2.6.38.2/arch/x86/kernel/head_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/head_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/head_64.S linux-2.6.38.7/arch/x86/kernel/head_64.S
+--- linux-2.6.38.7/arch/x86/kernel/head_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/head_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -19,6 +19,7 @@
  #include <asm/cache.h>
  #include <asm/processor-flags.h>
@@ -12665,9 +13920,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/head_64.S linux-2.6.38.2/arch/x86/kern
  
  	__PAGE_ALIGNED_BSS
  	.align PAGE_SIZE
-diff -urNp linux-2.6.38.2/arch/x86/kernel/i386_ksyms_32.c linux-2.6.38.2/arch/x86/kernel/i386_ksyms_32.c
---- linux-2.6.38.2/arch/x86/kernel/i386_ksyms_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/i386_ksyms_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/i386_ksyms_32.c linux-2.6.38.7/arch/x86/kernel/i386_ksyms_32.c
+--- linux-2.6.38.7/arch/x86/kernel/i386_ksyms_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/i386_ksyms_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -20,8 +20,12 @@ extern void cmpxchg8b_emu(void);
  EXPORT_SYMBOL(cmpxchg8b_emu);
  #endif
@@ -12689,10 +13944,32 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/i386_ksyms_32.c linux-2.6.38.2/arch/x8
 +#ifdef CONFIG_PAX_KERNEXEC
 +EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
 +#endif
-diff -urNp linux-2.6.38.2/arch/x86/kernel/init_task.c linux-2.6.38.2/arch/x86/kernel/init_task.c
---- linux-2.6.38.2/arch/x86/kernel/init_task.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/init_task.c	2011-03-21 18:31:35.000000000 -0400
-@@ -38,5 +38,5 @@ EXPORT_SYMBOL(init_task);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/i8259.c linux-2.6.38.7/arch/x86/kernel/i8259.c
+--- linux-2.6.38.7/arch/x86/kernel/i8259.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/i8259.c	2011-04-28 19:57:25.000000000 -0400
+@@ -210,7 +210,7 @@ spurious_8259A_irq:
+ 			       "spurious 8259A interrupt: IRQ%d.\n", irq);
+ 			spurious_irq_mask |= irqmask;
+ 		}
+-		atomic_inc(&irq_err_count);
++		atomic_inc_unchecked(&irq_err_count);
+ 		/*
+ 		 * Theoretically we do not have to handle this IRQ,
+ 		 * but in Linux this does not cause problems and is
+diff -urNp linux-2.6.38.7/arch/x86/kernel/init_task.c linux-2.6.38.7/arch/x86/kernel/init_task.c
+--- linux-2.6.38.7/arch/x86/kernel/init_task.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/init_task.c	2011-04-28 19:34:14.000000000 -0400
+@@ -20,8 +20,7 @@ static struct sighand_struct init_sighan
+  * way process stacks are handled. This is done by having a special
+  * "init_task" linker map entry..
+  */
+-union thread_union init_thread_union __init_task_data =
+-	{ INIT_THREAD_INFO(init_task) };
++union thread_union init_thread_union __init_task_data;
+ 
+ /*
+  * Initial task structure.
+@@ -38,5 +37,5 @@ EXPORT_SYMBOL(init_task);
   * section. Since TSS's are completely CPU-local, we want them
   * on exact cacheline boundaries, to eliminate cacheline ping-pong.
   */
@@ -12700,9 +13977,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/init_task.c linux-2.6.38.2/arch/x86/ke
 -
 +struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
 +EXPORT_SYMBOL(init_tss);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/ioport.c linux-2.6.38.2/arch/x86/kernel/ioport.c
---- linux-2.6.38.2/arch/x86/kernel/ioport.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/ioport.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/ioport.c linux-2.6.38.7/arch/x86/kernel/ioport.c
+--- linux-2.6.38.7/arch/x86/kernel/ioport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/ioport.c	2011-04-28 19:34:14.000000000 -0400
 @@ -6,6 +6,7 @@
  #include <linux/sched.h>
  #include <linux/kernel.h>
@@ -12746,64 +14023,190 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ioport.c linux-2.6.38.2/arch/x86/kerne
  		if (!capable(CAP_SYS_RAWIO))
  			return -EPERM;
  	}
-diff -urNp linux-2.6.38.2/arch/x86/kernel/irq_32.c linux-2.6.38.2/arch/x86/kernel/irq_32.c
---- linux-2.6.38.2/arch/x86/kernel/irq_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/irq_32.c	2011-03-21 18:31:35.000000000 -0400
-@@ -91,7 +91,7 @@ execute_on_irq_stack(int overflow, struc
+diff -urNp linux-2.6.38.7/arch/x86/kernel/irq_32.c linux-2.6.38.7/arch/x86/kernel/irq_32.c
+--- linux-2.6.38.7/arch/x86/kernel/irq_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/irq_32.c	2011-04-28 19:34:14.000000000 -0400
+@@ -36,7 +36,7 @@ static int check_stack_overflow(void)
+ 	__asm__ __volatile__("andl %%esp,%0" :
+ 			     "=r" (sp) : "0" (THREAD_SIZE - 1));
+ 
+-	return sp < (sizeof(struct thread_info) + STACK_WARN);
++	return sp < STACK_WARN;
+ }
+ 
+ static void print_stack_overflow(void)
+@@ -54,8 +54,8 @@ static inline void print_stack_overflow(
+  * per-CPU IRQ handling contexts (thread information and stack)
+  */
+ union irq_ctx {
+-	struct thread_info      tinfo;
+-	u32                     stack[THREAD_SIZE/sizeof(u32)];
++	unsigned long		previous_esp;
++	u32			stack[THREAD_SIZE/sizeof(u32)];
+ } __attribute__((aligned(THREAD_SIZE)));
+ 
+ static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
+@@ -75,10 +75,9 @@ static void call_on_stack(void *func, vo
+ static inline int
+ execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
+ {
+-	union irq_ctx *curctx, *irqctx;
++	union irq_ctx *irqctx;
+ 	u32 *isp, arg1, arg2;
+ 
+-	curctx = (union irq_ctx *) current_thread_info();
+ 	irqctx = __this_cpu_read(hardirq_ctx);
+ 
+ 	/*
+@@ -87,21 +86,17 @@ execute_on_irq_stack(int overflow, struc
+ 	 * handler) we can't do that and just have to keep using the
+ 	 * current stack (which is the irq stack already after all)
+ 	 */
+-	if (unlikely(curctx == irqctx))
++	if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
  		return 0;
  
  	/* build the stack frame on the IRQ stack */
 -	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
+-	irqctx->tinfo.task = curctx->tinfo.task;
+-	irqctx->tinfo.previous_esp = current_stack_pointer;
 +	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
- 	irqctx->tinfo.task = curctx->tinfo.task;
- 	irqctx->tinfo.previous_esp = current_stack_pointer;
- 
-@@ -103,6 +103,10 @@ execute_on_irq_stack(int overflow, struc
- 		(irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
- 		(curctx->tinfo.preempt_count & SOFTIRQ_MASK);
++	irqctx->previous_esp = current_stack_pointer;
++	add_preempt_count(HARDIRQ_OFFSET);
  
+-	/*
+-	 * Copy the softirq bits in preempt_count so that the
+-	 * softirq checks work in the hardirq context.
+-	 */
+-	irqctx->tinfo.preempt_count =
+-		(irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
+-		(curctx->tinfo.preempt_count & SOFTIRQ_MASK);
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	__set_fs(irqctx->tinfo.addr_limit);
++	__set_fs(MAKE_MM_SEG(0));
 +#endif
-+
+ 
  	if (unlikely(overflow))
  		call_on_stack(print_stack_overflow, isp);
- 
-@@ -113,6 +117,11 @@ execute_on_irq_stack(int overflow, struc
+@@ -113,6 +108,12 @@ execute_on_irq_stack(int overflow, struc
  		     :  "0" (irq),   "1" (desc),  "2" (isp),
  			"D" (desc->handle_irq)
  		     : "memory", "cc", "ecx");
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+	__set_fs(curctx->tinfo.addr_limit);
++	__set_fs(current_thread_info()->addr_limit);
 +#endif
 +
++	sub_preempt_count(HARDIRQ_OFFSET);
  	return 1;
  }
  
-@@ -168,9 +177,18 @@ asmlinkage void do_softirq(void)
- 		irqctx->tinfo.previous_esp = current_stack_pointer;
+@@ -121,29 +122,11 @@ execute_on_irq_stack(int overflow, struc
+  */
+ void __cpuinit irq_ctx_init(int cpu)
+ {
+-	union irq_ctx *irqctx;
+-
+ 	if (per_cpu(hardirq_ctx, cpu))
+ 		return;
+ 
+-	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+-					       THREAD_FLAGS,
+-					       THREAD_ORDER));
+-	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+-	irqctx->tinfo.cpu		= cpu;
+-	irqctx->tinfo.preempt_count	= HARDIRQ_OFFSET;
+-	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+-
+-	per_cpu(hardirq_ctx, cpu) = irqctx;
+-
+-	irqctx = page_address(alloc_pages_node(cpu_to_node(cpu),
+-					       THREAD_FLAGS,
+-					       THREAD_ORDER));
+-	memset(&irqctx->tinfo, 0, sizeof(struct thread_info));
+-	irqctx->tinfo.cpu		= cpu;
+-	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
+-
+-	per_cpu(softirq_ctx, cpu) = irqctx;
++	per_cpu(hardirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
++	per_cpu(softirq_ctx, cpu) = page_address(alloc_pages_node(cpu_to_node(cpu), THREAD_FLAGS, THREAD_ORDER));
+ 
+ 	printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
+ 	       cpu, per_cpu(hardirq_ctx, cpu),  per_cpu(softirq_ctx, cpu));
+@@ -152,7 +135,6 @@ void __cpuinit irq_ctx_init(int cpu)
+ asmlinkage void do_softirq(void)
+ {
+ 	unsigned long flags;
+-	struct thread_info *curctx;
+ 	union irq_ctx *irqctx;
+ 	u32 *isp;
+ 
+@@ -162,15 +144,22 @@ asmlinkage void do_softirq(void)
+ 	local_irq_save(flags);
+ 
+ 	if (local_softirq_pending()) {
+-		curctx = current_thread_info();
+ 		irqctx = __this_cpu_read(softirq_ctx);
+-		irqctx->tinfo.task = curctx->task;
+-		irqctx->tinfo.previous_esp = current_stack_pointer;
++		irqctx->previous_esp = current_stack_pointer;
  
  		/* build the stack frame on the softirq stack */
 -		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
 +		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		__set_fs(irqctx->tinfo.addr_limit);
++		__set_fs(MAKE_MM_SEG(0));
 +#endif
  
  		call_on_stack(__do_softirq, isp);
 +
 +#ifdef CONFIG_PAX_MEMORY_UDEREF
-+		__set_fs(curctx->addr_limit);
++		__set_fs(current_thread_info()->addr_limit);
 +#endif
 +
  		/*
  		 * Shouldnt happen, we returned above if in_interrupt():
  		 */
-diff -urNp linux-2.6.38.2/arch/x86/kernel/kgdb.c linux-2.6.38.2/arch/x86/kernel/kgdb.c
---- linux-2.6.38.2/arch/x86/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/kgdb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/irq.c linux-2.6.38.7/arch/x86/kernel/irq.c
+--- linux-2.6.38.7/arch/x86/kernel/irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -16,7 +16,7 @@
+ #include <asm/mce.h>
+ #include <asm/hw_irq.h>
+ 
+-atomic_t irq_err_count;
++atomic_unchecked_t irq_err_count;
+ 
+ /* Function pointer for generic interrupt vector handling */
+ void (*x86_platform_ipi_callback)(void) = NULL;
+@@ -115,9 +115,9 @@ static int show_other_interrupts(struct 
+ 		seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
+ 	seq_printf(p, "  Machine check polls\n");
+ #endif
+-	seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
++	seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
+ #if defined(CONFIG_X86_IO_APIC)
+-	seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
++	seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
+ #endif
+ 	return 0;
+ }
+@@ -210,10 +210,10 @@ u64 arch_irq_stat_cpu(unsigned int cpu)
+ 
+ u64 arch_irq_stat(void)
+ {
+-	u64 sum = atomic_read(&irq_err_count);
++	u64 sum = atomic_read_unchecked(&irq_err_count);
+ 
+ #ifdef CONFIG_X86_IO_APIC
+-	sum += atomic_read(&irq_mis_count);
++	sum += atomic_read_unchecked(&irq_mis_count);
+ #endif
+ 	return sum;
+ }
+diff -urNp linux-2.6.38.7/arch/x86/kernel/kgdb.c linux-2.6.38.7/arch/x86/kernel/kgdb.c
+--- linux-2.6.38.7/arch/x86/kernel/kgdb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/kgdb.c	2011-04-28 19:57:25.000000000 -0400
 @@ -124,11 +124,11 @@ char *dbg_get_reg(int regno, void *mem, 
  	switch (regno) {
  #ifdef CONFIG_X86_32
@@ -12818,6 +14221,30 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/kgdb.c linux-2.6.38.2/arch/x86/kernel/
  			*(unsigned long *)mem = kernel_stack_pointer(regs);
  		break;
  	case GDB_GS:
+@@ -473,12 +473,12 @@ int kgdb_arch_handle_exception(int e_vec
+ 	case 'k':
+ 		/* clear the trace bit */
+ 		linux_regs->flags &= ~X86_EFLAGS_TF;
+-		atomic_set(&kgdb_cpu_doing_single_step, -1);
++		atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
+ 
+ 		/* set the trace bit if we're stepping */
+ 		if (remcomInBuffer[0] == 's') {
+ 			linux_regs->flags |= X86_EFLAGS_TF;
+-			atomic_set(&kgdb_cpu_doing_single_step,
++			atomic_set_unchecked(&kgdb_cpu_doing_single_step,
+ 				   raw_smp_processor_id());
+ 		}
+ 
+@@ -543,7 +543,7 @@ static int __kgdb_notify(struct die_args
+ 		break;
+ 
+ 	case DIE_DEBUG:
+-		if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
++		if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
+ 			if (user_mode(regs))
+ 				return single_step_cont(regs, args);
+ 			break;
 @@ -719,7 +719,7 @@ void kgdb_arch_set_pc(struct pt_regs *re
  	regs->ip = ip;
  }
@@ -12827,9 +14254,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/kgdb.c linux-2.6.38.2/arch/x86/kernel/
  	/* Breakpoint instruction: */
  	.gdb_bpt_instr		= { 0xcc },
  	.flags			= KGDB_HW_BREAKPOINT,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/kprobes.c linux-2.6.38.2/arch/x86/kernel/kprobes.c
---- linux-2.6.38.2/arch/x86/kernel/kprobes.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/kprobes.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/kprobes.c linux-2.6.38.7/arch/x86/kernel/kprobes.c
+--- linux-2.6.38.7/arch/x86/kernel/kprobes.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/kprobes.c	2011-04-28 19:34:14.000000000 -0400
 @@ -115,8 +115,11 @@ static void __kprobes __synthesize_relat
  	} __attribute__((packed)) *insn;
  
@@ -12963,9 +14390,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/kprobes.c linux-2.6.38.2/arch/x86/kern
  	       RELATIVE_ADDR_SIZE);
  
  	insn_buf[0] = RELATIVEJUMP_OPCODE;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/ldt.c linux-2.6.38.2/arch/x86/kernel/ldt.c
---- linux-2.6.38.2/arch/x86/kernel/ldt.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/ldt.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/ldt.c linux-2.6.38.7/arch/x86/kernel/ldt.c
+--- linux-2.6.38.7/arch/x86/kernel/ldt.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/ldt.c	2011-04-28 19:34:14.000000000 -0400
 @@ -67,13 +67,13 @@ static int alloc_ldt(mm_context_t *pc, i
  	if (reload) {
  #ifdef CONFIG_SMP
@@ -13030,9 +14457,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ldt.c linux-2.6.38.2/arch/x86/kernel/l
  	fill_ldt(&ldt, &ldt_info);
  	if (oldmode)
  		ldt.avl = 0;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/machine_kexec_32.c linux-2.6.38.2/arch/x86/kernel/machine_kexec_32.c
---- linux-2.6.38.2/arch/x86/kernel/machine_kexec_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/machine_kexec_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/machine_kexec_32.c linux-2.6.38.7/arch/x86/kernel/machine_kexec_32.c
+--- linux-2.6.38.7/arch/x86/kernel/machine_kexec_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/machine_kexec_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -27,7 +27,7 @@
  #include <asm/cacheflush.h>
  #include <asm/debugreg.h>
@@ -13060,9 +14487,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/machine_kexec_32.c linux-2.6.38.2/arch
  
  	relocate_kernel_ptr = control_page;
  	page_list[PA_CONTROL_PAGE] = __pa(control_page);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_amd.c linux-2.6.38.2/arch/x86/kernel/microcode_amd.c
---- linux-2.6.38.2/arch/x86/kernel/microcode_amd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/microcode_amd.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/microcode_amd.c linux-2.6.38.7/arch/x86/kernel/microcode_amd.c
+--- linux-2.6.38.7/arch/x86/kernel/microcode_amd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/microcode_amd.c	2011-04-28 19:34:14.000000000 -0400
 @@ -317,7 +317,7 @@ static void microcode_fini_cpu_amd(int c
  	uci->mc = NULL;
  }
@@ -13081,9 +14508,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_amd.c linux-2.6.38.2/arch/x8
  {
  	return &microcode_amd_ops;
  }
-diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_core.c linux-2.6.38.2/arch/x86/kernel/microcode_core.c
---- linux-2.6.38.2/arch/x86/kernel/microcode_core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/microcode_core.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/microcode_core.c linux-2.6.38.7/arch/x86/kernel/microcode_core.c
+--- linux-2.6.38.7/arch/x86/kernel/microcode_core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/microcode_core.c	2011-04-28 19:34:14.000000000 -0400
 @@ -92,7 +92,7 @@ MODULE_LICENSE("GPL");
  
  #define MICROCODE_VERSION	"2.00"
@@ -13093,9 +14520,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_core.c linux-2.6.38.2/arch/x
  
  /*
   * Synchronization.
-diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_intel.c linux-2.6.38.2/arch/x86/kernel/microcode_intel.c
---- linux-2.6.38.2/arch/x86/kernel/microcode_intel.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/microcode_intel.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/microcode_intel.c linux-2.6.38.7/arch/x86/kernel/microcode_intel.c
+--- linux-2.6.38.7/arch/x86/kernel/microcode_intel.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/microcode_intel.c	2011-04-28 19:34:14.000000000 -0400
 @@ -440,13 +440,13 @@ static enum ucode_state request_microcod
  
  static int get_ucode_user(void *to, const void *from, size_t n)
@@ -13130,9 +14557,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/microcode_intel.c linux-2.6.38.2/arch/
  {
  	return &microcode_intel_ops;
  }
-diff -urNp linux-2.6.38.2/arch/x86/kernel/module.c linux-2.6.38.2/arch/x86/kernel/module.c
---- linux-2.6.38.2/arch/x86/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/module.c linux-2.6.38.7/arch/x86/kernel/module.c
+--- linux-2.6.38.7/arch/x86/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/module.c	2011-04-28 19:34:14.000000000 -0400
 @@ -35,21 +35,66 @@
  #define DEBUGP(fmt...)
  #endif
@@ -13271,9 +14698,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/module.c linux-2.6.38.2/arch/x86/kerne
  #if 0
  			if ((s64)val != *(s32 *)loc)
  				goto overflow;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/kernel/paravirt.c
---- linux-2.6.38.2/arch/x86/kernel/paravirt.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/paravirt.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/paravirt.c linux-2.6.38.7/arch/x86/kernel/paravirt.c
+--- linux-2.6.38.7/arch/x86/kernel/paravirt.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/paravirt.c	2011-05-16 21:47:08.000000000 -0400
 @@ -122,7 +122,7 @@ unsigned paravirt_patch_jmp(void *insnbu
   * corresponding structure. */
  static void *get_call_destination(u8 type)
@@ -13283,7 +14710,17 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  		.pv_init_ops = pv_init_ops,
  		.pv_time_ops = pv_time_ops,
  		.pv_cpu_ops = pv_cpu_ops,
-@@ -145,14 +145,14 @@ unsigned paravirt_patch_default(u8 type,
+@@ -133,6 +133,9 @@ static void *get_call_destination(u8 typ
+ 		.pv_lock_ops = pv_lock_ops,
+ #endif
+ 	};
++
++	pax_track_stack();
++
+ 	return *((void **)&tmpl + type);
+ }
+ 
+@@ -145,14 +148,14 @@ unsigned paravirt_patch_default(u8 type,
  	if (opfunc == NULL)
  		/* If there's no function, patch it with a ud2a (BUG) */
  		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
@@ -13301,7 +14738,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  		ret = paravirt_patch_ident_64(insnbuf, len);
  
  	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
-@@ -178,7 +178,7 @@ unsigned paravirt_patch_insns(void *insn
+@@ -178,7 +181,7 @@ unsigned paravirt_patch_insns(void *insn
  	if (insn_len > len || start == NULL)
  		insn_len = len;
  	else
@@ -13310,7 +14747,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  
  	return insn_len;
  }
-@@ -294,22 +294,22 @@ void arch_flush_lazy_mmu_mode(void)
+@@ -294,22 +297,22 @@ void arch_flush_lazy_mmu_mode(void)
  	preempt_enable();
  }
  
@@ -13337,7 +14774,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
  	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
  	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
-@@ -321,7 +321,7 @@ struct pv_irq_ops pv_irq_ops = {
+@@ -321,7 +324,7 @@ struct pv_irq_ops pv_irq_ops = {
  #endif
  };
  
@@ -13346,7 +14783,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  	.cpuid = native_cpuid,
  	.get_debugreg = native_get_debugreg,
  	.set_debugreg = native_set_debugreg,
-@@ -382,7 +382,7 @@ struct pv_cpu_ops pv_cpu_ops = {
+@@ -382,7 +385,7 @@ struct pv_cpu_ops pv_cpu_ops = {
  	.end_context_switch = paravirt_nop,
  };
  
@@ -13355,7 +14792,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  #ifdef CONFIG_X86_LOCAL_APIC
  	.startup_ipi_hook = paravirt_nop,
  #endif
-@@ -396,7 +396,7 @@ struct pv_apic_ops pv_apic_ops = {
+@@ -396,7 +399,7 @@ struct pv_apic_ops pv_apic_ops = {
  #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
  #endif
  
@@ -13364,7 +14801,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  
  	.read_cr2 = native_read_cr2,
  	.write_cr2 = native_write_cr2,
-@@ -465,6 +465,12 @@ struct pv_mmu_ops pv_mmu_ops = {
+@@ -465,6 +468,12 @@ struct pv_mmu_ops pv_mmu_ops = {
  	},
  
  	.set_fixmap = native_set_fixmap,
@@ -13377,9 +14814,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt.c linux-2.6.38.2/arch/x86/ker
  };
  
  EXPORT_SYMBOL_GPL(pv_time_ops);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.38.2/arch/x86/kernel/paravirt-spinlocks.c
---- linux-2.6.38.2/arch/x86/kernel/paravirt-spinlocks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/paravirt-spinlocks.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.38.7/arch/x86/kernel/paravirt-spinlocks.c
+--- linux-2.6.38.7/arch/x86/kernel/paravirt-spinlocks.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/paravirt-spinlocks.c	2011-04-28 19:34:14.000000000 -0400
 @@ -13,7 +13,7 @@ default_spin_lock_flags(arch_spinlock_t 
  	arch_spin_lock(lock);
  }
@@ -13389,9 +14826,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.38.2/ar
  #ifdef CONFIG_SMP
  	.spin_is_locked = __ticket_spin_is_locked,
  	.spin_is_contended = __ticket_spin_is_contended,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-calgary_64.c linux-2.6.38.2/arch/x86/kernel/pci-calgary_64.c
---- linux-2.6.38.2/arch/x86/kernel/pci-calgary_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/pci-calgary_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-calgary_64.c linux-2.6.38.7/arch/x86/kernel/pci-calgary_64.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-calgary_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-calgary_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -476,7 +476,7 @@ static void calgary_free_coherent(struct
  	free_pages((unsigned long)vaddr, get_order(size));
  }
@@ -13401,9 +14838,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-calgary_64.c linux-2.6.38.2/arch/x
  	.alloc_coherent = calgary_alloc_coherent,
  	.free_coherent = calgary_free_coherent,
  	.map_sg = calgary_map_sg,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-dma.c linux-2.6.38.2/arch/x86/kernel/pci-dma.c
---- linux-2.6.38.2/arch/x86/kernel/pci-dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/pci-dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-dma.c linux-2.6.38.7/arch/x86/kernel/pci-dma.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-dma.c	2011-04-28 19:34:14.000000000 -0400
 @@ -16,7 +16,7 @@
  
  static int forbid_dac __read_mostly;
@@ -13422,10 +14859,10 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-dma.c linux-2.6.38.2/arch/x86/kern
  
  #ifdef CONFIG_PCI
  	if (mask > 0xffffffff && forbid_dac > 0) {
-diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-gart_64.c linux-2.6.38.2/arch/x86/kernel/pci-gart_64.c
---- linux-2.6.38.2/arch/x86/kernel/pci-gart_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/pci-gart_64.c	2011-03-21 18:31:35.000000000 -0400
-@@ -706,7 +706,7 @@ static __init int init_amd_gatt(struct a
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-gart_64.c linux-2.6.38.7/arch/x86/kernel/pci-gart_64.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-gart_64.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-gart_64.c	2011-05-10 22:06:52.000000000 -0400
+@@ -713,7 +713,7 @@ static __init int init_amd_gatt(struct a
  	return -1;
  }
  
@@ -13434,9 +14871,30 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-gart_64.c linux-2.6.38.2/arch/x86/
  	.map_sg				= gart_map_sg,
  	.unmap_sg			= gart_unmap_sg,
  	.map_page			= gart_map_page,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-nommu.c linux-2.6.38.2/arch/x86/kernel/pci-nommu.c
---- linux-2.6.38.2/arch/x86/kernel/pci-nommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/pci-nommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-iommu_table.c linux-2.6.38.7/arch/x86/kernel/pci-iommu_table.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-iommu_table.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-iommu_table.c	2011-05-16 21:47:08.000000000 -0400
+@@ -2,7 +2,7 @@
+ #include <asm/iommu_table.h>
+ #include <linux/string.h>
+ #include <linux/kallsyms.h>
+-
++#include <linux/sched.h>
+ 
+ #define DEBUG 1
+ 
+@@ -53,6 +53,8 @@ void __init check_iommu_entries(struct i
+ 	char sym_p[KSYM_SYMBOL_LEN];
+ 	char sym_q[KSYM_SYMBOL_LEN];
+ 
++	pax_track_stack();
++
+ 	/* Simple cyclic dependency checker. */
+ 	for (p = start; p < finish; p++) {
+ 		q = find_dependents_of(start, finish, p);
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-nommu.c linux-2.6.38.7/arch/x86/kernel/pci-nommu.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-nommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-nommu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -95,7 +95,7 @@ static void nommu_sync_sg_for_device(str
  	flush_write_buffers();
  }
@@ -13446,9 +14904,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-nommu.c linux-2.6.38.2/arch/x86/ke
  	.alloc_coherent		= dma_generic_alloc_coherent,
  	.free_coherent		= nommu_free_coherent,
  	.map_sg			= nommu_map_sg,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-swiotlb.c linux-2.6.38.2/arch/x86/kernel/pci-swiotlb.c
---- linux-2.6.38.2/arch/x86/kernel/pci-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/pci-swiotlb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pci-swiotlb.c linux-2.6.38.7/arch/x86/kernel/pci-swiotlb.c
+--- linux-2.6.38.7/arch/x86/kernel/pci-swiotlb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pci-swiotlb.c	2011-04-28 19:34:14.000000000 -0400
 @@ -26,7 +26,7 @@ static void *x86_swiotlb_alloc_coherent(
  	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
  }
@@ -13458,9 +14916,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/pci-swiotlb.c linux-2.6.38.2/arch/x86/
  	.mapping_error = swiotlb_dma_mapping_error,
  	.alloc_coherent = x86_swiotlb_alloc_coherent,
  	.free_coherent = swiotlb_free_coherent,
-diff -urNp linux-2.6.38.2/arch/x86/kernel/process_32.c linux-2.6.38.2/arch/x86/kernel/process_32.c
---- linux-2.6.38.2/arch/x86/kernel/process_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/process_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/process_32.c linux-2.6.38.7/arch/x86/kernel/process_32.c
+--- linux-2.6.38.7/arch/x86/kernel/process_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/process_32.c	2011-05-16 21:47:08.000000000 -0400
 @@ -65,6 +65,7 @@ asmlinkage void ret_from_fork(void) __as
  unsigned long thread_saved_pc(struct task_struct *tsk)
  {
@@ -13487,7 +14945,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_32.c linux-2.6.38.2/arch/x86/k
  
  	show_regs_common();
  
-@@ -196,7 +196,7 @@ int copy_thread(unsigned long clone_flag
+@@ -196,13 +196,14 @@ int copy_thread(unsigned long clone_flag
  	struct task_struct *tsk;
  	int err;
  
@@ -13496,7 +14954,14 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_32.c linux-2.6.38.2/arch/x86/k
  	*childregs = *regs;
  	childregs->ax = 0;
  	childregs->sp = sp;
-@@ -293,7 +293,7 @@ __switch_to(struct task_struct *prev_p, 
+ 
+ 	p->thread.sp = (unsigned long) childregs;
+ 	p->thread.sp0 = (unsigned long) (childregs+1);
++	p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
+ 
+ 	p->thread.ip = (unsigned long) ret_from_fork;
+ 
+@@ -293,7 +294,7 @@ __switch_to(struct task_struct *prev_p, 
  	struct thread_struct *prev = &prev_p->thread,
  				 *next = &next_p->thread;
  	int cpu = smp_processor_id();
@@ -13505,7 +14970,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_32.c linux-2.6.38.2/arch/x86/k
  	bool preload_fpu;
  
  	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
-@@ -328,6 +328,10 @@ __switch_to(struct task_struct *prev_p, 
+@@ -328,6 +329,10 @@ __switch_to(struct task_struct *prev_p, 
  	 */
  	lazy_save_gs(prev->gs);
  
@@ -13516,37 +14981,33 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_32.c linux-2.6.38.2/arch/x86/k
  	/*
  	 * Load the per-thread Thread-Local Storage descriptor.
  	 */
-@@ -404,3 +408,27 @@ unsigned long get_wchan(struct task_stru
- 	return 0;
- }
+@@ -363,6 +368,9 @@ __switch_to(struct task_struct *prev_p, 
+ 	 */
+ 	arch_end_context_switch(next_p);
  
-+#ifdef CONFIG_PAX_RANDKSTACK
-+asmlinkage void pax_randomize_kstack(void)
-+{
-+	struct thread_struct *thread = &current->thread;
-+	unsigned long time;
-+
-+	if (!randomize_va_space)
-+		return;
-+
-+	rdtscl(time);
-+
-+	/* P4 seems to return a 0 LSB, ignore it */
-+#ifdef CONFIG_MPENTIUM4
-+	time &= 0x1EUL;
-+	time <<= 2;
-+#else
-+	time &= 0xFUL;
-+	time <<= 3;
-+#endif
++	percpu_write(current_task, next_p);
++	percpu_write(current_tinfo, &next_p->tinfo);
 +
-+	thread->sp0 ^= time;
-+	load_sp0(init_tss + smp_processor_id(), thread);
-+}
-+#endif
-diff -urNp linux-2.6.38.2/arch/x86/kernel/process_64.c linux-2.6.38.2/arch/x86/kernel/process_64.c
---- linux-2.6.38.2/arch/x86/kernel/process_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/process_64.c	2011-03-21 18:31:35.000000000 -0400
+ 	if (preload_fpu)
+ 		__math_state_restore();
+ 
+@@ -372,8 +380,6 @@ __switch_to(struct task_struct *prev_p, 
+ 	if (prev->gs | next->gs)
+ 		lazy_load_gs(next->gs);
+ 
+-	percpu_write(current_task, next_p);
+-
+ 	return prev_p;
+ }
+ 
+@@ -403,4 +409,3 @@ unsigned long get_wchan(struct task_stru
+ 	} while (count++ < 16);
+ 	return 0;
+ }
+-
+diff -urNp linux-2.6.38.7/arch/x86/kernel/process_64.c linux-2.6.38.7/arch/x86/kernel/process_64.c
+--- linux-2.6.38.7/arch/x86/kernel/process_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/process_64.c	2011-05-16 21:47:08.000000000 -0400
 @@ -87,7 +87,7 @@ static void __exit_idle(void)
  void exit_idle(void)
  {
@@ -13556,6 +15017,24 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_64.c linux-2.6.38.2/arch/x86/k
  		return;
  	__exit_idle();
  }
+@@ -260,8 +260,7 @@ int copy_thread(unsigned long clone_flag
+ 	struct pt_regs *childregs;
+ 	struct task_struct *me = current;
+ 
+-	childregs = ((struct pt_regs *)
+-			(THREAD_SIZE + task_stack_page(p))) - 1;
++	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
+ 	*childregs = *regs;
+ 
+ 	childregs->ax = 0;
+@@ -273,6 +272,7 @@ int copy_thread(unsigned long clone_flag
+ 	p->thread.sp = (unsigned long) childregs;
+ 	p->thread.sp0 = (unsigned long) (childregs+1);
+ 	p->thread.usersp = me->thread.usersp;
++	p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
+ 
+ 	set_tsk_thread_flag(p, TIF_FORK);
+ 
 @@ -376,7 +376,7 @@ __switch_to(struct task_struct *prev_p, 
  	struct thread_struct *prev = &prev_p->thread;
  	struct thread_struct *next = &next_p->thread;
@@ -13565,25 +15044,76 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process_64.c linux-2.6.38.2/arch/x86/k
  	unsigned fsindex, gsindex;
  	bool preload_fpu;
  
-@@ -529,12 +529,11 @@ unsigned long get_wchan(struct task_stru
+@@ -472,10 +472,9 @@ __switch_to(struct task_struct *prev_p, 
+ 	prev->usersp = percpu_read(old_rsp);
+ 	percpu_write(old_rsp, next->usersp);
+ 	percpu_write(current_task, next_p);
++	percpu_write(current_tinfo, &next_p->tinfo);
+ 
+-	percpu_write(kernel_stack,
+-		  (unsigned long)task_stack_page(next_p) +
+-		  THREAD_SIZE - KERNEL_STACK_OFFSET);
++	percpu_write(kernel_stack, next->sp0);
+ 
+ 	/*
+ 	 * Now maybe reload the debug registers and handle I/O bitmaps
+@@ -529,12 +528,11 @@ unsigned long get_wchan(struct task_stru
  	if (!p || p == current || p->state == TASK_RUNNING)
  		return 0;
  	stack = (unsigned long)task_stack_page(p);
 -	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
-+	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-8-sizeof(u64))
++	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
  		return 0;
  	fp = *(u64 *)(p->thread.sp);
  	do {
 -		if (fp < (unsigned long)stack ||
 -		    fp >= (unsigned long)stack+THREAD_SIZE)
-+		if (fp < stack || fp > stack+THREAD_SIZE-8-sizeof(u64))
++		if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
  			return 0;
  		ip = *(u64 *)(fp+8);
  		if (!in_sched_functions(ip))
-diff -urNp linux-2.6.38.2/arch/x86/kernel/process.c linux-2.6.38.2/arch/x86/kernel/process.c
---- linux-2.6.38.2/arch/x86/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/process.c	2011-03-28 16:56:19.000000000 -0400
-@@ -70,7 +70,7 @@ void exit_thread(void)
+diff -urNp linux-2.6.38.7/arch/x86/kernel/process.c linux-2.6.38.7/arch/x86/kernel/process.c
+--- linux-2.6.38.7/arch/x86/kernel/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/process.c	2011-05-22 23:03:34.000000000 -0400
+@@ -48,16 +48,33 @@ void free_thread_xstate(struct task_stru
+ 
+ void free_thread_info(struct thread_info *ti)
+ {
+-	free_thread_xstate(ti->task);
+ 	free_pages((unsigned long)ti, get_order(THREAD_SIZE));
+ }
+ 
++static struct kmem_cache *task_struct_cachep;
++
+ void arch_task_cache_init(void)
+ {
+-        task_xstate_cachep =
+-        	kmem_cache_create("task_xstate", xstate_size,
++	/* create a slab on which task_structs can be allocated */
++	task_struct_cachep =
++		kmem_cache_create("task_struct", sizeof(struct task_struct),
++			ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
++
++	task_xstate_cachep =
++		kmem_cache_create("task_xstate", xstate_size,
+ 				  __alignof__(union thread_xstate),
+-				  SLAB_PANIC | SLAB_NOTRACK, NULL);
++				  SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
++}
++
++struct task_struct *alloc_task_struct(void)
++{
++	return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
++}
++
++void free_task_struct(struct task_struct *task)
++{
++	free_thread_xstate(task);
++	kmem_cache_free(task_struct_cachep, task);
+ }
+ 
+ /*
+@@ -70,7 +87,7 @@ void exit_thread(void)
  	unsigned long *bp = t->io_bitmap_ptr;
  
  	if (bp) {
@@ -13592,7 +15122,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process.c linux-2.6.38.2/arch/x86/kern
  
  		t->io_bitmap_ptr = NULL;
  		clear_thread_flag(TIF_IO_BITMAP);
-@@ -106,7 +106,7 @@ void show_regs_common(void)
+@@ -106,7 +123,7 @@ void show_regs_common(void)
  
  	printk(KERN_CONT "\n");
  	printk(KERN_DEFAULT "Pid: %d, comm: %.20s %s %s %.*s",
@@ -13601,7 +15131,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process.c linux-2.6.38.2/arch/x86/kern
  		init_utsname()->release,
  		(int)strcspn(init_utsname()->version, " "),
  		init_utsname()->version);
-@@ -123,6 +123,9 @@ void flush_thread(void)
+@@ -123,6 +140,9 @@ void flush_thread(void)
  {
  	struct task_struct *tsk = current;
  
@@ -13611,7 +15141,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process.c linux-2.6.38.2/arch/x86/kern
  	flush_ptrace_hw_breakpoint(tsk);
  	memset(tsk->thread.tls_array, 0, sizeof(tsk->thread.tls_array));
  	/*
-@@ -285,10 +288,10 @@ int kernel_thread(int (*fn)(void *), voi
+@@ -285,10 +305,10 @@ int kernel_thread(int (*fn)(void *), voi
  	regs.di = (unsigned long) arg;
  
  #ifdef CONFIG_X86_32
@@ -13625,28 +15155,64 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/process.c linux-2.6.38.2/arch/x86/kern
  #else
  	regs.ss = __KERNEL_DS;
  #endif
-@@ -667,17 +670,3 @@ static int __init idle_setup(char *str)
- 	return 0;
+@@ -404,7 +424,7 @@ void default_idle(void)
+ EXPORT_SYMBOL(default_idle);
+ #endif
+ 
+-void stop_this_cpu(void *dummy)
++__noreturn void stop_this_cpu(void *dummy)
+ {
+ 	local_irq_disable();
+ 	/*
+@@ -668,16 +688,34 @@ static int __init idle_setup(char *str)
  }
  early_param("idle", idle_setup);
--
+ 
 -unsigned long arch_align_stack(unsigned long sp)
--{
++#ifdef CONFIG_PAX_RANDKSTACK
++asmlinkage void pax_randomize_kstack(void)
+ {
 -	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
 -		sp -= get_random_int() % 8192;
 -	return sp & ~0xf;
 -}
--
++	struct thread_struct *thread = &current->thread;
++	unsigned long time;
+ 
 -unsigned long arch_randomize_brk(struct mm_struct *mm)
 -{
 -	unsigned long range_end = mm->brk + 0x02000000;
 -	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
 -}
--
-diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kernel/ptrace.c
---- linux-2.6.38.2/arch/x86/kernel/ptrace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/ptrace.c	2011-03-21 18:31:35.000000000 -0400
-@@ -805,7 +805,7 @@ long arch_ptrace(struct task_struct *chi
++	if (!randomize_va_space)
++		return;
++
++	rdtscl(time);
++
++	/* P4 seems to return a 0 LSB, ignore it */
++#ifdef CONFIG_MPENTIUM4
++	time &= 0x3EUL;
++	time <<= 2;
++#elif defined(CONFIG_X86_64)
++	time &= 0xFUL;
++	time <<= 4;
++#else
++	time &= 0x1FUL;
++	time <<= 3;
++#endif
++
++	thread->sp0 ^= time;
++	load_sp0(init_tss + smp_processor_id(), thread);
+ 
++#ifdef CONFIG_X86_64
++	percpu_write(kernel_stack, thread->sp0);
++#endif
++}
++#endif
+diff -urNp linux-2.6.38.7/arch/x86/kernel/ptrace.c linux-2.6.38.7/arch/x86/kernel/ptrace.c
+--- linux-2.6.38.7/arch/x86/kernel/ptrace.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/ptrace.c	2011-05-22 23:05:54.000000000 -0400
+@@ -821,7 +821,7 @@ long arch_ptrace(struct task_struct *chi
  		 unsigned long addr, unsigned long data)
  {
  	int ret;
@@ -13655,7 +15221,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kerne
  
  	switch (request) {
  	/* read the word at location addr in the USER area. */
-@@ -890,14 +890,14 @@ long arch_ptrace(struct task_struct *chi
+@@ -906,14 +906,14 @@ long arch_ptrace(struct task_struct *chi
  		if ((int) addr < 0)
  			return -EIO;
  		ret = do_get_thread_area(child, addr,
@@ -13672,7 +15238,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kerne
  		break;
  #endif
  
-@@ -1314,7 +1314,7 @@ static void fill_sigtrap_info(struct tas
+@@ -1330,7 +1330,7 @@ static void fill_sigtrap_info(struct tas
  	memset(info, 0, sizeof(*info));
  	info->si_signo = SIGTRAP;
  	info->si_code = si_code;
@@ -13681,7 +15247,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kerne
  }
  
  void user_single_step_siginfo(struct task_struct *tsk,
-@@ -1347,7 +1347,7 @@ void send_sigtrap(struct task_struct *ts
+@@ -1363,7 +1363,7 @@ void send_sigtrap(struct task_struct *ts
   * We must return the syscall number to actually look up in the table.
   * This can be -1L to skip running any syscall at all.
   */
@@ -13690,7 +15256,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kerne
  {
  	long ret = 0;
  
-@@ -1392,7 +1392,7 @@ asmregparm long syscall_trace_enter(stru
+@@ -1408,7 +1408,7 @@ asmregparm long syscall_trace_enter(stru
  	return ret ?: regs->orig_ax;
  }
  
@@ -13699,9 +15265,40 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/ptrace.c linux-2.6.38.2/arch/x86/kerne
  {
  	bool step;
  
-diff -urNp linux-2.6.38.2/arch/x86/kernel/reboot.c linux-2.6.38.2/arch/x86/kernel/reboot.c
---- linux-2.6.38.2/arch/x86/kernel/reboot.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/reboot.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/pvclock.c linux-2.6.38.7/arch/x86/kernel/pvclock.c
+--- linux-2.6.38.7/arch/x86/kernel/pvclock.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/pvclock.c	2011-05-11 18:35:16.000000000 -0400
+@@ -81,11 +81,11 @@ unsigned long pvclock_tsc_khz(struct pvc
+ 	return pv_tsc_khz;
+ }
+ 
+-static atomic64_t last_value = ATOMIC64_INIT(0);
++static atomic64_unchecked_t last_value = ATOMIC64_INIT(0);
+ 
+ void pvclock_resume(void)
+ {
+-	atomic64_set(&last_value, 0);
++	atomic64_set_unchecked(&last_value, 0);
+ }
+ 
+ cycle_t pvclock_clocksource_read(struct pvclock_vcpu_time_info *src)
+@@ -121,11 +121,11 @@ cycle_t pvclock_clocksource_read(struct 
+ 	 * updating at the same time, and one of them could be slightly behind,
+ 	 * making the assumption that last_value always go forward fail to hold.
+ 	 */
+-	last = atomic64_read(&last_value);
++	last = atomic64_read_unchecked(&last_value);
+ 	do {
+ 		if (ret < last)
+ 			return last;
+-		last = atomic64_cmpxchg(&last_value, last, ret);
++		last = atomic64_cmpxchg_unchecked(&last_value, last, ret);
+ 	} while (unlikely(last != ret));
+ 
+ 	return ret;
+diff -urNp linux-2.6.38.7/arch/x86/kernel/reboot.c linux-2.6.38.7/arch/x86/kernel/reboot.c
+--- linux-2.6.38.7/arch/x86/kernel/reboot.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/reboot.c	2011-05-22 23:03:34.000000000 -0400
 @@ -34,7 +34,7 @@ void (*pm_power_off)(void);
  EXPORT_SYMBOL(pm_power_off);
  
@@ -13711,15 +15308,6 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/reboot.c linux-2.6.38.2/arch/x86/kerne
  enum reboot_type reboot_type = BOOT_KBD;
  int reboot_force;
  
-@@ -293,7 +293,7 @@ static struct dmi_system_id __initdata r
- 			DMI_MATCH(DMI_BOARD_NAME, "VersaLogic Menlow board"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
- 
- static int __init reboot_init(void)
 @@ -309,12 +309,12 @@ core_initcall(reboot_init);
     controller to pulse the CPU reset line, which is more thorough, but
     doesn't work with at least one type of 486 motherboard.  It is easy
@@ -13743,7 +15331,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/reboot.c linux-2.6.38.2/arch/x86/kerne
   * We assume that length will aways be less that 100!
   */
 -void machine_real_restart(const unsigned char *code, int length)
-+void machine_real_restart(const unsigned char *code, unsigned int length)
++__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
  {
  	local_irq_disable();
  
@@ -13767,10 +15355,69 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/reboot.c linux-2.6.38.2/arch/x86/kerne
  
  	/* Set up the IDT for real mode. */
  	load_idt(&real_mode_idt);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/setup.c linux-2.6.38.2/arch/x86/kernel/setup.c
---- linux-2.6.38.2/arch/x86/kernel/setup.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/setup.c	2011-03-28 17:42:53.000000000 -0400
-@@ -657,7 +657,7 @@ static void __init trim_bios_range(void)
+@@ -427,6 +426,7 @@ void machine_real_restart(const unsigned
+ 	__asm__ __volatile__ ("ljmp $0x0008,%0"
+ 				:
+ 				: "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
++	unreachable();
+ }
+ #ifdef CONFIG_APM_MODULE
+ EXPORT_SYMBOL(machine_real_restart);
+@@ -547,7 +547,7 @@ void __attribute__((weak)) mach_reboot_f
+ {
+ }
+ 
+-static void native_machine_emergency_restart(void)
++__noreturn static void native_machine_emergency_restart(void)
+ {
+ 	int i;
+ 
+@@ -662,13 +662,13 @@ void native_machine_shutdown(void)
+ #endif
+ }
+ 
+-static void __machine_emergency_restart(int emergency)
++static __noreturn void __machine_emergency_restart(int emergency)
+ {
+ 	reboot_emergency = emergency;
+ 	machine_ops.emergency_restart();
+ }
+ 
+-static void native_machine_restart(char *__unused)
++static __noreturn void native_machine_restart(char *__unused)
+ {
+ 	printk("machine restart\n");
+ 
+@@ -677,7 +677,7 @@ static void native_machine_restart(char 
+ 	__machine_emergency_restart(0);
+ }
+ 
+-static void native_machine_halt(void)
++static __noreturn void native_machine_halt(void)
+ {
+ 	/* stop other cpus and apics */
+ 	machine_shutdown();
+@@ -688,7 +688,7 @@ static void native_machine_halt(void)
+ 	stop_this_cpu(NULL);
+ }
+ 
+-static void native_machine_power_off(void)
++__noreturn static void native_machine_power_off(void)
+ {
+ 	if (pm_power_off) {
+ 		if (!reboot_force)
+@@ -697,6 +697,7 @@ static void native_machine_power_off(voi
+ 	}
+ 	/* a fallback in case there is no PM info available */
+ 	tboot_shutdown(TB_SHUTDOWN_HALT);
++	unreachable();
+ }
+ 
+ struct machine_ops machine_ops = {
+diff -urNp linux-2.6.38.7/arch/x86/kernel/setup.c linux-2.6.38.7/arch/x86/kernel/setup.c
+--- linux-2.6.38.7/arch/x86/kernel/setup.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/setup.c	2011-04-28 19:34:14.000000000 -0400
+@@ -654,7 +654,7 @@ static void __init trim_bios_range(void)
  	 * area (640->1Mb) as ram even though it is not.
  	 * take them out.
  	 */
@@ -13779,7 +15426,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/setup.c linux-2.6.38.2/arch/x86/kernel
  	sanitize_e820_map(e820.map, ARRAY_SIZE(e820.map), &e820.nr_map);
  }
  
-@@ -793,14 +793,14 @@ void __init setup_arch(char **cmdline_p)
+@@ -790,14 +790,14 @@ void __init setup_arch(char **cmdline_p)
  
  	if (!boot_params.hdr.root_flags)
  		root_mountflags &= ~MS_RDONLY;
@@ -13799,9 +15446,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/setup.c linux-2.6.38.2/arch/x86/kernel
  	data_resource.end = virt_to_phys(_edata)-1;
  	bss_resource.start = virt_to_phys(&__bss_start);
  	bss_resource.end = virt_to_phys(&__bss_stop)-1;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/setup_percpu.c linux-2.6.38.2/arch/x86/kernel/setup_percpu.c
---- linux-2.6.38.2/arch/x86/kernel/setup_percpu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/setup_percpu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/setup_percpu.c linux-2.6.38.7/arch/x86/kernel/setup_percpu.c
+--- linux-2.6.38.7/arch/x86/kernel/setup_percpu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/setup_percpu.c	2011-04-28 19:34:14.000000000 -0400
 @@ -21,19 +21,17 @@
  #include <asm/cpu.h>
  #include <asm/stackprotector.h>
@@ -13865,9 +15512,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/setup_percpu.c linux-2.6.38.2/arch/x86
  		/*
  		 * Up to this point, the boot CPU has been using .init.data
  		 * area.  Reload any changed state for the boot CPU.
-diff -urNp linux-2.6.38.2/arch/x86/kernel/signal.c linux-2.6.38.2/arch/x86/kernel/signal.c
---- linux-2.6.38.2/arch/x86/kernel/signal.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/signal.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/signal.c linux-2.6.38.7/arch/x86/kernel/signal.c
+--- linux-2.6.38.7/arch/x86/kernel/signal.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/signal.c	2011-05-22 23:03:34.000000000 -0400
 @@ -198,7 +198,7 @@ static unsigned long align_sigframe(unsi
  	 * Align the stack pointer according to the i386 ABI,
  	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
@@ -13933,7 +15580,16 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/signal.c linux-2.6.38.2/arch/x86/kerne
  	} put_user_catch(err);
  
  	if (err)
-@@ -780,7 +783,7 @@ static void do_signal(struct pt_regs *re
+@@ -773,6 +776,8 @@ static void do_signal(struct pt_regs *re
+ 	int signr;
+ 	sigset_t *oldset;
+ 
++	pax_track_stack();
++
+ 	/*
+ 	 * We want the common case to go fast, which is why we may in certain
+ 	 * cases get here from kernel mode. Just return without doing anything
+@@ -780,7 +785,7 @@ static void do_signal(struct pt_regs *re
  	 * X86_32: vm86 regs switched out by assembly code before reaching
  	 * here, so testing against kernel CS suffices.
  	 */
@@ -13942,12 +15598,24 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/signal.c linux-2.6.38.2/arch/x86/kerne
  		return;
  
  	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
-diff -urNp linux-2.6.38.2/arch/x86/kernel/smpboot.c linux-2.6.38.2/arch/x86/kernel/smpboot.c
---- linux-2.6.38.2/arch/x86/kernel/smpboot.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/smpboot.c	2011-03-21 18:31:35.000000000 -0400
-@@ -783,7 +783,11 @@ do_rest:
- 		(unsigned long)task_stack_page(c_idle.idle) -
- 		KERNEL_STACK_OFFSET + THREAD_SIZE;
+diff -urNp linux-2.6.38.7/arch/x86/kernel/smpboot.c linux-2.6.38.7/arch/x86/kernel/smpboot.c
+--- linux-2.6.38.7/arch/x86/kernel/smpboot.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/smpboot.c	2011-05-11 18:34:57.000000000 -0400
+@@ -773,17 +773,20 @@ static int __cpuinit do_boot_cpu(int api
+ 	set_idle_for_cpu(cpu, c_idle.idle);
+ do_rest:
+ 	per_cpu(current_task, cpu) = c_idle.idle;
++	per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
+ #ifdef CONFIG_X86_32
+ 	/* Stack for startup_32 can be just as for start_secondary onwards */
+ 	irq_ctx_init(cpu);
+ #else
+ 	clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
+ 	initial_gs = per_cpu_offset(cpu);
+-	per_cpu(kernel_stack, cpu) =
+-		(unsigned long)task_stack_page(c_idle.idle) -
+-		KERNEL_STACK_OFFSET + THREAD_SIZE;
++	per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
  #endif
 +
 +	pax_open_kernel();
@@ -13957,7 +15625,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/smpboot.c linux-2.6.38.2/arch/x86/kern
  	initial_code = (unsigned long)start_secondary;
  	stack_start  = c_idle.idle->thread.sp;
  
-@@ -923,6 +927,12 @@ int __cpuinit native_cpu_up(unsigned int
+@@ -923,6 +926,12 @@ int __cpuinit native_cpu_up(unsigned int
  
  	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
  
@@ -13970,9 +15638,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/smpboot.c linux-2.6.38.2/arch/x86/kern
  	err = do_boot_cpu(apicid, cpu);
  	if (err) {
  		pr_debug("do_boot_cpu failed %d\n", err);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/step.c linux-2.6.38.2/arch/x86/kernel/step.c
---- linux-2.6.38.2/arch/x86/kernel/step.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/step.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/step.c linux-2.6.38.7/arch/x86/kernel/step.c
+--- linux-2.6.38.7/arch/x86/kernel/step.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/step.c	2011-04-28 19:34:14.000000000 -0400
 @@ -27,10 +27,10 @@ unsigned long convert_ip_to_linear(struc
  		struct desc_struct *desc;
  		unsigned long base;
@@ -14015,17 +15683,17 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/step.c linux-2.6.38.2/arch/x86/kernel/
  				/* 32-bit mode: register increment */
  				return 0;
  			/* 64-bit mode: REX prefix */
-diff -urNp linux-2.6.38.2/arch/x86/kernel/syscall_table_32.S linux-2.6.38.2/arch/x86/kernel/syscall_table_32.S
---- linux-2.6.38.2/arch/x86/kernel/syscall_table_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/syscall_table_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/syscall_table_32.S linux-2.6.38.7/arch/x86/kernel/syscall_table_32.S
+--- linux-2.6.38.7/arch/x86/kernel/syscall_table_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/syscall_table_32.S	2011-04-28 19:34:14.000000000 -0400
 @@ -1,3 +1,4 @@
 +.section .rodata,"a",@progbits
  ENTRY(sys_call_table)
  	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
  	.long sys_exit
-diff -urNp linux-2.6.38.2/arch/x86/kernel/sys_i386_32.c linux-2.6.38.2/arch/x86/kernel/sys_i386_32.c
---- linux-2.6.38.2/arch/x86/kernel/sys_i386_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/sys_i386_32.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/sys_i386_32.c linux-2.6.38.7/arch/x86/kernel/sys_i386_32.c
+--- linux-2.6.38.7/arch/x86/kernel/sys_i386_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/sys_i386_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -24,17 +24,224 @@
  
  #include <asm/syscalls.h>
@@ -14263,9 +15931,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/sys_i386_32.c linux-2.6.38.2/arch/x86/
 +
 +	return addr;
  }
-diff -urNp linux-2.6.38.2/arch/x86/kernel/sys_x86_64.c linux-2.6.38.2/arch/x86/kernel/sys_x86_64.c
---- linux-2.6.38.2/arch/x86/kernel/sys_x86_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/sys_x86_64.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/sys_x86_64.c linux-2.6.38.7/arch/x86/kernel/sys_x86_64.c
+--- linux-2.6.38.7/arch/x86/kernel/sys_x86_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/sys_x86_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -32,8 +32,8 @@ out:
  	return error;
  }
@@ -14403,9 +16071,60 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/sys_x86_64.c linux-2.6.38.2/arch/x86/k
  	mm->cached_hole_size = ~0UL;
  
  	return addr;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/time.c linux-2.6.38.2/arch/x86/kernel/time.c
---- linux-2.6.38.2/arch/x86/kernel/time.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/time.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/tboot.c linux-2.6.38.7/arch/x86/kernel/tboot.c
+--- linux-2.6.38.7/arch/x86/kernel/tboot.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/tboot.c	2011-05-22 23:03:34.000000000 -0400
+@@ -218,7 +218,7 @@ static int tboot_setup_sleep(void)
+ 
+ void tboot_shutdown(u32 shutdown_type)
+ {
+-	void (*shutdown)(void);
++	void (* __noreturn shutdown)(void);
+ 
+ 	if (!tboot_enabled())
+ 		return;
+@@ -240,7 +240,7 @@ void tboot_shutdown(u32 shutdown_type)
+ 
+ 	switch_to_tboot_pt();
+ 
+-	shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
++	shutdown = (void *)tboot->shutdown_entry;
+ 	shutdown();
+ 
+ 	/* should not reach here */
+@@ -297,7 +297,7 @@ void tboot_sleep(u8 sleep_state, u32 pm1
+ 	tboot_shutdown(acpi_shutdown_map[sleep_state]);
+ }
+ 
+-static atomic_t ap_wfs_count;
++static atomic_unchecked_t ap_wfs_count;
+ 
+ static int tboot_wait_for_aps(int num_aps)
+ {
+@@ -321,9 +321,9 @@ static int __cpuinit tboot_cpu_callback(
+ {
+ 	switch (action) {
+ 	case CPU_DYING:
+-		atomic_inc(&ap_wfs_count);
++		atomic_inc_unchecked(&ap_wfs_count);
+ 		if (num_online_cpus() == 1)
+-			if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
++			if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
+ 				return NOTIFY_BAD;
+ 		break;
+ 	}
+@@ -342,7 +342,7 @@ static __init int tboot_late_init(void)
+ 
+ 	tboot_create_trampoline();
+ 
+-	atomic_set(&ap_wfs_count, 0);
++	atomic_set_unchecked(&ap_wfs_count, 0);
+ 	register_hotcpu_notifier(&tboot_cpu_notifier);
+ 	return 0;
+ }
+diff -urNp linux-2.6.38.7/arch/x86/kernel/time.c linux-2.6.38.7/arch/x86/kernel/time.c
+--- linux-2.6.38.7/arch/x86/kernel/time.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/time.c	2011-04-28 19:34:14.000000000 -0400
 @@ -22,17 +22,13 @@
  #include <asm/hpet.h>
  #include <asm/time.h>
@@ -14444,9 +16163,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/time.c linux-2.6.38.2/arch/x86/kernel/
  	}
  	return pc;
  }
-diff -urNp linux-2.6.38.2/arch/x86/kernel/tls.c linux-2.6.38.2/arch/x86/kernel/tls.c
---- linux-2.6.38.2/arch/x86/kernel/tls.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/tls.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/tls.c linux-2.6.38.7/arch/x86/kernel/tls.c
+--- linux-2.6.38.7/arch/x86/kernel/tls.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/tls.c	2011-04-28 19:34:14.000000000 -0400
 @@ -85,6 +85,11 @@ int do_set_thread_area(struct task_struc
  	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
  		return -EINVAL;
@@ -14459,9 +16178,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/tls.c linux-2.6.38.2/arch/x86/kernel/t
  	set_tls_desc(p, idx, &info, 1);
  
  	return 0;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/trampoline_32.S linux-2.6.38.2/arch/x86/kernel/trampoline_32.S
---- linux-2.6.38.2/arch/x86/kernel/trampoline_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/trampoline_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/trampoline_32.S linux-2.6.38.7/arch/x86/kernel/trampoline_32.S
+--- linux-2.6.38.7/arch/x86/kernel/trampoline_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/trampoline_32.S	2011-04-28 19:34:14.000000000 -0400
 @@ -32,6 +32,12 @@
  #include <asm/segment.h>
  #include <asm/page_types.h>
@@ -14484,9 +16203,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/trampoline_32.S linux-2.6.38.2/arch/x8
  
  	# These need to be in the same 64K segment as the above;
  	# hence we don't use the boot_gdt_descr defined in head.S
-diff -urNp linux-2.6.38.2/arch/x86/kernel/trampoline_64.S linux-2.6.38.2/arch/x86/kernel/trampoline_64.S
---- linux-2.6.38.2/arch/x86/kernel/trampoline_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/trampoline_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/trampoline_64.S linux-2.6.38.7/arch/x86/kernel/trampoline_64.S
+--- linux-2.6.38.7/arch/x86/kernel/trampoline_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/trampoline_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -91,7 +91,7 @@ startup_32:
  	movl	$__KERNEL_DS, %eax	# Initialize the %ds segment register
  	movl	%eax, %ds
@@ -14505,9 +16224,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/trampoline_64.S linux-2.6.38.2/arch/x8
  	.long	tgdt - r_base
  	.short 0
  	.quad	0x00cf9b000000ffff	# __KERNEL32_CS
-diff -urNp linux-2.6.38.2/arch/x86/kernel/traps.c linux-2.6.38.2/arch/x86/kernel/traps.c
---- linux-2.6.38.2/arch/x86/kernel/traps.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/traps.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/traps.c linux-2.6.38.7/arch/x86/kernel/traps.c
+--- linux-2.6.38.7/arch/x86/kernel/traps.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/traps.c	2011-04-28 19:34:14.000000000 -0400
 @@ -70,12 +70,6 @@ asmlinkage int system_call(void);
  
  /* Do we ignore FPU interrupts ? */
@@ -14650,21 +16369,28 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/traps.c linux-2.6.38.2/arch/x86/kernel
  	{
  		if (!fixup_exception(regs)) {
  			task->thread.error_code = error_code;
-diff -urNp linux-2.6.38.2/arch/x86/kernel/tsc.c linux-2.6.38.2/arch/x86/kernel/tsc.c
---- linux-2.6.38.2/arch/x86/kernel/tsc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/tsc.c	2011-03-21 18:31:35.000000000 -0400
-@@ -837,7 +837,7 @@ static struct dmi_system_id __initdata b
- 			DMI_MATCH(DMI_BOARD_NAME, "2635FA0"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {{0, {0}}}, NULL}
- };
+@@ -723,7 +752,7 @@ asmlinkage void __attribute__((weak)) sm
+ void __math_state_restore(void)
+ {
+ 	struct thread_info *thread = current_thread_info();
+-	struct task_struct *tsk = thread->task;
++	struct task_struct *tsk = current;
+ 
+ 	/*
+ 	 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
+@@ -750,8 +779,7 @@ void __math_state_restore(void)
+  */
+ asmlinkage void math_state_restore(void)
+ {
+-	struct thread_info *thread = current_thread_info();
+-	struct task_struct *tsk = thread->task;
++	struct task_struct *tsk = current;
  
- static void __init check_system_tsc_reliable(void)
-diff -urNp linux-2.6.38.2/arch/x86/kernel/vm86_32.c linux-2.6.38.2/arch/x86/kernel/vm86_32.c
---- linux-2.6.38.2/arch/x86/kernel/vm86_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/vm86_32.c	2011-03-21 18:31:35.000000000 -0400
+ 	if (!tsk_used_math(tsk)) {
+ 		local_irq_enable();
+diff -urNp linux-2.6.38.7/arch/x86/kernel/vm86_32.c linux-2.6.38.7/arch/x86/kernel/vm86_32.c
+--- linux-2.6.38.7/arch/x86/kernel/vm86_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/vm86_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -41,6 +41,7 @@
  #include <linux/ptrace.h>
  #include <linux/audit.h>
@@ -14729,9 +16455,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/vm86_32.c linux-2.6.38.2/arch/x86/kern
  	if (get_user(segoffs, intr_ptr))
  		goto cannot_handle;
  	if ((segoffs >> 16) == BIOSSEG)
-diff -urNp linux-2.6.38.2/arch/x86/kernel/vmlinux.lds.S linux-2.6.38.2/arch/x86/kernel/vmlinux.lds.S
---- linux-2.6.38.2/arch/x86/kernel/vmlinux.lds.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/vmlinux.lds.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/vmlinux.lds.S linux-2.6.38.7/arch/x86/kernel/vmlinux.lds.S
+--- linux-2.6.38.7/arch/x86/kernel/vmlinux.lds.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/vmlinux.lds.S	2011-04-28 19:34:14.000000000 -0400
 @@ -26,6 +26,13 @@
  #include <asm/page_types.h>
  #include <asm/cache.h>
@@ -15028,9 +16754,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/vmlinux.lds.S linux-2.6.38.2/arch/x86/
  	   "kernel image bigger than KERNEL_IMAGE_SIZE");
  
  #ifdef CONFIG_SMP
-diff -urNp linux-2.6.38.2/arch/x86/kernel/vsyscall_64.c linux-2.6.38.2/arch/x86/kernel/vsyscall_64.c
---- linux-2.6.38.2/arch/x86/kernel/vsyscall_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/vsyscall_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/vsyscall_64.c linux-2.6.38.7/arch/x86/kernel/vsyscall_64.c
+--- linux-2.6.38.7/arch/x86/kernel/vsyscall_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/vsyscall_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -80,6 +80,7 @@ void update_vsyscall(struct timespec *wa
  
  	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
@@ -15048,9 +16774,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/vsyscall_64.c linux-2.6.38.2/arch/x86/
  		p = tcache->blob[1];
  	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
  		/* Load per CPU data from RDTSCP */
-diff -urNp linux-2.6.38.2/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.38.2/arch/x86/kernel/x8664_ksyms_64.c
---- linux-2.6.38.2/arch/x86/kernel/x8664_ksyms_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/x8664_ksyms_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.38.7/arch/x86/kernel/x8664_ksyms_64.c
+--- linux-2.6.38.7/arch/x86/kernel/x8664_ksyms_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/x8664_ksyms_64.c	2011-04-28 19:34:14.000000000 -0400
 @@ -29,8 +29,6 @@ EXPORT_SYMBOL(__put_user_8);
  EXPORT_SYMBOL(copy_user_generic_string);
  EXPORT_SYMBOL(copy_user_generic_unrolled);
@@ -15060,9 +16786,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.38.2/arch/x
  
  EXPORT_SYMBOL(copy_page);
  EXPORT_SYMBOL(clear_page);
-diff -urNp linux-2.6.38.2/arch/x86/kernel/xsave.c linux-2.6.38.2/arch/x86/kernel/xsave.c
---- linux-2.6.38.2/arch/x86/kernel/xsave.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kernel/xsave.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kernel/xsave.c linux-2.6.38.7/arch/x86/kernel/xsave.c
+--- linux-2.6.38.7/arch/x86/kernel/xsave.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kernel/xsave.c	2011-04-28 19:34:14.000000000 -0400
 @@ -130,7 +130,7 @@ int check_for_xstate(struct i387_fxsave_
  	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
  		return -EINVAL;
@@ -15090,9 +16816,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kernel/xsave.c linux-2.6.38.2/arch/x86/kernel
  				       buf);
  	if (unlikely(err)) {
  		/*
-diff -urNp linux-2.6.38.2/arch/x86/kvm/emulate.c linux-2.6.38.2/arch/x86/kvm/emulate.c
---- linux-2.6.38.2/arch/x86/kvm/emulate.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kvm/emulate.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kvm/emulate.c linux-2.6.38.7/arch/x86/kvm/emulate.c
+--- linux-2.6.38.7/arch/x86/kvm/emulate.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/emulate.c	2011-04-28 19:34:14.000000000 -0400
 @@ -88,7 +88,7 @@
  #define Src2ImmByte (2<<29)
  #define Src2One     (3<<29)
@@ -15127,9 +16853,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/emulate.c linux-2.6.38.2/arch/x86/kvm/emu
  		switch ((_dst).bytes) {				             \
  		case 1:							     \
  			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b",u8); \
-diff -urNp linux-2.6.38.2/arch/x86/kvm/lapic.c linux-2.6.38.2/arch/x86/kvm/lapic.c
---- linux-2.6.38.2/arch/x86/kvm/lapic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kvm/lapic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kvm/lapic.c linux-2.6.38.7/arch/x86/kvm/lapic.c
+--- linux-2.6.38.7/arch/x86/kvm/lapic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/lapic.c	2011-04-28 19:34:14.000000000 -0400
 @@ -53,7 +53,7 @@
  #define APIC_BUS_CYCLE_NS 1
  
@@ -15139,10 +16865,52 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/lapic.c linux-2.6.38.2/arch/x86/kvm/lapic
  
  #define APIC_LVT_NUM			6
  /* 14 is the version for Xeon and Pentium 8.4.8*/
-diff -urNp linux-2.6.38.2/arch/x86/kvm/svm.c linux-2.6.38.2/arch/x86/kvm/svm.c
---- linux-2.6.38.2/arch/x86/kvm/svm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kvm/svm.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3273,7 +3273,11 @@ static void reload_tss(struct kvm_vcpu *
+diff -urNp linux-2.6.38.7/arch/x86/kvm/mmu.c linux-2.6.38.7/arch/x86/kvm/mmu.c
+--- linux-2.6.38.7/arch/x86/kvm/mmu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/mmu.c	2011-04-28 19:57:25.000000000 -0400
+@@ -3271,7 +3271,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
+ 
+ 	pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes);
+ 
+-	invlpg_counter = atomic_read(&vcpu->kvm->arch.invlpg_counter);
++	invlpg_counter = atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter);
+ 
+ 	/*
+ 	 * Assume that the pte write on a page table of the same type
+@@ -3305,7 +3305,7 @@ void kvm_mmu_pte_write(struct kvm_vcpu *
+ 
+ 	mmu_guess_page_from_pte_write(vcpu, gpa, gentry);
+ 	spin_lock(&vcpu->kvm->mmu_lock);
+-	if (atomic_read(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
++	if (atomic_read_unchecked(&vcpu->kvm->arch.invlpg_counter) != invlpg_counter)
+ 		gentry = 0;
+ 	kvm_mmu_access_page(vcpu, gfn);
+ 	kvm_mmu_free_some_pages(vcpu);
+diff -urNp linux-2.6.38.7/arch/x86/kvm/paging_tmpl.h linux-2.6.38.7/arch/x86/kvm/paging_tmpl.h
+--- linux-2.6.38.7/arch/x86/kvm/paging_tmpl.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/paging_tmpl.h	2011-05-16 21:47:08.000000000 -0400
+@@ -554,6 +554,8 @@ static int FNAME(page_fault)(struct kvm_
+ 	unsigned long mmu_seq;
+ 	bool map_writable;
+ 
++	pax_track_stack();
++
+ 	pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
+ 
+ 	r = mmu_topup_memory_caches(vcpu);
+@@ -674,7 +676,7 @@ static void FNAME(invlpg)(struct kvm_vcp
+ 	if (need_flush)
+ 		kvm_flush_remote_tlbs(vcpu->kvm);
+ 
+-	atomic_inc(&vcpu->kvm->arch.invlpg_counter);
++	atomic_inc_unchecked(&vcpu->kvm->arch.invlpg_counter);
+ 
+ 	spin_unlock(&vcpu->kvm->mmu_lock);
+ 
+diff -urNp linux-2.6.38.7/arch/x86/kvm/svm.c linux-2.6.38.7/arch/x86/kvm/svm.c
+--- linux-2.6.38.7/arch/x86/kvm/svm.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/svm.c	2011-05-10 22:08:57.000000000 -0400
+@@ -3276,7 +3276,11 @@ static void reload_tss(struct kvm_vcpu *
  	int cpu = raw_smp_processor_id();
  
  	struct svm_cpu_data *sd = per_cpu(svm_data, cpu);
@@ -15154,7 +16922,18 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/svm.c linux-2.6.38.2/arch/x86/kvm/svm.c
  	load_TR_desc();
  }
  
-@@ -3850,7 +3854,7 @@ static void svm_fpu_deactivate(struct kv
+@@ -3651,6 +3655,10 @@ static void svm_vcpu_run(struct kvm_vcpu
+ 	loadsegment(fs, svm->host.fs);
+ #endif
+ 
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	__set_fs(current_thread_info()->addr_limit);
++#endif
++
+ 	reload_tss(vcpu);
+ 
+ 	local_irq_disable();
+@@ -3858,7 +3866,7 @@ static void svm_fpu_deactivate(struct kv
  	update_cr0_intercept(svm);
  }
  
@@ -15163,9 +16942,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/svm.c linux-2.6.38.2/arch/x86/kvm/svm.c
  	.cpu_has_kvm_support = has_svm,
  	.disabled_by_bios = is_disabled,
  	.hardware_setup = svm_hardware_setup,
-diff -urNp linux-2.6.38.2/arch/x86/kvm/vmx.c linux-2.6.38.2/arch/x86/kvm/vmx.c
---- linux-2.6.38.2/arch/x86/kvm/vmx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kvm/vmx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kvm/vmx.c linux-2.6.38.7/arch/x86/kvm/vmx.c
+--- linux-2.6.38.7/arch/x86/kvm/vmx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/vmx.c	2011-04-28 19:57:25.000000000 -0400
 @@ -725,7 +725,11 @@ static void reload_tss(void)
  	struct desc_struct *descs;
  
@@ -15226,16 +17005,25 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/vmx.c linux-2.6.38.2/arch/x86/kvm/vmx.c
  	      : "cc", "memory"
  		, R"ax", R"bx", R"di", R"si"
  #ifdef CONFIG_X86_64
-@@ -4091,7 +4109,7 @@ static void vmx_vcpu_run(struct kvm_vcpu
+@@ -4091,7 +4109,16 @@ static void vmx_vcpu_run(struct kvm_vcpu
  
  	vmx->idt_vectoring_info = vmcs_read32(IDT_VECTORING_INFO_FIELD);
  
 -	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
 +	asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
++	loadsegment(fs, __KERNEL_PERCPU);
++#endif
++
++#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
++	__set_fs(current_thread_info()->addr_limit);
++#endif
++
  	vmx->launched = 1;
  
  	vmx->exit_reason = vmcs_read32(VM_EXIT_REASON);
-@@ -4326,7 +4344,7 @@ static void vmx_set_supported_cpuid(u32 
+@@ -4326,7 +4353,7 @@ static void vmx_set_supported_cpuid(u32 
  {
  }
  
@@ -15244,9 +17032,9 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/vmx.c linux-2.6.38.2/arch/x86/kvm/vmx.c
  	.cpu_has_kvm_support = cpu_has_kvm_support,
  	.disabled_by_bios = vmx_disabled_by_bios,
  	.hardware_setup = hardware_setup,
-diff -urNp linux-2.6.38.2/arch/x86/kvm/x86.c linux-2.6.38.2/arch/x86/kvm/x86.c
---- linux-2.6.38.2/arch/x86/kvm/x86.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/kvm/x86.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/kvm/x86.c linux-2.6.38.7/arch/x86/kvm/x86.c
+--- linux-2.6.38.7/arch/x86/kvm/x86.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/kvm/x86.c	2011-04-28 19:34:14.000000000 -0400
 @@ -93,7 +93,7 @@ static void update_cr8_intercept(struct 
  static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
  				    struct kvm_cpuid_entry2 __user *entries);
@@ -15256,77 +17044,6 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/x86.c linux-2.6.38.2/arch/x86/kvm/x86.c
  EXPORT_SYMBOL_GPL(kvm_x86_ops);
  
  int ignore_msrs = 0;
-@@ -119,38 +119,38 @@ static struct kvm_shared_msrs_global __r
- static DEFINE_PER_CPU(struct kvm_shared_msrs, shared_msrs);
- 
- struct kvm_stats_debugfs_item debugfs_entries[] = {
--	{ "pf_fixed", VCPU_STAT(pf_fixed) },
--	{ "pf_guest", VCPU_STAT(pf_guest) },
--	{ "tlb_flush", VCPU_STAT(tlb_flush) },
--	{ "invlpg", VCPU_STAT(invlpg) },
--	{ "exits", VCPU_STAT(exits) },
--	{ "io_exits", VCPU_STAT(io_exits) },
--	{ "mmio_exits", VCPU_STAT(mmio_exits) },
--	{ "signal_exits", VCPU_STAT(signal_exits) },
--	{ "irq_window", VCPU_STAT(irq_window_exits) },
--	{ "nmi_window", VCPU_STAT(nmi_window_exits) },
--	{ "halt_exits", VCPU_STAT(halt_exits) },
--	{ "halt_wakeup", VCPU_STAT(halt_wakeup) },
--	{ "hypercalls", VCPU_STAT(hypercalls) },
--	{ "request_irq", VCPU_STAT(request_irq_exits) },
--	{ "irq_exits", VCPU_STAT(irq_exits) },
--	{ "host_state_reload", VCPU_STAT(host_state_reload) },
--	{ "efer_reload", VCPU_STAT(efer_reload) },
--	{ "fpu_reload", VCPU_STAT(fpu_reload) },
--	{ "insn_emulation", VCPU_STAT(insn_emulation) },
--	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail) },
--	{ "irq_injections", VCPU_STAT(irq_injections) },
--	{ "nmi_injections", VCPU_STAT(nmi_injections) },
--	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped) },
--	{ "mmu_pte_write", VM_STAT(mmu_pte_write) },
--	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated) },
--	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped) },
--	{ "mmu_flooded", VM_STAT(mmu_flooded) },
--	{ "mmu_recycled", VM_STAT(mmu_recycled) },
--	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss) },
--	{ "mmu_unsync", VM_STAT(mmu_unsync) },
--	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush) },
--	{ "largepages", VM_STAT(lpages) },
-+	{ "pf_fixed", VCPU_STAT(pf_fixed), NULL },
-+	{ "pf_guest", VCPU_STAT(pf_guest), NULL },
-+	{ "tlb_flush", VCPU_STAT(tlb_flush), NULL },
-+	{ "invlpg", VCPU_STAT(invlpg), NULL },
-+	{ "exits", VCPU_STAT(exits), NULL },
-+	{ "io_exits", VCPU_STAT(io_exits), NULL },
-+	{ "mmio_exits", VCPU_STAT(mmio_exits), NULL },
-+	{ "signal_exits", VCPU_STAT(signal_exits), NULL },
-+	{ "irq_window", VCPU_STAT(irq_window_exits), NULL },
-+	{ "nmi_window", VCPU_STAT(nmi_window_exits), NULL },
-+	{ "halt_exits", VCPU_STAT(halt_exits), NULL },
-+	{ "halt_wakeup", VCPU_STAT(halt_wakeup), NULL },
-+	{ "hypercalls", VCPU_STAT(hypercalls), NULL },
-+	{ "request_irq", VCPU_STAT(request_irq_exits), NULL },
-+	{ "irq_exits", VCPU_STAT(irq_exits), NULL },
-+	{ "host_state_reload", VCPU_STAT(host_state_reload), NULL },
-+	{ "efer_reload", VCPU_STAT(efer_reload), NULL },
-+	{ "fpu_reload", VCPU_STAT(fpu_reload), NULL },
-+	{ "insn_emulation", VCPU_STAT(insn_emulation), NULL },
-+	{ "insn_emulation_fail", VCPU_STAT(insn_emulation_fail), NULL },
-+	{ "irq_injections", VCPU_STAT(irq_injections), NULL },
-+	{ "nmi_injections", VCPU_STAT(nmi_injections), NULL },
-+	{ "mmu_shadow_zapped", VM_STAT(mmu_shadow_zapped), NULL },
-+	{ "mmu_pte_write", VM_STAT(mmu_pte_write), NULL },
-+	{ "mmu_pte_updated", VM_STAT(mmu_pte_updated), NULL },
-+	{ "mmu_pde_zapped", VM_STAT(mmu_pde_zapped), NULL },
-+	{ "mmu_flooded", VM_STAT(mmu_flooded), NULL },
-+	{ "mmu_recycled", VM_STAT(mmu_recycled), NULL },
-+	{ "mmu_cache_miss", VM_STAT(mmu_cache_miss), NULL },
-+	{ "mmu_unsync", VM_STAT(mmu_unsync), NULL },
-+	{ "remote_tlb_flush", VM_STAT(remote_tlb_flush), NULL },
-+	{ "largepages", VM_STAT(lpages), NULL },
- 	{ NULL }
- };
- 
 @@ -2023,6 +2023,8 @@ long kvm_arch_dev_ioctl(struct file *fil
  		if (n < msr_list.nmsrs)
  			goto out;
@@ -15336,7 +17053,54 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/x86.c linux-2.6.38.2/arch/x86/kvm/x86.c
  		if (copy_to_user(user_msr_list->indices, &msrs_to_save,
  				 num_msrs_to_save * sizeof(u32)))
  			goto out;
-@@ -2499,7 +2501,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
+@@ -2190,15 +2192,20 @@ static int kvm_vcpu_ioctl_set_cpuid2(str
+ 				     struct kvm_cpuid2 *cpuid,
+ 				     struct kvm_cpuid_entry2 __user *entries)
+ {
+-	int r;
++	int r, i;
+ 
+ 	r = -E2BIG;
+ 	if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
+ 		goto out;
+ 	r = -EFAULT;
+-	if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
+-			   cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
++	if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
+ 		goto out;
++	for (i = 0; i < cpuid->nent; ++i) {
++		struct kvm_cpuid_entry2 cpuid_entry;
++		if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
++			goto out;
++		vcpu->arch.cpuid_entries[i] = cpuid_entry;
++	}
+ 	vcpu->arch.cpuid_nent = cpuid->nent;
+ 	kvm_apic_set_version(vcpu);
+ 	kvm_x86_ops->cpuid_update(vcpu);
+@@ -2213,15 +2220,19 @@ static int kvm_vcpu_ioctl_get_cpuid2(str
+ 				     struct kvm_cpuid2 *cpuid,
+ 				     struct kvm_cpuid_entry2 __user *entries)
+ {
+-	int r;
++	int r, i;
+ 
+ 	r = -E2BIG;
+ 	if (cpuid->nent < vcpu->arch.cpuid_nent)
+ 		goto out;
+ 	r = -EFAULT;
+-	if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
+-			 vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
++	if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
+ 		goto out;
++	for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
++		struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
++		if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
++			goto out;
++	}
+ 	return 0;
+ 
+ out:
+@@ -2499,7 +2510,7 @@ static int kvm_vcpu_ioctl_set_lapic(stru
  static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
  				    struct kvm_interrupt *irq)
  {
@@ -15345,7 +17109,7 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/x86.c linux-2.6.38.2/arch/x86/kvm/x86.c
  		return -EINVAL;
  	if (irqchip_in_kernel(vcpu->kvm))
  		return -ENXIO;
-@@ -4687,10 +4689,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
+@@ -4687,10 +4698,10 @@ void kvm_after_handle_nmi(struct kvm_vcp
  }
  EXPORT_SYMBOL_GPL(kvm_after_handle_nmi);
  
@@ -15358,19 +17122,406 @@ diff -urNp linux-2.6.38.2/arch/x86/kvm/x86.c linux-2.6.38.2/arch/x86/kvm/x86.c
  
  	if (kvm_x86_ops) {
  		printk(KERN_ERR "kvm: already loaded the other module\n");
-diff -urNp linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S
---- linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S	2011-03-21 18:31:35.000000000 -0400
-@@ -86,13 +86,23 @@ ENTRY(atomic64_\func\()_return_cx8)
+diff -urNp linux-2.6.38.7/arch/x86/lib/atomic64_32.c linux-2.6.38.7/arch/x86/lib/atomic64_32.c
+--- linux-2.6.38.7/arch/x86/lib/atomic64_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/atomic64_32.c	2011-05-02 19:07:09.000000000 -0400
+@@ -8,18 +8,30 @@
+ 
+ long long atomic64_read_cx8(long long, const atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_read_cx8);
++long long atomic64_read_unchecked_cx8(long long, const atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_read_unchecked_cx8);
+ long long atomic64_set_cx8(long long, const atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_set_cx8);
++long long atomic64_set_unchecked_cx8(long long, const atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_set_unchecked_cx8);
+ long long atomic64_xchg_cx8(long long, unsigned high);
+ EXPORT_SYMBOL(atomic64_xchg_cx8);
+ long long atomic64_add_return_cx8(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_add_return_cx8);
++long long atomic64_add_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_add_return_unchecked_cx8);
+ long long atomic64_sub_return_cx8(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_sub_return_cx8);
++long long atomic64_sub_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_sub_return_unchecked_cx8);
+ long long atomic64_inc_return_cx8(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_inc_return_cx8);
++long long atomic64_inc_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_inc_return_unchecked_cx8);
+ long long atomic64_dec_return_cx8(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_dec_return_cx8);
++long long atomic64_dec_return_unchecked_cx8(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_dec_return_unchecked_cx8);
+ long long atomic64_dec_if_positive_cx8(atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_dec_if_positive_cx8);
+ int atomic64_inc_not_zero_cx8(atomic64_t *v);
+@@ -30,26 +42,46 @@ EXPORT_SYMBOL(atomic64_add_unless_cx8);
+ #ifndef CONFIG_X86_CMPXCHG64
+ long long atomic64_read_386(long long, const atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_read_386);
++long long atomic64_read_unchecked_386(long long, const atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_read_unchecked_386);
+ long long atomic64_set_386(long long, const atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_set_386);
++long long atomic64_set_unchecked_386(long long, const atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_set_unchecked_386);
+ long long atomic64_xchg_386(long long, unsigned high);
+ EXPORT_SYMBOL(atomic64_xchg_386);
+ long long atomic64_add_return_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_add_return_386);
++long long atomic64_add_return_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_add_return_unchecked_386);
+ long long atomic64_sub_return_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_sub_return_386);
++long long atomic64_sub_return_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_sub_return_unchecked_386);
+ long long atomic64_inc_return_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_inc_return_386);
++long long atomic64_inc_return_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_inc_return_unchecked_386);
+ long long atomic64_dec_return_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_dec_return_386);
++long long atomic64_dec_return_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_dec_return_unchecked_386);
+ long long atomic64_add_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_add_386);
++long long atomic64_add_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_add_unchecked_386);
+ long long atomic64_sub_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_sub_386);
++long long atomic64_sub_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_sub_unchecked_386);
+ long long atomic64_inc_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_inc_386);
++long long atomic64_inc_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_inc_unchecked_386);
+ long long atomic64_dec_386(long long a, atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_dec_386);
++long long atomic64_dec_unchecked_386(long long a, atomic64_unchecked_t *v);
++EXPORT_SYMBOL(atomic64_dec_unchecked_386);
+ long long atomic64_dec_if_positive_386(atomic64_t *v);
+ EXPORT_SYMBOL(atomic64_dec_if_positive_386);
+ int atomic64_inc_not_zero_386(atomic64_t *v);
+diff -urNp linux-2.6.38.7/arch/x86/lib/atomic64_386_32.S linux-2.6.38.7/arch/x86/lib/atomic64_386_32.S
+--- linux-2.6.38.7/arch/x86/lib/atomic64_386_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/atomic64_386_32.S	2011-05-02 19:07:09.000000000 -0400
+@@ -50,6 +50,10 @@ BEGIN(read)
+ 	movl  (v), %eax
+ 	movl 4(v), %edx
+ RET_ENDP
++BEGIN(read_unchecked)
++	movl  (v), %eax
++	movl 4(v), %edx
++RET_ENDP
+ #undef v
+ 
+ #define v %esi
+@@ -57,6 +61,10 @@ BEGIN(set)
+ 	movl %ebx,  (v)
+ 	movl %ecx, 4(v)
+ RET_ENDP
++BEGIN(set_unchecked)
++	movl %ebx,  (v)
++	movl %ecx, 4(v)
++RET_ENDP
+ #undef v
+ 
+ #define v  %esi
+@@ -72,6 +80,20 @@ RET_ENDP
+ BEGIN(add)
+ 	addl %eax,  (v)
+ 	adcl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++	jno 0f
++	subl %eax,  (v)
++	sbbl %edx, 4(v)
++	int $4
++0:
++	_ASM_EXTABLE(0b, 0b)
++#endif
++
++RET_ENDP
++BEGIN(add_unchecked)
++	addl %eax,  (v)
++	adcl %edx, 4(v)
+ RET_ENDP
+ #undef v
+ 
+@@ -79,6 +101,24 @@ RET_ENDP
+ BEGIN(add_return)
+ 	addl  (v), %eax
+ 	adcl 4(v), %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
++	movl %eax,  (v)
++	movl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++2:
++#endif
++
++RET_ENDP
++BEGIN(add_return_unchecked)
++	addl  (v), %eax
++	adcl 4(v), %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ RET_ENDP
+@@ -88,6 +128,20 @@ RET_ENDP
+ BEGIN(sub)
+ 	subl %eax,  (v)
+ 	sbbl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++	jno 0f
++	addl %eax,  (v)
++	adcl %edx, 4(v)
++	int $4
++0:
++	_ASM_EXTABLE(0b, 0b)
++#endif
++
++RET_ENDP
++BEGIN(sub_unchecked)
++	subl %eax,  (v)
++	sbbl %edx, 4(v)
+ RET_ENDP
+ #undef v
+ 
+@@ -98,6 +152,27 @@ BEGIN(sub_return)
+ 	sbbl $0, %edx
+ 	addl  (v), %eax
+ 	adcl 4(v), %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
++	movl %eax,  (v)
++	movl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++2:
++#endif
++
++RET_ENDP
++BEGIN(sub_return_unchecked)
++	negl %edx
++	negl %eax
++	sbbl $0, %edx
++	addl  (v), %eax
++	adcl 4(v), %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ RET_ENDP
+@@ -107,6 +182,20 @@ RET_ENDP
+ BEGIN(inc)
+ 	addl $1,  (v)
+ 	adcl $0, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++	jno 0f
++	subl $1,  (v)
++	sbbl $0, 4(v)
++	int $4
++0:
++	_ASM_EXTABLE(0b, 0b)
++#endif
++
++RET_ENDP
++BEGIN(inc_unchecked)
++	addl $1,  (v)
++	adcl $0, 4(v)
+ RET_ENDP
+ #undef v
+ 
+@@ -116,6 +205,26 @@ BEGIN(inc_return)
+ 	movl 4(v), %edx
+ 	addl $1, %eax
+ 	adcl $0, %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
++	movl %eax,  (v)
++	movl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++2:
++#endif
++
++RET_ENDP
++BEGIN(inc_return_unchecked)
++	movl  (v), %eax
++	movl 4(v), %edx
++	addl $1, %eax
++	adcl $0, %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ RET_ENDP
+@@ -125,6 +234,20 @@ RET_ENDP
+ BEGIN(dec)
+ 	subl $1,  (v)
+ 	sbbl $0, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++	jno 0f
++	addl $1,  (v)
++	adcl $0, 4(v)
++	int $4
++0:
++	_ASM_EXTABLE(0b, 0b)
++#endif
++
++RET_ENDP
++BEGIN(dec_unchecked)
++	subl $1,  (v)
++	sbbl $0, 4(v)
+ RET_ENDP
+ #undef v
+ 
+@@ -134,6 +257,26 @@ BEGIN(dec_return)
+ 	movl 4(v), %edx
+ 	subl $1, %eax
+ 	sbbl $0, %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
++	movl %eax,  (v)
++	movl %edx, 4(v)
++
++#ifdef CONFIG_PAX_REFCOUNT
++2:
++#endif
++
++RET_ENDP
++BEGIN(dec_return_unchecked)
++	movl  (v), %eax
++	movl 4(v), %edx
++	subl $1, %eax
++	sbbl $0, %edx
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ RET_ENDP
+@@ -145,6 +288,13 @@ BEGIN(add_unless)
+ 	adcl %edx, %edi
+ 	addl  (v), %eax
+ 	adcl 4(v), %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
+ 	cmpl %eax, %esi
+ 	je 3f
+ 1:
+@@ -170,6 +320,13 @@ BEGIN(inc_not_zero)
+ 1:
+ 	addl $1, %eax
+ 	adcl $0, %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+ 	movl $1, %eax
+@@ -188,6 +345,13 @@ BEGIN(dec_if_positive)
+ 	movl 4(v), %edx
+ 	subl $1, %eax
+ 	sbbl $0, %edx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 1f)
++#endif
++
+ 	js 1f
+ 	movl %eax,  (v)
+ 	movl %edx, 4(v)
+diff -urNp linux-2.6.38.7/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.7/arch/x86/lib/atomic64_cx8_32.S
+--- linux-2.6.38.7/arch/x86/lib/atomic64_cx8_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/atomic64_cx8_32.S	2011-05-02 19:07:09.000000000 -0400
+@@ -41,6 +41,14 @@ ENTRY(atomic64_read_cx8)
+ 	CFI_ENDPROC
+ ENDPROC(atomic64_read_cx8)
+ 
++ENTRY(atomic64_read_unchecked_cx8)
++	CFI_STARTPROC
++
++	read64 %ecx
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_read_unchecked_cx8)
++
+ ENTRY(atomic64_set_cx8)
+ 	CFI_STARTPROC
+ 
+@@ -54,6 +62,19 @@ ENTRY(atomic64_set_cx8)
+ 	CFI_ENDPROC
+ ENDPROC(atomic64_set_cx8)
+ 
++ENTRY(atomic64_set_unchecked_cx8)
++	CFI_STARTPROC
++
++1:
++/* we don't need LOCK_PREFIX since aligned 64-bit writes
++ * are atomic on 586 and newer */
++	cmpxchg8b (%esi)
++	jne 1b
++
++	ret
++	CFI_ENDPROC
++ENDPROC(atomic64_set_unchecked_cx8)
++
+ ENTRY(atomic64_xchg_cx8)
+ 	CFI_STARTPROC
+ 
+@@ -68,8 +89,8 @@ ENTRY(atomic64_xchg_cx8)
+ 	CFI_ENDPROC
+ ENDPROC(atomic64_xchg_cx8)
+ 
+-.macro addsub_return func ins insc
+-ENTRY(atomic64_\func\()_return_cx8)
++.macro addsub_return func ins insc unchecked=""
++ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
+ 	CFI_STARTPROC
+ 	SAVE ebp
+ 	SAVE ebx
+@@ -86,27 +107,43 @@ ENTRY(atomic64_\func\()_return_cx8)
  	movl %edx, %ecx
  	\ins\()l %esi, %ebx
  	\insc\()l %edi, %ecx
 +
++.ifb \unchecked
 +#ifdef CONFIG_PAX_REFCOUNT
 +	into
 +2:
 +	_ASM_EXTABLE(2b, 3f)
 +#endif
++.endif
 +
  	LOCK_PREFIX
  	cmpxchg8b (%ebp)
@@ -15380,23 +17531,46 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.2/arch/x86
  	movl %ebx, %eax
  	movl %ecx, %edx
 +
++.ifb \unchecked
 +#ifdef CONFIG_PAX_REFCOUNT
 +3:
 +#endif
++.endif
 +
  	RESTORE edi
  	RESTORE esi
  	RESTORE ebx
-@@ -116,13 +126,24 @@ ENTRY(atomic64_\func\()_return_cx8)
+ 	RESTORE ebp
+ 	ret
+ 	CFI_ENDPROC
+-ENDPROC(atomic64_\func\()_return_cx8)
++ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
+ .endm
+ 
+ addsub_return add add adc
+ addsub_return sub sub sbb
++addsub_return add add adc _unchecked
++addsub_return sub sub sbb _unchecked
+ 
+-.macro incdec_return func ins insc
+-ENTRY(atomic64_\func\()_return_cx8)
++.macro incdec_return func ins insc unchecked
++ENTRY(atomic64_\func\()_return\unchecked\()_cx8)
+ 	CFI_STARTPROC
+ 	SAVE ebx
+ 
+@@ -116,21 +153,38 @@ ENTRY(atomic64_\func\()_return_cx8)
  	movl %edx, %ecx
  	\ins\()l $1, %ebx
  	\insc\()l $0, %ecx
 +
++.ifb \unchecked
 +#ifdef CONFIG_PAX_REFCOUNT
 +	into
 +2:
 +	_ASM_EXTABLE(2b, 3f)
 +#endif
++.endif
 +
  	LOCK_PREFIX
  	cmpxchg8b (%esi)
@@ -15406,14 +17580,41 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.2/arch/x86
  	movl %ebx, %eax
  	movl %ecx, %edx
 +
++.ifb \unchecked
 +#ifdef CONFIG_PAX_REFCOUNT
 +3:
 +#endif
++.endif
 +
  	RESTORE ebx
  	ret
  	CFI_ENDPROC
-@@ -176,6 +197,13 @@ ENTRY(atomic64_add_unless_cx8)
+-ENDPROC(atomic64_\func\()_return_cx8)
++ENDPROC(atomic64_\func\()_return\unchecked\()_cx8)
+ .endm
+ 
+ incdec_return inc add adc
+ incdec_return dec sub sbb
++incdec_return inc add adc _unchecked
++incdec_return dec sub sbb _unchecked
+ 
+ ENTRY(atomic64_dec_if_positive_cx8)
+ 	CFI_STARTPROC
+@@ -142,6 +196,13 @@ ENTRY(atomic64_dec_if_positive_cx8)
+ 	movl %edx, %ecx
+ 	subl $1, %ebx
+ 	sbb $0, %ecx
++
++#ifdef CONFIG_PAX_REFCOUNT
++	into
++1234:
++	_ASM_EXTABLE(1234b, 2f)
++#endif
++
+ 	js 2f
+ 	LOCK_PREFIX
+ 	cmpxchg8b (%esi)
+@@ -176,6 +237,13 @@ ENTRY(atomic64_add_unless_cx8)
  	movl %edx, %ecx
  	addl %esi, %ebx
  	adcl %edi, %ecx
@@ -15421,13 +17622,13 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.2/arch/x86
 +#ifdef CONFIG_PAX_REFCOUNT
 +	into
 +1234:
-+	_ASM_EXTABLE(1234b, 1234b)
++	_ASM_EXTABLE(1234b, 3f)
 +#endif
 +
  	LOCK_PREFIX
  	cmpxchg8b (%ebp)
  	jne 1b
-@@ -208,6 +236,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
+@@ -208,6 +276,13 @@ ENTRY(atomic64_inc_not_zero_cx8)
  	movl %edx, %ecx
  	addl $1, %ebx
  	adcl $0, %ecx
@@ -15435,15 +17636,15 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/atomic64_cx8_32.S linux-2.6.38.2/arch/x86
 +#ifdef CONFIG_PAX_REFCOUNT
 +	into
 +1234:
-+	_ASM_EXTABLE(1234b, 1234b)
++	_ASM_EXTABLE(1234b, 3f)
 +#endif
 +
  	LOCK_PREFIX
  	cmpxchg8b (%esi)
  	jne 1b
-diff -urNp linux-2.6.38.2/arch/x86/lib/checksum_32.S linux-2.6.38.2/arch/x86/lib/checksum_32.S
---- linux-2.6.38.2/arch/x86/lib/checksum_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/checksum_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/checksum_32.S linux-2.6.38.7/arch/x86/lib/checksum_32.S
+--- linux-2.6.38.7/arch/x86/lib/checksum_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/checksum_32.S	2011-04-28 19:34:14.000000000 -0400
 @@ -28,7 +28,8 @@
  #include <linux/linkage.h>
  #include <asm/dwarf2.h>
@@ -15704,9 +17905,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/checksum_32.S linux-2.6.38.2/arch/x86/lib
  				
  #undef ROUND
  #undef ROUND1		
-diff -urNp linux-2.6.38.2/arch/x86/lib/clear_page_64.S linux-2.6.38.2/arch/x86/lib/clear_page_64.S
---- linux-2.6.38.2/arch/x86/lib/clear_page_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/clear_page_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/clear_page_64.S linux-2.6.38.7/arch/x86/lib/clear_page_64.S
+--- linux-2.6.38.7/arch/x86/lib/clear_page_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/clear_page_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -43,7 +43,7 @@ ENDPROC(clear_page)
  
  #include <asm/cpufeature.h>
@@ -15716,9 +17917,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/clear_page_64.S linux-2.6.38.2/arch/x86/l
  1:	.byte 0xeb					/* jmp <disp8> */
  	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
  2:
-diff -urNp linux-2.6.38.2/arch/x86/lib/copy_page_64.S linux-2.6.38.2/arch/x86/lib/copy_page_64.S
---- linux-2.6.38.2/arch/x86/lib/copy_page_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/copy_page_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/copy_page_64.S linux-2.6.38.7/arch/x86/lib/copy_page_64.S
+--- linux-2.6.38.7/arch/x86/lib/copy_page_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/copy_page_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -104,7 +104,7 @@ ENDPROC(copy_page)
  
  #include <asm/cpufeature.h>
@@ -15728,9 +17929,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/copy_page_64.S linux-2.6.38.2/arch/x86/li
  1:	.byte 0xeb					/* jmp <disp8> */
  	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
  2:
-diff -urNp linux-2.6.38.2/arch/x86/lib/copy_user_64.S linux-2.6.38.2/arch/x86/lib/copy_user_64.S
---- linux-2.6.38.2/arch/x86/lib/copy_user_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/copy_user_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/copy_user_64.S linux-2.6.38.7/arch/x86/lib/copy_user_64.S
+--- linux-2.6.38.7/arch/x86/lib/copy_user_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/copy_user_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -15,13 +15,14 @@
  #include <asm/asm-offsets.h>
  #include <asm/thread_info.h>
@@ -15787,9 +17988,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/copy_user_64.S linux-2.6.38.2/arch/x86/li
  	movl %edx,%ecx
  	xorl %eax,%eax
  	rep
-diff -urNp linux-2.6.38.2/arch/x86/lib/copy_user_nocache_64.S linux-2.6.38.2/arch/x86/lib/copy_user_nocache_64.S
---- linux-2.6.38.2/arch/x86/lib/copy_user_nocache_64.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/copy_user_nocache_64.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/copy_user_nocache_64.S linux-2.6.38.7/arch/x86/lib/copy_user_nocache_64.S
+--- linux-2.6.38.7/arch/x86/lib/copy_user_nocache_64.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/copy_user_nocache_64.S	2011-04-28 19:34:14.000000000 -0400
 @@ -14,6 +14,7 @@
  #include <asm/current.h>
  #include <asm/asm-offsets.h>
@@ -15814,30 +18015,38 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/copy_user_nocache_64.S linux-2.6.38.2/arc
  	cmpl $8,%edx
  	jb 20f		/* less then 8 bytes, go to byte copy loop */
  	ALIGN_DESTINATION
-diff -urNp linux-2.6.38.2/arch/x86/lib/csum-wrappers_64.c linux-2.6.38.2/arch/x86/lib/csum-wrappers_64.c
---- linux-2.6.38.2/arch/x86/lib/csum-wrappers_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/csum-wrappers_64.c	2011-03-21 18:31:35.000000000 -0400
-@@ -52,6 +52,8 @@ csum_partial_copy_from_user(const void _
+diff -urNp linux-2.6.38.7/arch/x86/lib/csum-wrappers_64.c linux-2.6.38.7/arch/x86/lib/csum-wrappers_64.c
+--- linux-2.6.38.7/arch/x86/lib/csum-wrappers_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/csum-wrappers_64.c	2011-04-28 19:57:25.000000000 -0400
+@@ -52,6 +52,12 @@ csum_partial_copy_from_user(const void _
  			len -= 2;
  		}
  	}
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +		src += PAX_USER_SHADOW_BASE;
++#endif
++
  	isum = csum_partial_copy_generic((__force const void *)src,
  				dst, len, isum, errp, NULL);
  	if (unlikely(*errp))
-@@ -105,6 +107,8 @@ csum_partial_copy_to_user(const void *sr
+@@ -105,6 +111,12 @@ csum_partial_copy_to_user(const void *sr
  	}
  
  	*errp = 0;
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
 +		dst += PAX_USER_SHADOW_BASE;
++#endif
++
  	return csum_partial_copy_generic(src, (void __force *)dst,
  					 len, isum, NULL, errp);
  }
-diff -urNp linux-2.6.38.2/arch/x86/lib/getuser.S linux-2.6.38.2/arch/x86/lib/getuser.S
---- linux-2.6.38.2/arch/x86/lib/getuser.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/getuser.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/getuser.S linux-2.6.38.7/arch/x86/lib/getuser.S
+--- linux-2.6.38.7/arch/x86/lib/getuser.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/getuser.S	2011-04-28 19:34:14.000000000 -0400
 @@ -33,14 +33,35 @@
  #include <asm/asm-offsets.h>
  #include <asm/thread_info.h>
@@ -15943,9 +18152,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/getuser.S linux-2.6.38.2/arch/x86/lib/get
  4:	movq -7(%_ASM_AX),%_ASM_DX
  	xor %eax,%eax
  	ret
-diff -urNp linux-2.6.38.2/arch/x86/lib/insn.c linux-2.6.38.2/arch/x86/lib/insn.c
---- linux-2.6.38.2/arch/x86/lib/insn.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/insn.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/insn.c linux-2.6.38.7/arch/x86/lib/insn.c
+--- linux-2.6.38.7/arch/x86/lib/insn.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/insn.c	2011-04-28 19:34:14.000000000 -0400
 @@ -21,6 +21,11 @@
  #include <linux/string.h>
  #include <asm/inat.h>
@@ -15969,9 +18178,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/insn.c linux-2.6.38.2/arch/x86/lib/insn.c
  	insn->x86_64 = x86_64 ? 1 : 0;
  	insn->opnd_bytes = 4;
  	if (x86_64)
-diff -urNp linux-2.6.38.2/arch/x86/lib/mmx_32.c linux-2.6.38.2/arch/x86/lib/mmx_32.c
---- linux-2.6.38.2/arch/x86/lib/mmx_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/mmx_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/mmx_32.c linux-2.6.38.7/arch/x86/lib/mmx_32.c
+--- linux-2.6.38.7/arch/x86/lib/mmx_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/mmx_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -29,6 +29,7 @@ void *_mmx_memcpy(void *to, const void *
  {
  	void *p;
@@ -16287,9 +18496,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/mmx_32.c linux-2.6.38.2/arch/x86/lib/mmx_
  
  		from += 64;
  		to += 64;
-diff -urNp linux-2.6.38.2/arch/x86/lib/putuser.S linux-2.6.38.2/arch/x86/lib/putuser.S
---- linux-2.6.38.2/arch/x86/lib/putuser.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/putuser.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/putuser.S linux-2.6.38.7/arch/x86/lib/putuser.S
+--- linux-2.6.38.7/arch/x86/lib/putuser.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/putuser.S	2011-04-28 19:34:14.000000000 -0400
 @@ -15,7 +15,8 @@
  #include <asm/thread_info.h>
  #include <asm/errno.h>
@@ -16427,9 +18636,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/putuser.S linux-2.6.38.2/arch/x86/lib/put
  #endif
  	xor %eax,%eax
  	EXIT
-diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_32.c linux-2.6.38.2/arch/x86/lib/usercopy_32.c
---- linux-2.6.38.2/arch/x86/lib/usercopy_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/usercopy_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/lib/usercopy_32.c linux-2.6.38.7/arch/x86/lib/usercopy_32.c
+--- linux-2.6.38.7/arch/x86/lib/usercopy_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/usercopy_32.c	2011-04-28 19:34:14.000000000 -0400
 @@ -43,7 +43,7 @@ do {									   \
  	__asm__ __volatile__(						   \
  		"	testl %1,%1\n"					   \
@@ -16951,7 +19160,7 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_32.c linux-2.6.38.2/arch/x86/lib
  	return n;
  }
  EXPORT_SYMBOL(__copy_from_user_ll_nozero);
-@@ -827,65 +943,49 @@ unsigned long __copy_from_user_ll_nocach
+@@ -827,65 +943,50 @@ unsigned long __copy_from_user_ll_nocach
  	if (n > 64 && cpu_has_xmm2)
  		n = __copy_user_intel_nocache(to, from, n);
  	else
@@ -17041,6 +19250,7 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_32.c linux-2.6.38.2/arch/x86/lib
 +	return;
  }
 -EXPORT_SYMBOL(copy_from_user_overflow);
++EXPORT_SYMBOL(__set_fs);
 +
 +void set_fs(mm_segment_t x)
 +{
@@ -17049,37 +19259,49 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_32.c linux-2.6.38.2/arch/x86/lib
 +}
 +EXPORT_SYMBOL(set_fs);
 +#endif
-diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_64.c linux-2.6.38.2/arch/x86/lib/usercopy_64.c
---- linux-2.6.38.2/arch/x86/lib/usercopy_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/lib/usercopy_64.c	2011-03-21 18:31:35.000000000 -0400
-@@ -42,6 +42,8 @@ long
+diff -urNp linux-2.6.38.7/arch/x86/lib/usercopy_64.c linux-2.6.38.7/arch/x86/lib/usercopy_64.c
+--- linux-2.6.38.7/arch/x86/lib/usercopy_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/lib/usercopy_64.c	2011-04-28 19:57:25.000000000 -0400
+@@ -42,6 +42,12 @@ long
  __strncpy_from_user(char *dst, const char __user *src, long count)
  {
  	long res;
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
 +		src += PAX_USER_SHADOW_BASE;
++#endif
++
  	__do_strncpy_from_user(dst, src, count, res);
  	return res;
  }
-@@ -65,6 +67,8 @@ unsigned long __clear_user(void __user *
+@@ -65,6 +71,12 @@ unsigned long __clear_user(void __user *
  {
  	long __d0;
  	might_fault();
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
 +		addr += PAX_USER_SHADOW_BASE;
++#endif
++
  	/* no memory constraint because it doesn't change any memory gcc knows
  	   about */
  	asm volatile(
-@@ -151,10 +155,14 @@ EXPORT_SYMBOL(strlen_user);
+@@ -151,10 +163,18 @@ EXPORT_SYMBOL(strlen_user);
  
  unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
  {
 -	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
 +	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
 +		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
 +			to += PAX_USER_SHADOW_BASE;
 +		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
 +			from += PAX_USER_SHADOW_BASE;
++#endif
++
  		return copy_user_generic((__force void *)to, (__force void *)from, len);
 -	} 
 -	return len;		
@@ -17088,9 +19310,9 @@ diff -urNp linux-2.6.38.2/arch/x86/lib/usercopy_64.c linux-2.6.38.2/arch/x86/lib
  }
  EXPORT_SYMBOL(copy_in_user);
  
-diff -urNp linux-2.6.38.2/arch/x86/Makefile linux-2.6.38.2/arch/x86/Makefile
---- linux-2.6.38.2/arch/x86/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/Makefile linux-2.6.38.7/arch/x86/Makefile
+--- linux-2.6.38.7/arch/x86/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/Makefile	2011-04-28 19:34:14.000000000 -0400
 @@ -195,3 +195,12 @@ define archhelp
    echo  '                  FDARGS="..."  arguments for the booted kernel'
    echo  '                  FDINITRD=file initrd for the booted kernel'
@@ -17104,9 +19326,9 @@ diff -urNp linux-2.6.38.2/arch/x86/Makefile linux-2.6.38.2/arch/x86/Makefile
 +
 +archprepare:
 +	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
-diff -urNp linux-2.6.38.2/arch/x86/mm/extable.c linux-2.6.38.2/arch/x86/mm/extable.c
---- linux-2.6.38.2/arch/x86/mm/extable.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/extable.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/extable.c linux-2.6.38.7/arch/x86/mm/extable.c
+--- linux-2.6.38.7/arch/x86/mm/extable.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/extable.c	2011-04-28 19:34:14.000000000 -0400
 @@ -1,14 +1,71 @@
  #include <linux/module.h>
  #include <linux/spinlock.h>
@@ -17180,9 +19402,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/extable.c linux-2.6.38.2/arch/x86/mm/extab
  		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
  		extern u32 pnp_bios_is_utter_crap;
  		pnp_bios_is_utter_crap = 1;
-diff -urNp linux-2.6.38.2/arch/x86/mm/fault.c linux-2.6.38.2/arch/x86/mm/fault.c
---- linux-2.6.38.2/arch/x86/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/fault.c	2011-03-21 23:48:53.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/fault.c linux-2.6.38.7/arch/x86/mm/fault.c
+--- linux-2.6.38.7/arch/x86/mm/fault.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/fault.c	2011-05-22 23:31:40.000000000 -0400
 @@ -12,10 +12,18 @@
  #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
  #include <linux/perf_event.h>		/* perf_sw_event		*/
@@ -17852,9 +20074,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/fault.c linux-2.6.38.2/arch/x86/mm/fault.c
 +
 +	return ret ? -EFAULT : 0;
 +}
-diff -urNp linux-2.6.38.2/arch/x86/mm/gup.c linux-2.6.38.2/arch/x86/mm/gup.c
---- linux-2.6.38.2/arch/x86/mm/gup.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/gup.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/gup.c linux-2.6.38.7/arch/x86/mm/gup.c
+--- linux-2.6.38.7/arch/x86/mm/gup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/gup.c	2011-04-28 19:34:14.000000000 -0400
 @@ -263,7 +263,7 @@ int __get_user_pages_fast(unsigned long 
  	addr = start;
  	len = (unsigned long) nr_pages << PAGE_SHIFT;
@@ -17864,9 +20086,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/gup.c linux-2.6.38.2/arch/x86/mm/gup.c
  					(void __user *)start, len)))
  		return 0;
  
-diff -urNp linux-2.6.38.2/arch/x86/mm/highmem_32.c linux-2.6.38.2/arch/x86/mm/highmem_32.c
---- linux-2.6.38.2/arch/x86/mm/highmem_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/highmem_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/highmem_32.c linux-2.6.38.7/arch/x86/mm/highmem_32.c
+--- linux-2.6.38.7/arch/x86/mm/highmem_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/highmem_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -44,7 +44,10 @@ void *kmap_atomic_prot(struct page *page
  	idx = type + KM_TYPE_NR*smp_processor_id();
  	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
@@ -17878,9 +20100,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/highmem_32.c linux-2.6.38.2/arch/x86/mm/hi
  
  	return (void *)vaddr;
  }
-diff -urNp linux-2.6.38.2/arch/x86/mm/hugetlbpage.c linux-2.6.38.2/arch/x86/mm/hugetlbpage.c
---- linux-2.6.38.2/arch/x86/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/hugetlbpage.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/hugetlbpage.c linux-2.6.38.7/arch/x86/mm/hugetlbpage.c
+--- linux-2.6.38.7/arch/x86/mm/hugetlbpage.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/hugetlbpage.c	2011-04-28 19:34:15.000000000 -0400
 @@ -266,13 +266,20 @@ static unsigned long hugetlb_get_unmappe
  	struct hstate *h = hstate_file(file);
  	struct mm_struct *mm = current->mm;
@@ -18088,9 +20310,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/hugetlbpage.c linux-2.6.38.2/arch/x86/mm/h
  			return addr;
  	}
  	if (mm->get_unmapped_area == arch_get_unmapped_area)
-diff -urNp linux-2.6.38.2/arch/x86/mm/init_32.c linux-2.6.38.2/arch/x86/mm/init_32.c
---- linux-2.6.38.2/arch/x86/mm/init_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/init_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/init_32.c linux-2.6.38.7/arch/x86/mm/init_32.c
+--- linux-2.6.38.7/arch/x86/mm/init_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/init_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -74,36 +74,6 @@ static __init void *alloc_low_page(void)
  }
  
@@ -18365,10 +20587,10 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_32.c linux-2.6.38.2/arch/x86/mm/init_
  	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
  	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
  		size >> 10);
-diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_64.c
---- linux-2.6.38.2/arch/x86/mm/init_64.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/init_64.c	2011-03-28 17:42:53.000000000 -0400
-@@ -73,7 +73,7 @@ early_param("gbpages", parse_direct_gbpa
+diff -urNp linux-2.6.38.7/arch/x86/mm/init_64.c linux-2.6.38.7/arch/x86/mm/init_64.c
+--- linux-2.6.38.7/arch/x86/mm/init_64.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/init_64.c	2011-04-28 19:34:15.000000000 -0400
+@@ -72,7 +72,7 @@ early_param("gbpages", parse_direct_gbpa
   * around without checking the pgd every time.
   */
  
@@ -18377,7 +20599,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  EXPORT_SYMBOL_GPL(__supported_pte_mask);
  
  int force_personality32;
-@@ -106,12 +106,22 @@ void sync_global_pgds(unsigned long star
+@@ -105,12 +105,22 @@ void sync_global_pgds(unsigned long star
  
  	for (address = start; address <= end; address += PGDIR_SIZE) {
  		const pgd_t *pgd_ref = pgd_offset_k(address);
@@ -18400,7 +20622,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  		list_for_each_entry(page, &pgd_list, lru) {
  			pgd_t *pgd;
  			spinlock_t *pgt_lock;
-@@ -120,6 +130,7 @@ void sync_global_pgds(unsigned long star
+@@ -119,6 +129,7 @@ void sync_global_pgds(unsigned long star
  			/* the pgt_lock only for Xen */
  			pgt_lock = &pgd_page_get_mm(page)->page_table_lock;
  			spin_lock(pgt_lock);
@@ -18408,7 +20630,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  
  			if (pgd_none(*pgd))
  				set_pgd(pgd, *pgd_ref);
-@@ -127,7 +138,10 @@ void sync_global_pgds(unsigned long star
+@@ -126,7 +137,10 @@ void sync_global_pgds(unsigned long star
  				BUG_ON(pgd_page_vaddr(*pgd)
  				       != pgd_page_vaddr(*pgd_ref));
  
@@ -18419,7 +20641,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  		}
  		spin_unlock(&pgd_lock);
  	}
-@@ -201,7 +215,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
+@@ -200,7 +214,9 @@ void set_pte_vaddr_pud(pud_t *pud_page, 
  	pmd = fill_pmd(pud, vaddr);
  	pte = fill_pte(pmd, vaddr);
  
@@ -18429,7 +20651,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  
  	/*
  	 * It's enough to flush this one mapping.
-@@ -260,14 +276,12 @@ static void __init __init_extra_mapping(
+@@ -259,14 +275,12 @@ static void __init __init_extra_mapping(
  		pgd = pgd_offset_k((unsigned long)__va(phys));
  		if (pgd_none(*pgd)) {
  			pud = (pud_t *) spp_getpage();
@@ -18446,7 +20668,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  		}
  		pmd = pmd_offset(pud, phys);
  		BUG_ON(!pmd_none(*pmd));
-@@ -707,6 +721,12 @@ void __init mem_init(void)
+@@ -706,6 +720,12 @@ void __init mem_init(void)
  
  	pci_iommu_alloc();
  
@@ -18459,7 +20681,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  	/* clear_bss() already clear the empty_zero_page */
  
  	reservedpages = 0;
-@@ -867,8 +887,8 @@ int kern_addr_valid(unsigned long addr)
+@@ -866,8 +886,8 @@ int kern_addr_valid(unsigned long addr)
  static struct vm_area_struct gate_vma = {
  	.vm_start	= VSYSCALL_START,
  	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
@@ -18470,7 +20692,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  };
  
  struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
-@@ -902,7 +922,7 @@ int in_gate_area_no_task(unsigned long a
+@@ -901,7 +921,7 @@ int in_gate_area_no_task(unsigned long a
  
  const char *arch_vma_name(struct vm_area_struct *vma)
  {
@@ -18479,9 +20701,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init_64.c linux-2.6.38.2/arch/x86/mm/init_
  		return "[vdso]";
  	if (vma == &gate_vma)
  		return "[vsyscall]";
-diff -urNp linux-2.6.38.2/arch/x86/mm/init.c linux-2.6.38.2/arch/x86/mm/init.c
---- linux-2.6.38.2/arch/x86/mm/init.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/init.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/init.c linux-2.6.38.7/arch/x86/mm/init.c
+--- linux-2.6.38.7/arch/x86/mm/init.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/init.c	2011-04-28 19:34:15.000000000 -0400
 @@ -72,11 +72,7 @@ static void __init find_early_table_spac
  	 * cause a hotspot and fill up ZONE_DMA. The page tables
  	 * need roughly 0.5KB per GB.
@@ -18495,22 +20717,25 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init.c linux-2.6.38.2/arch/x86/mm/init.c
  	base = memblock_find_in_range(start, max_pfn_mapped<<PAGE_SHIFT,
  					tables, PAGE_SIZE);
  	if (base == MEMBLOCK_ERROR)
-@@ -304,7 +300,13 @@ unsigned long __init_refok init_memory_m
+@@ -323,7 +319,16 @@ unsigned long __init_refok init_memory_m
   */
  int devmem_is_allowed(unsigned long pagenr)
  {
 -	if (pagenr <= 256)
++#ifndef CONFIG_GRKERNSEC_KMEM
 +	if (!pagenr)
 +		return 1;
 +#ifdef CONFIG_VM86
 +	if (pagenr < (ISA_START_ADDRESS >> PAGE_SHIFT))
 +		return 1;
 +#endif
++#endif
++
 +	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
  		return 1;
  	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
  		return 0;
-@@ -364,6 +366,86 @@ void free_init_pages(char *what, unsigne
+@@ -383,6 +388,86 @@ void free_init_pages(char *what, unsigne
  
  void free_initmem(void)
  {
@@ -18597,9 +20822,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/init.c linux-2.6.38.2/arch/x86/mm/init.c
  	free_init_pages("unused kernel memory",
  			(unsigned long)(&__init_begin),
  			(unsigned long)(&__init_end));
-diff -urNp linux-2.6.38.2/arch/x86/mm/iomap_32.c linux-2.6.38.2/arch/x86/mm/iomap_32.c
---- linux-2.6.38.2/arch/x86/mm/iomap_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/iomap_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/iomap_32.c linux-2.6.38.7/arch/x86/mm/iomap_32.c
+--- linux-2.6.38.7/arch/x86/mm/iomap_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/iomap_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -64,7 +64,11 @@ void *kmap_atomic_prot_pfn(unsigned long
  	type = kmap_atomic_idx_push();
  	idx = type + KM_TYPE_NR * smp_processor_id();
@@ -18612,9 +20837,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/iomap_32.c linux-2.6.38.2/arch/x86/mm/ioma
  	arch_flush_lazy_mmu_mode();
  
  	return (void *)vaddr;
-diff -urNp linux-2.6.38.2/arch/x86/mm/ioremap.c linux-2.6.38.2/arch/x86/mm/ioremap.c
---- linux-2.6.38.2/arch/x86/mm/ioremap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/ioremap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/ioremap.c linux-2.6.38.7/arch/x86/mm/ioremap.c
+--- linux-2.6.38.7/arch/x86/mm/ioremap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/ioremap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -104,7 +104,7 @@ static void __iomem *__ioremap_caller(re
  	for (pfn = phys_addr >> PAGE_SHIFT; pfn <= last_pfn; pfn++) {
  		int is_ram = page_is_ram(pfn);
@@ -18643,9 +20868,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/ioremap.c linux-2.6.38.2/arch/x86/mm/iorem
  
  	/*
  	 * The boot-ioremap range spans multiple pmds, for which
-diff -urNp linux-2.6.38.2/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.38.2/arch/x86/mm/kmemcheck/kmemcheck.c
---- linux-2.6.38.2/arch/x86/mm/kmemcheck/kmemcheck.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/kmemcheck/kmemcheck.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.38.7/arch/x86/mm/kmemcheck/kmemcheck.c
+--- linux-2.6.38.7/arch/x86/mm/kmemcheck/kmemcheck.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/kmemcheck/kmemcheck.c	2011-04-28 19:34:15.000000000 -0400
 @@ -622,9 +622,9 @@ bool kmemcheck_fault(struct pt_regs *reg
  	 * memory (e.g. tracked pages)? For now, we need this to avoid
  	 * invoking kmemcheck for PnP BIOS calls.
@@ -18658,9 +20883,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.38.2/arch/
  		return false;
  
  	pte = kmemcheck_pte_lookup(address);
-diff -urNp linux-2.6.38.2/arch/x86/mm/mmap.c linux-2.6.38.2/arch/x86/mm/mmap.c
---- linux-2.6.38.2/arch/x86/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/mmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/mmap.c linux-2.6.38.7/arch/x86/mm/mmap.c
+--- linux-2.6.38.7/arch/x86/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/mmap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -49,7 +49,7 @@ static unsigned int stack_maxrandom_size
   * Leave an at least ~128 MB hole with possible stack randomization.
   */
@@ -18742,9 +20967,30 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/mmap.c linux-2.6.38.2/arch/x86/mm/mmap.c
  		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
  		mm->unmap_area = arch_unmap_area_topdown;
  	}
-diff -urNp linux-2.6.38.2/arch/x86/mm/numa_32.c linux-2.6.38.2/arch/x86/mm/numa_32.c
---- linux-2.6.38.2/arch/x86/mm/numa_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/numa_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/mmio-mod.c linux-2.6.38.7/arch/x86/mm/mmio-mod.c
+--- linux-2.6.38.7/arch/x86/mm/mmio-mod.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/mmio-mod.c	2011-04-28 19:57:25.000000000 -0400
+@@ -235,7 +235,7 @@ static void post(struct kmmio_probe *p, 
+ static void ioremap_trace_core(resource_size_t offset, unsigned long size,
+ 							void __iomem *addr)
+ {
+-	static atomic_t next_id;
++	static atomic_unchecked_t next_id;
+ 	struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
+ 	/* These are page-unaligned. */
+ 	struct mmiotrace_map map = {
+@@ -259,7 +259,7 @@ static void ioremap_trace_core(resource_
+ 			.private = trace
+ 		},
+ 		.phys = offset,
+-		.id = atomic_inc_return(&next_id)
++		.id = atomic_inc_return_unchecked(&next_id)
+ 	};
+ 	map.map_id = trace->id;
+ 
+diff -urNp linux-2.6.38.7/arch/x86/mm/numa_32.c linux-2.6.38.7/arch/x86/mm/numa_32.c
+--- linux-2.6.38.7/arch/x86/mm/numa_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/numa_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -99,7 +99,6 @@ unsigned long node_memmap_size_bytes(int
  }
  #endif
@@ -18753,9 +20999,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/numa_32.c linux-2.6.38.2/arch/x86/mm/numa_
  extern unsigned long highend_pfn, highstart_pfn;
  
  #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
-diff -urNp linux-2.6.38.2/arch/x86/mm/pageattr.c linux-2.6.38.2/arch/x86/mm/pageattr.c
---- linux-2.6.38.2/arch/x86/mm/pageattr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/pageattr.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/pageattr.c linux-2.6.38.7/arch/x86/mm/pageattr.c
+--- linux-2.6.38.7/arch/x86/mm/pageattr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/pageattr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -261,7 +261,7 @@ static inline pgprot_t static_protection
  	 */
  #ifdef CONFIG_PCI_BIOS
@@ -18840,9 +21086,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pageattr.c linux-2.6.38.2/arch/x86/mm/page
  }
  
  static int
-diff -urNp linux-2.6.38.2/arch/x86/mm/pageattr-test.c linux-2.6.38.2/arch/x86/mm/pageattr-test.c
---- linux-2.6.38.2/arch/x86/mm/pageattr-test.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/pageattr-test.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/pageattr-test.c linux-2.6.38.7/arch/x86/mm/pageattr-test.c
+--- linux-2.6.38.7/arch/x86/mm/pageattr-test.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/pageattr-test.c	2011-04-28 19:34:15.000000000 -0400
 @@ -36,7 +36,7 @@ enum {
  
  static int pte_testbit(pte_t pte)
@@ -18852,9 +21098,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pageattr-test.c linux-2.6.38.2/arch/x86/mm
  }
  
  struct split_state {
-diff -urNp linux-2.6.38.2/arch/x86/mm/pat.c linux-2.6.38.2/arch/x86/mm/pat.c
---- linux-2.6.38.2/arch/x86/mm/pat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/pat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/pat.c linux-2.6.38.7/arch/x86/mm/pat.c
+--- linux-2.6.38.7/arch/x86/mm/pat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/pat.c	2011-04-28 19:34:15.000000000 -0400
 @@ -361,7 +361,7 @@ int free_memtype(u64 start, u64 end)
  
  	if (!entry) {
@@ -18902,9 +21148,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pat.c linux-2.6.38.2/arch/x86/mm/pat.c
  				cattr_name(want_flags),
  				(unsigned long long)paddr,
  				(unsigned long long)(paddr + size),
-diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable_32.c linux-2.6.38.2/arch/x86/mm/pgtable_32.c
---- linux-2.6.38.2/arch/x86/mm/pgtable_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/pgtable_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/pgtable_32.c linux-2.6.38.7/arch/x86/mm/pgtable_32.c
+--- linux-2.6.38.7/arch/x86/mm/pgtable_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/pgtable_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -48,10 +48,13 @@ void set_pte_vaddr(unsigned long vaddr, 
  		return;
  	}
@@ -18919,10 +21165,10 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable_32.c linux-2.6.38.2/arch/x86/mm/pg
  
  	/*
  	 * It's enough to flush this one mapping.
-diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtable.c
---- linux-2.6.38.2/arch/x86/mm/pgtable.c	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/pgtable.c	2011-03-24 23:22:14.000000000 -0400
-@@ -84,9 +84,58 @@ static inline void pgd_list_del(pgd_t *p
+diff -urNp linux-2.6.38.7/arch/x86/mm/pgtable.c linux-2.6.38.7/arch/x86/mm/pgtable.c
+--- linux-2.6.38.7/arch/x86/mm/pgtable.c	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/pgtable.c	2011-05-11 18:34:57.000000000 -0400
+@@ -84,10 +84,52 @@ static inline void pgd_list_del(pgd_t *p
  	list_del(&page->lru);
  }
  
@@ -18948,13 +21194,10 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
 +#else
 +		*dst++ = *src++;
 +#endif
-+
+ 
 +}
 +#endif
 +
-+#ifdef CONFIG_PAX_PER_CPU_PGD
-+static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
-+static inline void pgd_dtor(pgd_t *pgd) {}
 +#ifdef CONFIG_X86_64
 +#define pxd_t				pud_t
 +#define pyd_t				pgd_t
@@ -18972,18 +21215,15 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
 +#define pyd_offset(mm ,address)		pud_offset((mm), (address))
 +#define PYD_SIZE			PUD_SIZE
 +#endif
++
++#ifdef CONFIG_PAX_PER_CPU_PGD
++static inline void pgd_ctor(struct mm_struct *mm, pgd_t *pgd) {}
++static inline void pgd_dtor(pgd_t *pgd) {}
 +#else
-+#define pxd_t				pmd_t
-+#define pyd_t				pud_t
-+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
-+#define pxd_free(mm, pmd)		pmd_free((mm), (pmd))
-+#define pyd_populate(mm, pud, pmd)	pud_populate((mm), (pud), (pmd))
-+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
-+#define PYD_SIZE			PUD_SIZE
- 
  static void pgd_set_mm(pgd_t *pgd, struct mm_struct *mm)
  {
-@@ -128,6 +177,7 @@ static void pgd_dtor(pgd_t *pgd)
+ 	BUILD_BUG_ON(sizeof(virt_to_page(pgd)->index) < sizeof(mm));
+@@ -128,6 +170,7 @@ static void pgd_dtor(pgd_t *pgd)
  	pgd_list_del(pgd);
  	spin_unlock(&pgd_lock);
  }
@@ -18991,7 +21231,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  
  /*
   * List of all pgd's needed for non-PAE so it can invalidate entries
-@@ -140,7 +190,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -140,7 +183,7 @@ static void pgd_dtor(pgd_t *pgd)
   * -- wli
   */
  
@@ -19000,7 +21240,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  /*
   * In PAE mode, we need to do a cr3 reload (=tlb flush) when
   * updating the top-level pagetable entries to guarantee the
-@@ -152,7 +202,7 @@ static void pgd_dtor(pgd_t *pgd)
+@@ -152,7 +195,7 @@ static void pgd_dtor(pgd_t *pgd)
   * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
   * and initialize the kernel pmds here.
   */
@@ -19009,7 +21249,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  
  void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
  {
-@@ -170,36 +220,38 @@ void pud_populate(struct mm_struct *mm, 
+@@ -170,36 +213,38 @@ void pud_populate(struct mm_struct *mm, 
  	 */
  	flush_tlb_mm(mm);
  }
@@ -19059,7 +21299,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  		return -ENOMEM;
  	}
  
-@@ -212,51 +264,55 @@ static int preallocate_pmds(pmd_t *pmds[
+@@ -212,51 +257,55 @@ static int preallocate_pmds(pmd_t *pmds[
   * preallocate which never got a corresponding vma will need to be
   * freed manually.
   */
@@ -19132,7 +21372,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  
  	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
  
-@@ -265,11 +321,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+@@ -265,11 +314,11 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
  
  	mm->pgd = pgd;
  
@@ -19146,7 +21386,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  
  	/*
  	 * Make sure that pre-populating the pmds is atomic with
-@@ -279,14 +335,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
+@@ -279,14 +328,14 @@ pgd_t *pgd_alloc(struct mm_struct *mm)
  	spin_lock(&pgd_lock);
  
  	pgd_ctor(mm, pgd);
@@ -19164,7 +21404,7 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  out_free_pgd:
  	free_page((unsigned long)pgd);
  out:
-@@ -295,7 +351,7 @@ out:
+@@ -295,7 +344,7 @@ out:
  
  void pgd_free(struct mm_struct *mm, pgd_t *pgd)
  {
@@ -19173,9 +21413,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/pgtable.c linux-2.6.38.2/arch/x86/mm/pgtab
  	pgd_dtor(pgd);
  	paravirt_pgd_free(mm, pgd);
  	free_page((unsigned long)pgd);
-diff -urNp linux-2.6.38.2/arch/x86/mm/setup_nx.c linux-2.6.38.2/arch/x86/mm/setup_nx.c
---- linux-2.6.38.2/arch/x86/mm/setup_nx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/setup_nx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/mm/setup_nx.c linux-2.6.38.7/arch/x86/mm/setup_nx.c
+--- linux-2.6.38.7/arch/x86/mm/setup_nx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/setup_nx.c	2011-04-28 19:34:15.000000000 -0400
 @@ -5,8 +5,10 @@
  #include <asm/pgtable.h>
  #include <asm/proto.h>
@@ -19205,18 +21445,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/setup_nx.c linux-2.6.38.2/arch/x86/mm/setu
  		__supported_pte_mask &= ~_PAGE_NX;
  }
  
-diff -urNp linux-2.6.38.2/arch/x86/mm/tlb.c linux-2.6.38.2/arch/x86/mm/tlb.c
---- linux-2.6.38.2/arch/x86/mm/tlb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/mm/tlb.c	2011-03-21 18:31:35.000000000 -0400
-@@ -14,7 +14,7 @@
- #include <asm/uv/uv.h>
- 
- DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
--			= { &init_mm, 0, };
-+			= { &init_mm, 0 };
- 
- /*
-  *	Smarter SMP flushing macros.
+diff -urNp linux-2.6.38.7/arch/x86/mm/tlb.c linux-2.6.38.7/arch/x86/mm/tlb.c
+--- linux-2.6.38.7/arch/x86/mm/tlb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/mm/tlb.c	2011-04-28 19:34:15.000000000 -0400
 @@ -65,7 +65,11 @@ void leave_mm(int cpu)
  		BUG();
  	cpumask_clear_cpu(cpu,
@@ -19229,9 +21460,9 @@ diff -urNp linux-2.6.38.2/arch/x86/mm/tlb.c linux-2.6.38.2/arch/x86/mm/tlb.c
  }
  EXPORT_SYMBOL_GPL(leave_mm);
  
-diff -urNp linux-2.6.38.2/arch/x86/oprofile/backtrace.c linux-2.6.38.2/arch/x86/oprofile/backtrace.c
---- linux-2.6.38.2/arch/x86/oprofile/backtrace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/oprofile/backtrace.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/oprofile/backtrace.c linux-2.6.38.7/arch/x86/oprofile/backtrace.c
+--- linux-2.6.38.7/arch/x86/oprofile/backtrace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/oprofile/backtrace.c	2011-04-28 19:34:15.000000000 -0400
 @@ -57,7 +57,7 @@ dump_user_backtrace_32(struct stack_fram
  	struct stack_frame_ia32 *fp;
  
@@ -19250,9 +21481,9 @@ diff -urNp linux-2.6.38.2/arch/x86/oprofile/backtrace.c linux-2.6.38.2/arch/x86/
  		unsigned long stack = kernel_stack_pointer(regs);
  		if (depth)
  			dump_trace(NULL, regs, (unsigned long *)stack,
-diff -urNp linux-2.6.38.2/arch/x86/oprofile/op_model_p4.c linux-2.6.38.2/arch/x86/oprofile/op_model_p4.c
---- linux-2.6.38.2/arch/x86/oprofile/op_model_p4.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/oprofile/op_model_p4.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/oprofile/op_model_p4.c linux-2.6.38.7/arch/x86/oprofile/op_model_p4.c
+--- linux-2.6.38.7/arch/x86/oprofile/op_model_p4.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/oprofile/op_model_p4.c	2011-04-28 19:34:15.000000000 -0400
 @@ -50,7 +50,7 @@ static inline void setup_num_counters(vo
  #endif
  }
@@ -19262,9 +21493,9 @@ diff -urNp linux-2.6.38.2/arch/x86/oprofile/op_model_p4.c linux-2.6.38.2/arch/x8
  {
  #ifdef CONFIG_SMP
  	return smp_num_siblings == 2 ? 2 : 1;
-diff -urNp linux-2.6.38.2/arch/x86/pci/ce4100.c linux-2.6.38.2/arch/x86/pci/ce4100.c
---- linux-2.6.38.2/arch/x86/pci/ce4100.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/ce4100.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/ce4100.c linux-2.6.38.7/arch/x86/pci/ce4100.c
+--- linux-2.6.38.7/arch/x86/pci/ce4100.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/ce4100.c	2011-04-28 19:34:15.000000000 -0400
 @@ -302,7 +302,7 @@ static int ce4100_conf_write(unsigned in
  	return pci_direct_conf1.write(seg, bus, devfn, reg, len, value);
  }
@@ -19274,9 +21505,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/ce4100.c linux-2.6.38.2/arch/x86/pci/ce41
  	.read =	ce4100_conf_read,
  	.write = ce4100_conf_write,
  };
-diff -urNp linux-2.6.38.2/arch/x86/pci/common.c linux-2.6.38.2/arch/x86/pci/common.c
---- linux-2.6.38.2/arch/x86/pci/common.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/common.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/common.c linux-2.6.38.7/arch/x86/pci/common.c
+--- linux-2.6.38.7/arch/x86/pci/common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/common.c	2011-04-28 19:34:15.000000000 -0400
 @@ -33,8 +33,8 @@ int noioapicreroute = 1;
  int pcibios_last_bus = -1;
  unsigned long pirq_table_addr;
@@ -19288,18 +21519,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/common.c linux-2.6.38.2/arch/x86/pci/comm
  
  int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
  						int reg, int len, u32 *val)
-@@ -423,7 +423,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "ProLiant DL585 G2"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
- 
- void __init dmi_check_pciprobe(void)
-diff -urNp linux-2.6.38.2/arch/x86/pci/direct.c linux-2.6.38.2/arch/x86/pci/direct.c
---- linux-2.6.38.2/arch/x86/pci/direct.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/direct.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/direct.c linux-2.6.38.7/arch/x86/pci/direct.c
+--- linux-2.6.38.7/arch/x86/pci/direct.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/direct.c	2011-04-28 19:34:15.000000000 -0400
 @@ -79,7 +79,7 @@ static int pci_conf1_write(unsigned int 
  
  #undef PCI_CONF1_ADDRESS
@@ -19327,51 +21549,21 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/direct.c linux-2.6.38.2/arch/x86/pci/dire
  {
  	u32 x = 0;
  	int year, devfn;
-diff -urNp linux-2.6.38.2/arch/x86/pci/fixup.c linux-2.6.38.2/arch/x86/pci/fixup.c
---- linux-2.6.38.2/arch/x86/pci/fixup.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/fixup.c	2011-03-21 18:31:35.000000000 -0400
-@@ -364,7 +364,7 @@ static const struct dmi_system_id __devi
- 			DMI_MATCH(DMI_PRODUCT_NAME, "MS-6702E"),
- 		},
- 	},
--	{}
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
+diff -urNp linux-2.6.38.7/arch/x86/pci/fixup.c linux-2.6.38.7/arch/x86/pci/fixup.c
+--- linux-2.6.38.7/arch/x86/pci/fixup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/fixup.c	2011-04-28 19:34:15.000000000 -0400
 @@ -435,7 +435,7 @@ static const struct dmi_system_id __devi
  			DMI_MATCH(DMI_PRODUCT_VERSION, "PSA40U"),
  		},
  	},
 -	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
++	{}
  };
  
  static void __devinit pci_pre_fixup_toshiba_ohci1394(struct pci_dev *dev)
-diff -urNp linux-2.6.38.2/arch/x86/pci/irq.c linux-2.6.38.2/arch/x86/pci/irq.c
---- linux-2.6.38.2/arch/x86/pci/irq.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/irq.c	2011-03-21 18:31:35.000000000 -0400
-@@ -542,7 +542,7 @@ static __init int intel_router_probe(str
- 	static struct pci_device_id __initdata pirq_440gx[] = {
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_0) },
- 		{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82443GX_2) },
--		{ },
-+		{ PCI_DEVICE(0, 0) }
- 	};
- 
- 	/* 440GX has a proprietary PIRQ router -- don't use it */
-@@ -1115,7 +1115,7 @@ static struct dmi_system_id __initdata p
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- void __init pcibios_irq_init(void)
-diff -urNp linux-2.6.38.2/arch/x86/pci/mmconfig_32.c linux-2.6.38.2/arch/x86/pci/mmconfig_32.c
---- linux-2.6.38.2/arch/x86/pci/mmconfig_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/mmconfig_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/mmconfig_32.c linux-2.6.38.7/arch/x86/pci/mmconfig_32.c
+--- linux-2.6.38.7/arch/x86/pci/mmconfig_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/mmconfig_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -117,7 +117,7 @@ static int pci_mmcfg_write(unsigned int 
  	return 0;
  }
@@ -19381,9 +21573,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/mmconfig_32.c linux-2.6.38.2/arch/x86/pci
  	.read =		pci_mmcfg_read,
  	.write =	pci_mmcfg_write,
  };
-diff -urNp linux-2.6.38.2/arch/x86/pci/mmconfig_64.c linux-2.6.38.2/arch/x86/pci/mmconfig_64.c
---- linux-2.6.38.2/arch/x86/pci/mmconfig_64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/mmconfig_64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/mmconfig_64.c linux-2.6.38.7/arch/x86/pci/mmconfig_64.c
+--- linux-2.6.38.7/arch/x86/pci/mmconfig_64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/mmconfig_64.c	2011-04-28 19:34:15.000000000 -0400
 @@ -81,7 +81,7 @@ static int pci_mmcfg_write(unsigned int 
  	return 0;
  }
@@ -19393,9 +21585,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/mmconfig_64.c linux-2.6.38.2/arch/x86/pci
  	.read =		pci_mmcfg_read,
  	.write =	pci_mmcfg_write,
  };
-diff -urNp linux-2.6.38.2/arch/x86/pci/numaq_32.c linux-2.6.38.2/arch/x86/pci/numaq_32.c
---- linux-2.6.38.2/arch/x86/pci/numaq_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/numaq_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/numaq_32.c linux-2.6.38.7/arch/x86/pci/numaq_32.c
+--- linux-2.6.38.7/arch/x86/pci/numaq_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/numaq_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -108,7 +108,7 @@ static int pci_conf1_mq_write(unsigned i
  
  #undef PCI_CONF1_MQ_ADDRESS
@@ -19405,9 +21597,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/numaq_32.c linux-2.6.38.2/arch/x86/pci/nu
  	.read	= pci_conf1_mq_read,
  	.write	= pci_conf1_mq_write
  };
-diff -urNp linux-2.6.38.2/arch/x86/pci/olpc.c linux-2.6.38.2/arch/x86/pci/olpc.c
---- linux-2.6.38.2/arch/x86/pci/olpc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/olpc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/olpc.c linux-2.6.38.7/arch/x86/pci/olpc.c
+--- linux-2.6.38.7/arch/x86/pci/olpc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/olpc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -297,7 +297,7 @@ static int pci_olpc_write(unsigned int s
  	return 0;
  }
@@ -19417,9 +21609,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/olpc.c linux-2.6.38.2/arch/x86/pci/olpc.c
  	.read =	pci_olpc_read,
  	.write = pci_olpc_write,
  };
-diff -urNp linux-2.6.38.2/arch/x86/pci/pcbios.c linux-2.6.38.2/arch/x86/pci/pcbios.c
---- linux-2.6.38.2/arch/x86/pci/pcbios.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/pci/pcbios.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/pci/pcbios.c linux-2.6.38.7/arch/x86/pci/pcbios.c
+--- linux-2.6.38.7/arch/x86/pci/pcbios.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/pci/pcbios.c	2011-04-28 19:34:15.000000000 -0400
 @@ -79,50 +79,93 @@ union bios32 {
  static struct {
  	unsigned long address;
@@ -19742,9 +21934,9 @@ diff -urNp linux-2.6.38.2/arch/x86/pci/pcbios.c linux-2.6.38.2/arch/x86/pci/pcbi
  	return !(ret & 0xff00);
  }
  EXPORT_SYMBOL(pcibios_set_irq_routing);
-diff -urNp linux-2.6.38.2/arch/x86/platform/efi/efi_32.c linux-2.6.38.2/arch/x86/platform/efi/efi_32.c
---- linux-2.6.38.2/arch/x86/platform/efi/efi_32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/platform/efi/efi_32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/platform/efi/efi_32.c linux-2.6.38.7/arch/x86/platform/efi/efi_32.c
+--- linux-2.6.38.7/arch/x86/platform/efi/efi_32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/platform/efi/efi_32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -38,70 +38,37 @@
   */
  
@@ -19825,9 +22017,9 @@ diff -urNp linux-2.6.38.2/arch/x86/platform/efi/efi_32.c linux-2.6.38.2/arch/x86
  
  	/*
  	 * After the lock is released, the original page table is restored.
-diff -urNp linux-2.6.38.2/arch/x86/platform/efi/efi_stub_32.S linux-2.6.38.2/arch/x86/platform/efi/efi_stub_32.S
---- linux-2.6.38.2/arch/x86/platform/efi/efi_stub_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/platform/efi/efi_stub_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/platform/efi/efi_stub_32.S linux-2.6.38.7/arch/x86/platform/efi/efi_stub_32.S
+--- linux-2.6.38.7/arch/x86/platform/efi/efi_stub_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/platform/efi/efi_stub_32.S	2011-04-28 19:34:15.000000000 -0400
 @@ -6,6 +6,7 @@
   */
  
@@ -19926,9 +22118,21 @@ diff -urNp linux-2.6.38.2/arch/x86/platform/efi/efi_stub_32.S linux-2.6.38.2/arc
  saved_return_addr:
  	.long 0
  efi_rt_function_ptr:
-diff -urNp linux-2.6.38.2/arch/x86/power/cpu.c linux-2.6.38.2/arch/x86/power/cpu.c
---- linux-2.6.38.2/arch/x86/power/cpu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/power/cpu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/platform/uv/tlb_uv.c linux-2.6.38.7/arch/x86/platform/uv/tlb_uv.c
+--- linux-2.6.38.7/arch/x86/platform/uv/tlb_uv.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/arch/x86/platform/uv/tlb_uv.c	2011-05-22 23:05:54.000000000 -0400
+@@ -341,6 +341,8 @@ static void uv_reset_with_ipi(struct bau
+ 	cpumask_t mask;
+ 	struct reset_args reset_args;
+ 
++	pax_track_stack();
++
+ 	reset_args.sender = sender;
+ 
+ 	cpus_clear(mask);
+diff -urNp linux-2.6.38.7/arch/x86/power/cpu.c linux-2.6.38.7/arch/x86/power/cpu.c
+--- linux-2.6.38.7/arch/x86/power/cpu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/power/cpu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -130,7 +130,7 @@ static void do_fpu_end(void)
  static void fix_processor_context(void)
  {
@@ -19948,21 +22152,21 @@ diff -urNp linux-2.6.38.2/arch/x86/power/cpu.c linux-2.6.38.2/arch/x86/power/cpu
  
  	syscall_init();				/* This sets MSR_*STAR and related */
  #endif
-diff -urNp linux-2.6.38.2/arch/x86/vdso/Makefile linux-2.6.38.2/arch/x86/vdso/Makefile
---- linux-2.6.38.2/arch/x86/vdso/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/Makefile linux-2.6.38.7/arch/x86/vdso/Makefile
+--- linux-2.6.38.7/arch/x86/vdso/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/Makefile	2011-04-28 19:34:15.000000000 -0400
 @@ -123,7 +123,7 @@ quiet_cmd_vdso = VDSO    $@
  		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^) && \
  		 sh $(srctree)/$(src)/checkundef.sh '$(NM)' '$@'
  
 -VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
-+VDSO_LDFLAGS = -fPIC -shared --no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
++VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
  GCOV_PROFILE := n
  
  #
-diff -urNp linux-2.6.38.2/arch/x86/vdso/vclock_gettime.c linux-2.6.38.2/arch/x86/vdso/vclock_gettime.c
---- linux-2.6.38.2/arch/x86/vdso/vclock_gettime.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/vclock_gettime.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/vclock_gettime.c linux-2.6.38.7/arch/x86/vdso/vclock_gettime.c
+--- linux-2.6.38.7/arch/x86/vdso/vclock_gettime.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/vclock_gettime.c	2011-04-28 19:34:15.000000000 -0400
 @@ -22,24 +22,48 @@
  #include <asm/hpet.h>
  #include <asm/unistd.h>
@@ -20061,9 +22265,9 @@ diff -urNp linux-2.6.38.2/arch/x86/vdso/vclock_gettime.c linux-2.6.38.2/arch/x86
  }
  int gettimeofday(struct timeval *, struct timezone *)
  	__attribute__((weak, alias("__vdso_gettimeofday")));
-diff -urNp linux-2.6.38.2/arch/x86/vdso/vdso32-setup.c linux-2.6.38.2/arch/x86/vdso/vdso32-setup.c
---- linux-2.6.38.2/arch/x86/vdso/vdso32-setup.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/vdso32-setup.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/vdso32-setup.c linux-2.6.38.7/arch/x86/vdso/vdso32-setup.c
+--- linux-2.6.38.7/arch/x86/vdso/vdso32-setup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/vdso32-setup.c	2011-04-28 19:34:15.000000000 -0400
 @@ -25,6 +25,7 @@
  #include <asm/tlbflush.h>
  #include <asm/vdso.h>
@@ -20146,9 +22350,9 @@ diff -urNp linux-2.6.38.2/arch/x86/vdso/vdso32-setup.c linux-2.6.38.2/arch/x86/v
  		return &gate_vma;
  	return NULL;
  }
-diff -urNp linux-2.6.38.2/arch/x86/vdso/vdso.lds.S linux-2.6.38.2/arch/x86/vdso/vdso.lds.S
---- linux-2.6.38.2/arch/x86/vdso/vdso.lds.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/vdso.lds.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/vdso.lds.S linux-2.6.38.7/arch/x86/vdso/vdso.lds.S
+--- linux-2.6.38.7/arch/x86/vdso/vdso.lds.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/vdso.lds.S	2011-04-28 19:34:15.000000000 -0400
 @@ -35,3 +35,9 @@ VDSO64_PRELINK = VDSO_PRELINK;
  #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
  #include "vextern.h"
@@ -20159,9 +22363,9 @@ diff -urNp linux-2.6.38.2/arch/x86/vdso/vdso.lds.S linux-2.6.38.2/arch/x86/vdso/
 +VEXTERN(fallback_time)
 +VEXTERN(getcpu)
 +#undef	VEXTERN
-diff -urNp linux-2.6.38.2/arch/x86/vdso/vextern.h linux-2.6.38.2/arch/x86/vdso/vextern.h
---- linux-2.6.38.2/arch/x86/vdso/vextern.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/vextern.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/vextern.h linux-2.6.38.7/arch/x86/vdso/vextern.h
+--- linux-2.6.38.7/arch/x86/vdso/vextern.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/vextern.h	2011-04-28 19:34:15.000000000 -0400
 @@ -11,6 +11,5 @@
     put into vextern.h and be referenced as a pointer with vdso prefix.
     The main kernel later fills in the values.   */
@@ -20169,9 +22373,9 @@ diff -urNp linux-2.6.38.2/arch/x86/vdso/vextern.h linux-2.6.38.2/arch/x86/vdso/v
 -VEXTERN(jiffies)
  VEXTERN(vgetcpu_mode)
  VEXTERN(vsyscall_gtod_data)
-diff -urNp linux-2.6.38.2/arch/x86/vdso/vma.c linux-2.6.38.2/arch/x86/vdso/vma.c
---- linux-2.6.38.2/arch/x86/vdso/vma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/vdso/vma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/vdso/vma.c linux-2.6.38.7/arch/x86/vdso/vma.c
+--- linux-2.6.38.7/arch/x86/vdso/vma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/vdso/vma.c	2011-04-28 19:34:15.000000000 -0400
 @@ -58,7 +58,7 @@ static int __init init_vdso_vars(void)
  	if (!vbase)
  		goto oom;
@@ -20210,9 +22414,9 @@ diff -urNp linux-2.6.38.2/arch/x86/vdso/vma.c linux-2.6.38.2/arch/x86/vdso/vma.c
 -	return 0;
 -}
 -__setup("vdso=", vdso_setup);
-diff -urNp linux-2.6.38.2/arch/x86/xen/enlighten.c linux-2.6.38.2/arch/x86/xen/enlighten.c
---- linux-2.6.38.2/arch/x86/xen/enlighten.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/enlighten.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/xen/enlighten.c linux-2.6.38.7/arch/x86/xen/enlighten.c
+--- linux-2.6.38.7/arch/x86/xen/enlighten.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/enlighten.c	2011-05-22 23:03:34.000000000 -0400
 @@ -85,8 +85,6 @@ EXPORT_SYMBOL_GPL(xen_start_info);
  
  struct shared_info xen_dummy_shared_info;
@@ -20222,6 +22426,36 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/enlighten.c linux-2.6.38.2/arch/x86/xen/e
  RESERVE_BRK(shared_info_page_brk, PAGE_SIZE);
  __read_mostly int xen_have_vector_callback;
  EXPORT_SYMBOL_GPL(xen_have_vector_callback);
+@@ -1017,7 +1015,7 @@ static const struct pv_apic_ops xen_apic
+ #endif
+ };
+ 
+-static void xen_reboot(int reason)
++static __noreturn void xen_reboot(int reason)
+ {
+ 	struct sched_shutdown r = { .reason = reason };
+ 
+@@ -1025,17 +1023,17 @@ static void xen_reboot(int reason)
+ 		BUG();
+ }
+ 
+-static void xen_restart(char *msg)
++static __noreturn void xen_restart(char *msg)
+ {
+ 	xen_reboot(SHUTDOWN_reboot);
+ }
+ 
+-static void xen_emergency_restart(void)
++static __noreturn void xen_emergency_restart(void)
+ {
+ 	xen_reboot(SHUTDOWN_reboot);
+ }
+ 
+-static void xen_machine_halt(void)
++static __noreturn void xen_machine_halt(void)
+ {
+ 	xen_reboot(SHUTDOWN_poweroff);
+ }
 @@ -1134,7 +1132,17 @@ asmlinkage void __init xen_start_kernel(
  	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
  
@@ -20255,9 +22489,9 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/enlighten.c linux-2.6.38.2/arch/x86/xen/e
  	xen_smp_init();
  
  #ifdef CONFIG_ACPI_NUMA
-diff -urNp linux-2.6.38.2/arch/x86/xen/mmu.c linux-2.6.38.2/arch/x86/xen/mmu.c
---- linux-2.6.38.2/arch/x86/xen/mmu.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/mmu.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/xen/mmu.c linux-2.6.38.7/arch/x86/xen/mmu.c
+--- linux-2.6.38.7/arch/x86/xen/mmu.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/mmu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1721,6 +1721,8 @@ __init pgd_t *xen_setup_kernel_pagetable
  	convert_pfn_mfn(init_level4_pgt);
  	convert_pfn_mfn(level3_ident_pgt);
@@ -20278,9 +22512,9 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/mmu.c linux-2.6.38.2/arch/x86/xen/mmu.c
  	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
  	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
  
-diff -urNp linux-2.6.38.2/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.38.2/arch/x86/xen/pci-swiotlb-xen.c
---- linux-2.6.38.2/arch/x86/xen/pci-swiotlb-xen.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/pci-swiotlb-xen.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.38.7/arch/x86/xen/pci-swiotlb-xen.c
+--- linux-2.6.38.7/arch/x86/xen/pci-swiotlb-xen.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/pci-swiotlb-xen.c	2011-04-28 19:34:15.000000000 -0400
 @@ -10,7 +10,7 @@
  
  int xen_swiotlb __read_mostly;
@@ -20290,9 +22524,9 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/pci-swiotlb-xen.c linux-2.6.38.2/arch/x86
  	.mapping_error = xen_swiotlb_dma_mapping_error,
  	.alloc_coherent = xen_swiotlb_alloc_coherent,
  	.free_coherent = xen_swiotlb_free_coherent,
-diff -urNp linux-2.6.38.2/arch/x86/xen/smp.c linux-2.6.38.2/arch/x86/xen/smp.c
---- linux-2.6.38.2/arch/x86/xen/smp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/smp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/xen/smp.c linux-2.6.38.7/arch/x86/xen/smp.c
+--- linux-2.6.38.7/arch/x86/xen/smp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/smp.c	2011-05-11 18:34:57.000000000 -0400
 @@ -194,11 +194,6 @@ static void __init xen_smp_prepare_boot_
  {
  	BUG_ON(smp_processor_id() != 0);
@@ -20321,9 +22555,49 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/smp.c linux-2.6.38.2/arch/x86/xen/smp.c
  #else
  	ctxt->gs_base_kernel = per_cpu_offset(cpu);
  #endif
-diff -urNp linux-2.6.38.2/arch/x86/xen/xen-head.S linux-2.6.38.2/arch/x86/xen/xen-head.S
---- linux-2.6.38.2/arch/x86/xen/xen-head.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/xen-head.S	2011-03-21 18:31:35.000000000 -0400
+@@ -315,13 +310,12 @@ static int __cpuinit xen_cpu_up(unsigned
+ 	int rc;
+ 
+ 	per_cpu(current_task, cpu) = idle;
++	per_cpu(current_tinfo, cpu) = &idle->tinfo;
+ #ifdef CONFIG_X86_32
+ 	irq_ctx_init(cpu);
+ #else
+ 	clear_tsk_thread_flag(idle, TIF_FORK);
+-	per_cpu(kernel_stack, cpu) =
+-		(unsigned long)task_stack_page(idle) -
+-		KERNEL_STACK_OFFSET + THREAD_SIZE;
++	per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
+ #endif
+ 	xen_setup_runstate_info(cpu);
+ 	xen_setup_timer(cpu);
+diff -urNp linux-2.6.38.7/arch/x86/xen/xen-asm_32.S linux-2.6.38.7/arch/x86/xen/xen-asm_32.S
+--- linux-2.6.38.7/arch/x86/xen/xen-asm_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/xen-asm_32.S	2011-04-28 19:34:15.000000000 -0400
+@@ -83,14 +83,14 @@ ENTRY(xen_iret)
+ 	ESP_OFFSET=4	# bytes pushed onto stack
+ 
+ 	/*
+-	 * Store vcpu_info pointer for easy access.  Do it this way to
+-	 * avoid having to reload %fs
++	 * Store vcpu_info pointer for easy access.
+ 	 */
+ #ifdef CONFIG_SMP
+-	GET_THREAD_INFO(%eax)
+-	movl TI_cpu(%eax), %eax
+-	movl __per_cpu_offset(,%eax,4), %eax
+-	mov xen_vcpu(%eax), %eax
++	push %fs
++	mov $(__KERNEL_PERCPU), %eax
++	mov %eax, %fs
++	mov PER_CPU_VAR(xen_vcpu), %eax
++	pop %fs
+ #else
+ 	movl xen_vcpu, %eax
+ #endif
+diff -urNp linux-2.6.38.7/arch/x86/xen/xen-head.S linux-2.6.38.7/arch/x86/xen/xen-head.S
+--- linux-2.6.38.7/arch/x86/xen/xen-head.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/xen-head.S	2011-04-28 19:34:15.000000000 -0400
 @@ -19,6 +19,17 @@ ENTRY(startup_xen)
  #ifdef CONFIG_X86_32
  	mov %esi,xen_start_info
@@ -20342,9 +22616,9 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/xen-head.S linux-2.6.38.2/arch/x86/xen/xe
  #else
  	mov %rsi,xen_start_info
  	mov $init_thread_union+THREAD_SIZE,%rsp
-diff -urNp linux-2.6.38.2/arch/x86/xen/xen-ops.h linux-2.6.38.2/arch/x86/xen/xen-ops.h
---- linux-2.6.38.2/arch/x86/xen/xen-ops.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/arch/x86/xen/xen-ops.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/arch/x86/xen/xen-ops.h linux-2.6.38.7/arch/x86/xen/xen-ops.h
+--- linux-2.6.38.7/arch/x86/xen/xen-ops.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/arch/x86/xen/xen-ops.h	2011-04-28 19:34:15.000000000 -0400
 @@ -10,8 +10,6 @@
  extern const char xen_hypervisor_callback[];
  extern const char xen_failsafe_callback[];
@@ -20354,9 +22628,9 @@ diff -urNp linux-2.6.38.2/arch/x86/xen/xen-ops.h linux-2.6.38.2/arch/x86/xen/xen
  struct trap_info;
  void xen_copy_trap_info(struct trap_info *traps);
  
-diff -urNp linux-2.6.38.2/block/blk-iopoll.c linux-2.6.38.2/block/blk-iopoll.c
---- linux-2.6.38.2/block/blk-iopoll.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/block/blk-iopoll.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/block/blk-iopoll.c linux-2.6.38.7/block/blk-iopoll.c
+--- linux-2.6.38.7/block/blk-iopoll.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/block/blk-iopoll.c	2011-04-28 19:34:15.000000000 -0400
 @@ -77,7 +77,7 @@ void blk_iopoll_complete(struct blk_iopo
  }
  EXPORT_SYMBOL(blk_iopoll_complete);
@@ -20366,9 +22640,9 @@ diff -urNp linux-2.6.38.2/block/blk-iopoll.c linux-2.6.38.2/block/blk-iopoll.c
  {
  	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
  	int rearm = 0, budget = blk_iopoll_budget;
-diff -urNp linux-2.6.38.2/block/blk-map.c linux-2.6.38.2/block/blk-map.c
---- linux-2.6.38.2/block/blk-map.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/block/blk-map.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/block/blk-map.c linux-2.6.38.7/block/blk-map.c
+--- linux-2.6.38.7/block/blk-map.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/block/blk-map.c	2011-04-28 19:34:15.000000000 -0400
 @@ -301,7 +301,7 @@ int blk_rq_map_kern(struct request_queue
  	if (!len || !kbuf)
  		return -EINVAL;
@@ -20378,9 +22652,9 @@ diff -urNp linux-2.6.38.2/block/blk-map.c linux-2.6.38.2/block/blk-map.c
  	if (do_copy)
  		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
  	else
-diff -urNp linux-2.6.38.2/block/blk-softirq.c linux-2.6.38.2/block/blk-softirq.c
---- linux-2.6.38.2/block/blk-softirq.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/block/blk-softirq.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/block/blk-softirq.c linux-2.6.38.7/block/blk-softirq.c
+--- linux-2.6.38.7/block/blk-softirq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/block/blk-softirq.c	2011-04-28 19:34:15.000000000 -0400
 @@ -17,7 +17,7 @@ static DEFINE_PER_CPU(struct list_head, 
   * Softirq action handler - move entries to local list and loop over them
   * while passing them to the queue registered handler.
@@ -20390,30 +22664,123 @@ diff -urNp linux-2.6.38.2/block/blk-softirq.c linux-2.6.38.2/block/blk-softirq.c
  {
  	struct list_head *cpu_list, local_list;
  
-diff -urNp linux-2.6.38.2/crypto/lrw.c linux-2.6.38.2/crypto/lrw.c
---- linux-2.6.38.2/crypto/lrw.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/crypto/lrw.c	2011-03-21 18:31:35.000000000 -0400
-@@ -60,7 +60,7 @@ static int setkey(struct crypto_tfm *par
- 	struct priv *ctx = crypto_tfm_ctx(parent);
- 	struct crypto_cipher *child = ctx->child;
- 	int err, i;
--	be128 tmp = { 0 };
-+	be128 tmp = { 0, 0 };
- 	int bsize = crypto_cipher_blocksize(child);
- 
- 	crypto_cipher_clear_flags(child, CRYPTO_TFM_REQ_MASK);
-diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/dontdiff
---- linux-2.6.38.2/Documentation/dontdiff	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/Documentation/dontdiff	2011-03-21 18:31:35.000000000 -0400
-@@ -3,6 +3,7 @@
+diff -urNp linux-2.6.38.7/block/bsg.c linux-2.6.38.7/block/bsg.c
+--- linux-2.6.38.7/block/bsg.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/block/bsg.c	2011-04-28 19:34:15.000000000 -0400
+@@ -176,16 +176,24 @@ static int blk_fill_sgv4_hdr_rq(struct r
+ 				struct sg_io_v4 *hdr, struct bsg_device *bd,
+ 				fmode_t has_write_perm)
+ {
++	unsigned char tmpcmd[sizeof(rq->__cmd)];
++	unsigned char *cmdptr;
++
+ 	if (hdr->request_len > BLK_MAX_CDB) {
+ 		rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
+ 		if (!rq->cmd)
+ 			return -ENOMEM;
+-	}
++		cmdptr = rq->cmd;
++	} else
++		cmdptr = tmpcmd;
+ 
+-	if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
++	if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
+ 			   hdr->request_len))
+ 		return -EFAULT;
+ 
++	if (cmdptr != rq->cmd)
++		memcpy(rq->cmd, cmdptr, hdr->request_len);
++
+ 	if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
+ 		if (blk_verify_command(rq->cmd, has_write_perm))
+ 			return -EPERM;
+diff -urNp linux-2.6.38.7/block/scsi_ioctl.c linux-2.6.38.7/block/scsi_ioctl.c
+--- linux-2.6.38.7/block/scsi_ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/block/scsi_ioctl.c	2011-04-28 19:34:15.000000000 -0400
+@@ -222,8 +222,20 @@ EXPORT_SYMBOL(blk_verify_command);
+ static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
+ 			     struct sg_io_hdr *hdr, fmode_t mode)
+ {
+-	if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
++	unsigned char tmpcmd[sizeof(rq->__cmd)];
++	unsigned char *cmdptr;
++
++	if (rq->cmd != rq->__cmd)
++		cmdptr = rq->cmd;
++	else
++		cmdptr = tmpcmd;
++
++	if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
+ 		return -EFAULT;
++
++	if (cmdptr != rq->cmd)
++		memcpy(rq->cmd, cmdptr, hdr->cmd_len);
++
+ 	if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
+ 		return -EPERM;
+ 
+@@ -432,6 +444,8 @@ int sg_scsi_ioctl(struct request_queue *
+ 	int err;
+ 	unsigned int in_len, out_len, bytes, opcode, cmdlen;
+ 	char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
++	unsigned char tmpcmd[sizeof(rq->__cmd)];
++	unsigned char *cmdptr;
+ 
+ 	if (!sic)
+ 		return -EINVAL;
+@@ -465,9 +479,18 @@ int sg_scsi_ioctl(struct request_queue *
+ 	 */
+ 	err = -EFAULT;
+ 	rq->cmd_len = cmdlen;
+-	if (copy_from_user(rq->cmd, sic->data, cmdlen))
++
++	if (rq->cmd != rq->__cmd)
++		cmdptr = rq->cmd;
++	else
++		cmdptr = tmpcmd;
++
++	if (copy_from_user(cmdptr, sic->data, cmdlen))
+ 		goto error;
+ 
++	if (rq->cmd != cmdptr)
++		memcpy(rq->cmd, cmdptr, cmdlen);
++
+ 	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
+ 		goto error;
+ 
+diff -urNp linux-2.6.38.7/crypto/serpent.c linux-2.6.38.7/crypto/serpent.c
+--- linux-2.6.38.7/crypto/serpent.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/crypto/serpent.c	2011-05-16 21:47:08.000000000 -0400
+@@ -224,6 +224,8 @@ static int serpent_setkey(struct crypto_
+ 	u32 r0,r1,r2,r3,r4;
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	/* Copy key, add padding */
+ 
+ 	for (i = 0; i < keylen; ++i)
+diff -urNp linux-2.6.38.7/Documentation/dontdiff linux-2.6.38.7/Documentation/dontdiff
+--- linux-2.6.38.7/Documentation/dontdiff	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/Documentation/dontdiff	2011-05-18 20:23:44.000000000 -0400
+@@ -1,13 +1,16 @@
+ *.a
+ *.aux
  *.bin
++*.cis
  *.cpio
  *.csp
 +*.dbg
  *.dsp
  *.dvi
  *.elf
-@@ -38,8 +39,10 @@
+ *.eps
+ *.fw
++*.gcno
+ *.gen.S
+ *.gif
+ *.grep
+@@ -38,8 +41,10 @@
  *.tab.h
  *.tex
  *.ver
@@ -20424,7 +22791,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  *_vga16.c
  *~
  *.9
-@@ -49,11 +52,16 @@
+@@ -49,11 +54,16 @@
  53c700_d.h
  CVS
  ChangeSet
@@ -20441,8 +22808,11 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  SCCS
  System.map*
  TAGS
-@@ -82,6 +90,8 @@ bvmlinux
+@@ -80,8 +90,11 @@ btfixupprep
+ build
+ bvmlinux
  bzImage*
++capability_names.h
  capflags.c
  classlist.h*
 +clut_vga16.c
@@ -20450,7 +22820,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  comp*.log
  compile.h*
  conf
-@@ -106,16 +116,19 @@ fore200e_mkfirm
+@@ -106,16 +119,19 @@ fore200e_mkfirm
  fore200e_pca_fw.c*
  gconf
  gen-devlist
@@ -20470,7 +22840,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  initramfs_data.cpio.gz
  initramfs_list
  int16.c
-@@ -125,7 +138,6 @@ int32.c
+@@ -125,7 +141,6 @@ int32.c
  int4.c
  int8.c
  kallsyms
@@ -20478,7 +22848,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  keywords.c
  ksym.c*
  ksym.h*
-@@ -149,7 +161,9 @@ mkboot
+@@ -149,7 +164,9 @@ mkboot
  mkbugboot
  mkcpustr
  mkdep
@@ -20488,7 +22858,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  mktables
  mktree
  modpost
-@@ -165,6 +179,7 @@ parse.h
+@@ -165,6 +182,7 @@ parse.h
  patches*
  pca200e.bin
  pca200e_ecd.bin2
@@ -20496,15 +22866,17 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  piggy.gz
  piggyback
  piggy.S
-@@ -180,6 +195,7 @@ r600_reg_safe.h
+@@ -180,7 +198,9 @@ r600_reg_safe.h
  raid6altivec*.c
  raid6int*.c
  raid6tables.c
 +regdb.c
  relocs
++rlim_names.h
  rn50_reg_safe.h
  rs600_reg_safe.h
-@@ -189,6 +205,7 @@ setup
+ rv515_reg_safe.h
+@@ -189,6 +209,7 @@ setup
  setup.bin
  setup.elf
  sImage
@@ -20512,7 +22884,7 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  sm_tbl*
  split-include
  syscalltab.h
-@@ -213,13 +230,17 @@ version.h*
+@@ -213,13 +234,17 @@ version.h*
  vmlinux
  vmlinux-*
  vmlinux.aout
@@ -20530,9 +22902,9 @@ diff -urNp linux-2.6.38.2/Documentation/dontdiff linux-2.6.38.2/Documentation/do
  wakeup.bin
  wakeup.elf
  wakeup.lds
-diff -urNp linux-2.6.38.2/Documentation/filesystems/sysfs.txt linux-2.6.38.2/Documentation/filesystems/sysfs.txt
---- linux-2.6.38.2/Documentation/filesystems/sysfs.txt	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/Documentation/filesystems/sysfs.txt	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/Documentation/filesystems/sysfs.txt linux-2.6.38.7/Documentation/filesystems/sysfs.txt
+--- linux-2.6.38.7/Documentation/filesystems/sysfs.txt	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/Documentation/filesystems/sysfs.txt	2011-04-28 19:34:15.000000000 -0400
 @@ -123,8 +123,8 @@ set of sysfs operations for forwarding r
  show and store methods of the attribute owners. 
  
@@ -20544,9 +22916,9 @@ diff -urNp linux-2.6.38.2/Documentation/filesystems/sysfs.txt linux-2.6.38.2/Doc
  };
  
  [ Subsystems should have already defined a struct kobj_type as a
-diff -urNp linux-2.6.38.2/Documentation/kernel-parameters.txt linux-2.6.38.2/Documentation/kernel-parameters.txt
---- linux-2.6.38.2/Documentation/kernel-parameters.txt	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/Documentation/kernel-parameters.txt	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/Documentation/kernel-parameters.txt linux-2.6.38.7/Documentation/kernel-parameters.txt
+--- linux-2.6.38.7/Documentation/kernel-parameters.txt	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/Documentation/kernel-parameters.txt	2011-04-28 19:34:15.000000000 -0400
 @@ -1853,6 +1853,13 @@ bytes respectively. Such letter suffixes
  			the specified number of seconds.  This is to be used if
  			your oopses keep scrolling off the screen.
@@ -20561,10 +22933,30 @@ diff -urNp linux-2.6.38.2/Documentation/kernel-parameters.txt linux-2.6.38.2/Doc
  	pcbit=		[HW,ISDN]
  
  	pcd.		[PARIDE]
-diff -urNp linux-2.6.38.2/drivers/acpi/battery.c linux-2.6.38.2/drivers/acpi/battery.c
---- linux-2.6.38.2/drivers/acpi/battery.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/battery.c	2011-03-21 18:31:35.000000000 -0400
-@@ -862,7 +862,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
+diff -urNp linux-2.6.38.7/drivers/acpi/apei/cper.c linux-2.6.38.7/drivers/acpi/apei/cper.c
+--- linux-2.6.38.7/drivers/acpi/apei/cper.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/apei/cper.c	2011-04-28 19:57:25.000000000 -0400
+@@ -37,12 +37,12 @@
+  */
+ u64 cper_next_record_id(void)
+ {
+-	static atomic64_t seq;
++	static atomic64_unchecked_t seq;
+ 
+-	if (!atomic64_read(&seq))
+-		atomic64_set(&seq, ((u64)get_seconds()) << 32);
++	if (!atomic64_read_unchecked(&seq))
++		atomic64_set_unchecked(&seq, ((u64)get_seconds()) << 32);
+ 
+-	return atomic64_inc_return(&seq);
++	return atomic64_inc_return_unchecked(&seq);
+ }
+ EXPORT_SYMBOL_GPL(cper_next_record_id);
+ 
+diff -urNp linux-2.6.38.7/drivers/acpi/battery.c linux-2.6.38.7/drivers/acpi/battery.c
+--- linux-2.6.38.7/drivers/acpi/battery.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/battery.c	2011-05-10 22:06:52.000000000 -0400
+@@ -864,7 +864,7 @@ DECLARE_FILE_FUNCTIONS(alarm);
  	}
  
  static struct battery_file {
@@ -20573,21 +22965,9 @@ diff -urNp linux-2.6.38.2/drivers/acpi/battery.c linux-2.6.38.2/drivers/acpi/bat
  	mode_t mode;
  	const char *name;
  } acpi_battery_file[] = {
-diff -urNp linux-2.6.38.2/drivers/acpi/blacklist.c linux-2.6.38.2/drivers/acpi/blacklist.c
---- linux-2.6.38.2/drivers/acpi/blacklist.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/blacklist.c	2011-03-21 18:31:35.000000000 -0400
-@@ -73,7 +73,7 @@ static struct acpi_blacklist_item acpi_b
- 	{"IBM   ", "TP600E  ", 0x00000105, ACPI_SIG_DSDT, less_than_or_equal,
- 	 "Incorrect _ADR", 1},
- 
--	{""}
-+	{"", "", 0, NULL, all_versions, NULL, 0}
- };
- 
- #if	CONFIG_ACPI_BLACKLIST_YEAR
-diff -urNp linux-2.6.38.2/drivers/acpi/dock.c linux-2.6.38.2/drivers/acpi/dock.c
---- linux-2.6.38.2/drivers/acpi/dock.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/dock.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/dock.c linux-2.6.38.7/drivers/acpi/dock.c
+--- linux-2.6.38.7/drivers/acpi/dock.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/dock.c	2011-04-28 19:34:15.000000000 -0400
 @@ -77,7 +77,7 @@ struct dock_dependent_device {
  	struct list_head list;
  	struct list_head hotplug_list;
@@ -20606,9 +22986,9 @@ diff -urNp linux-2.6.38.2/drivers/acpi/dock.c linux-2.6.38.2/drivers/acpi/dock.c
  			     void *context)
  {
  	struct dock_dependent_device *dd;
-diff -urNp linux-2.6.38.2/drivers/acpi/ec_sys.c linux-2.6.38.2/drivers/acpi/ec_sys.c
---- linux-2.6.38.2/drivers/acpi/ec_sys.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/ec_sys.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/ec_sys.c linux-2.6.38.7/drivers/acpi/ec_sys.c
+--- linux-2.6.38.7/drivers/acpi/ec_sys.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/ec_sys.c	2011-04-28 19:34:15.000000000 -0400
 @@ -96,7 +96,7 @@ static ssize_t acpi_ec_write_io(struct f
  	return count;
  }
@@ -20618,9 +22998,9 @@ diff -urNp linux-2.6.38.2/drivers/acpi/ec_sys.c linux-2.6.38.2/drivers/acpi/ec_s
  	.owner = THIS_MODULE,
  	.open  = acpi_ec_open_io,
  	.read  = acpi_ec_read_io,
-diff -urNp linux-2.6.38.2/drivers/acpi/power_meter.c linux-2.6.38.2/drivers/acpi/power_meter.c
---- linux-2.6.38.2/drivers/acpi/power_meter.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/power_meter.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/power_meter.c linux-2.6.38.7/drivers/acpi/power_meter.c
+--- linux-2.6.38.7/drivers/acpi/power_meter.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/power_meter.c	2011-04-28 19:34:15.000000000 -0400
 @@ -316,8 +316,6 @@ static ssize_t set_trip(struct device *d
  		return res;
  
@@ -20630,9 +23010,9 @@ diff -urNp linux-2.6.38.2/drivers/acpi/power_meter.c linux-2.6.38.2/drivers/acpi
  
  	mutex_lock(&resource->lock);
  	resource->trip[attr->index - 7] = temp;
-diff -urNp linux-2.6.38.2/drivers/acpi/proc.c linux-2.6.38.2/drivers/acpi/proc.c
---- linux-2.6.38.2/drivers/acpi/proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/proc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/proc.c linux-2.6.38.7/drivers/acpi/proc.c
+--- linux-2.6.38.7/drivers/acpi/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -342,19 +342,13 @@ acpi_system_write_wakeup_device(struct f
  				size_t count, loff_t * ppos)
  {
@@ -20667,9 +23047,9 @@ diff -urNp linux-2.6.38.2/drivers/acpi/proc.c linux-2.6.38.2/drivers/acpi/proc.c
  			if (device_can_wakeup(&dev->dev)) {
  				bool enable = !device_may_wakeup(&dev->dev);
  				device_set_wakeup_enable(&dev->dev, enable);
-diff -urNp linux-2.6.38.2/drivers/acpi/processor_driver.c linux-2.6.38.2/drivers/acpi/processor_driver.c
---- linux-2.6.38.2/drivers/acpi/processor_driver.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/processor_driver.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/processor_driver.c linux-2.6.38.7/drivers/acpi/processor_driver.c
+--- linux-2.6.38.7/drivers/acpi/processor_driver.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/processor_driver.c	2011-04-28 19:34:15.000000000 -0400
 @@ -473,7 +473,7 @@ static int __cpuinit acpi_processor_add(
  		return 0;
  #endif
@@ -20679,21 +23059,21 @@ diff -urNp linux-2.6.38.2/drivers/acpi/processor_driver.c linux-2.6.38.2/drivers
  
  	/*
  	 * Buggy BIOS check
-diff -urNp linux-2.6.38.2/drivers/acpi/processor_idle.c linux-2.6.38.2/drivers/acpi/processor_idle.c
---- linux-2.6.38.2/drivers/acpi/processor_idle.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/acpi/processor_idle.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/acpi/processor_idle.c linux-2.6.38.7/drivers/acpi/processor_idle.c
+--- linux-2.6.38.7/drivers/acpi/processor_idle.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/acpi/processor_idle.c	2011-04-28 19:34:15.000000000 -0400
 @@ -121,7 +121,7 @@ static struct dmi_system_id __cpuinitdat
  	  DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
  	  DMI_MATCH(DMI_PRODUCT_NAME,"L8400B series Notebook PC")},
  	 (void *)1},
 -	{},
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL},
++	{}
  };
  
  
-diff -urNp linux-2.6.38.2/drivers/ata/acard-ahci.c linux-2.6.38.2/drivers/ata/acard-ahci.c
---- linux-2.6.38.2/drivers/ata/acard-ahci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/acard-ahci.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/acard-ahci.c linux-2.6.38.7/drivers/ata/acard-ahci.c
+--- linux-2.6.38.7/drivers/ata/acard-ahci.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/acard-ahci.c	2011-04-28 19:34:15.000000000 -0400
 @@ -87,7 +87,7 @@ static struct scsi_host_template acard_a
  	AHCI_SHT("acard-ahci"),
  };
@@ -20703,9 +23083,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/acard-ahci.c linux-2.6.38.2/drivers/ata/ac
  	.inherits		= &ahci_ops,
  	.qc_prep		= acard_ahci_qc_prep,
  	.qc_fill_rtf		= acard_ahci_qc_fill_rtf,
-diff -urNp linux-2.6.38.2/drivers/ata/ahci.c linux-2.6.38.2/drivers/ata/ahci.c
---- linux-2.6.38.2/drivers/ata/ahci.c	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/ahci.c	2011-03-23 17:21:49.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/ahci.c linux-2.6.38.7/drivers/ata/ahci.c
+--- linux-2.6.38.7/drivers/ata/ahci.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/ahci.c	2011-05-10 22:06:52.000000000 -0400
 @@ -94,17 +94,17 @@ static struct scsi_host_template ahci_sh
  	AHCI_SHT("ahci"),
  };
@@ -20727,18 +23107,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/ahci.c linux-2.6.38.2/drivers/ata/ahci.c
  	.inherits		= &ahci_ops,
  	.softreset		= ahci_sb600_softreset,
  	.pmp_softreset		= ahci_sb600_softreset,
-@@ -394,7 +394,7 @@ static const struct pci_device_id ahci_p
- 	{ PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
- 	  PCI_CLASS_STORAGE_SATA_AHCI, 0xffffff, board_ahci },
- 
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- 
-diff -urNp linux-2.6.38.2/drivers/ata/ahci.h linux-2.6.38.2/drivers/ata/ahci.h
---- linux-2.6.38.2/drivers/ata/ahci.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/ahci.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/ahci.h linux-2.6.38.7/drivers/ata/ahci.h
+--- linux-2.6.38.7/drivers/ata/ahci.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/ahci.h	2011-04-28 19:34:15.000000000 -0400
 @@ -309,7 +309,7 @@ extern struct device_attribute *ahci_sde
  	.shost_attrs		= ahci_shost_attrs,			\
  	.sdev_attrs		= ahci_sdev_attrs
@@ -20748,9 +23119,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/ahci.h linux-2.6.38.2/drivers/ata/ahci.h
  
  void ahci_fill_cmd_slot(struct ahci_port_priv *pp, unsigned int tag,
  			u32 opts);
-diff -urNp linux-2.6.38.2/drivers/ata/ata_generic.c linux-2.6.38.2/drivers/ata/ata_generic.c
---- linux-2.6.38.2/drivers/ata/ata_generic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/ata_generic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/ata_generic.c linux-2.6.38.7/drivers/ata/ata_generic.c
+--- linux-2.6.38.7/drivers/ata/ata_generic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/ata_generic.c	2011-04-28 19:34:15.000000000 -0400
 @@ -101,7 +101,7 @@ static struct scsi_host_template generic
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -20760,18 +23131,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/ata_generic.c linux-2.6.38.2/drivers/ata/a
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= ata_cable_unknown,
  	.set_mode	= generic_set_mode,
-diff -urNp linux-2.6.38.2/drivers/ata/ata_piix.c linux-2.6.38.2/drivers/ata/ata_piix.c
---- linux-2.6.38.2/drivers/ata/ata_piix.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/ata_piix.c	2011-03-21 18:31:35.000000000 -0400
-@@ -309,7 +309,7 @@ static const struct pci_device_id piix_p
- 	{ 0x8086, 0x1d00, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_sata },
- 	/* SATA Controller IDE (PBG) */
- 	{ 0x8086, 0x1d08, PCI_ANY_ID, PCI_ANY_ID, 0, 0, ich8_2port_sata },
--	{ }	/* terminate list */
-+	{ 0, 0, 0, 0, 0, 0, 0 }	/* terminate list */
- };
- 
- static struct pci_driver piix_pci_driver = {
+diff -urNp linux-2.6.38.7/drivers/ata/ata_piix.c linux-2.6.38.7/drivers/ata/ata_piix.c
+--- linux-2.6.38.7/drivers/ata/ata_piix.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/ata_piix.c	2011-04-28 19:34:15.000000000 -0400
 @@ -327,12 +327,12 @@ static struct scsi_host_template piix_sh
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -20811,27 +23173,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/ata_piix.c linux-2.6.38.2/drivers/ata/ata_
  	.inherits		= &piix_sata_ops,
  	.hardreset		= sata_std_hardreset,
  	.scr_read		= piix_sidpr_scr_read,
-@@ -638,7 +638,7 @@ static const struct ich_laptop ich_lapto
- 	{ 0x2653, 0x1043, 0x82D8 },	/* ICH6M on Asus Eee 701 */
- 	{ 0x27df, 0x104d, 0x900e },	/* ICH7 on Sony TZ-90 */
- 	/* end marker */
--	{ 0, }
-+	{ 0, 0, 0 }
- };
- 
- /**
-@@ -1130,7 +1130,7 @@ static int piix_broken_suspend(void)
- 			},
- 		},
- 
--		{ }	/* terminate list */
-+		{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }	/* terminate list */
- 	};
- 	static const char *oemstrs[] = {
- 		"Tecra M3,",
-diff -urNp linux-2.6.38.2/drivers/ata/libahci.c linux-2.6.38.2/drivers/ata/libahci.c
---- linux-2.6.38.2/drivers/ata/libahci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/libahci.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/libahci.c linux-2.6.38.7/drivers/ata/libahci.c
+--- linux-2.6.38.7/drivers/ata/libahci.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/libahci.c	2011-05-10 22:06:52.000000000 -0400
 @@ -137,7 +137,7 @@ struct device_attribute *ahci_sdev_attrs
  };
  EXPORT_SYMBOL_GPL(ahci_sdev_attrs);
@@ -20841,9 +23185,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/libahci.c linux-2.6.38.2/drivers/ata/libah
  	.inherits		= &sata_pmp_port_ops,
  
  	.qc_defer		= ahci_pmp_qc_defer,
-diff -urNp linux-2.6.38.2/drivers/ata/libata-acpi.c linux-2.6.38.2/drivers/ata/libata-acpi.c
---- linux-2.6.38.2/drivers/ata/libata-acpi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/libata-acpi.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/libata-acpi.c linux-2.6.38.7/drivers/ata/libata-acpi.c
+--- linux-2.6.38.7/drivers/ata/libata-acpi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/libata-acpi.c	2011-04-28 19:34:15.000000000 -0400
 @@ -218,12 +218,12 @@ static void ata_acpi_dev_uevent(acpi_han
  	ata_acpi_uevent(dev->link->ap, dev, event);
  }
@@ -20859,36 +23203,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/libata-acpi.c linux-2.6.38.2/drivers/ata/l
  	.handler = ata_acpi_ap_notify_dock,
  	.uevent = ata_acpi_ap_uevent,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/libata-core.c linux-2.6.38.2/drivers/ata/libata-core.c
---- linux-2.6.38.2/drivers/ata/libata-core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/libata-core.c	2011-03-21 18:31:35.000000000 -0400
-@@ -897,7 +897,7 @@ static const struct ata_xfer_ent {
- 	{ ATA_SHIFT_PIO, ATA_NR_PIO_MODES, XFER_PIO_0 },
- 	{ ATA_SHIFT_MWDMA, ATA_NR_MWDMA_MODES, XFER_MW_DMA_0 },
- 	{ ATA_SHIFT_UDMA, ATA_NR_UDMA_MODES, XFER_UDMA_0 },
--	{ -1, },
-+	{ -1, 0, 0 }
- };
- 
- /**
-@@ -2885,7 +2885,7 @@ static const struct ata_timing ata_timin
- 	{ XFER_UDMA_5,     0,   0,   0,   0,   0,   0, 0,    0,  20 },
- 	{ XFER_UDMA_6,     0,   0,   0,   0,   0,   0, 0,    0,  15 },
- 
--	{ 0xFF }
-+	{ 0xFF, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- #define ENOUGH(v, unit)		(((v)-1)/(unit)+1)
-@@ -4141,7 +4141,7 @@ static const struct ata_blacklist_entry 
- 	{ "PIONEER DVD-RW  DVR-212D",	"1.28", ATA_HORKAGE_NOSETXFER },
- 
- 	/* End Marker */
--	{ }
-+	{ NULL, NULL, 0 }
- };
- 
- /**
+diff -urNp linux-2.6.38.7/drivers/ata/libata-core.c linux-2.6.38.7/drivers/ata/libata-core.c
+--- linux-2.6.38.7/drivers/ata/libata-core.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/libata-core.c	2011-05-10 22:06:52.000000000 -0400
 @@ -4746,7 +4746,7 @@ void ata_qc_free(struct ata_queued_cmd *
  	struct ata_port *ap;
  	unsigned int tag;
@@ -20953,10 +23270,19 @@ diff -urNp linux-2.6.38.2/drivers/ata/libata-core.c linux-2.6.38.2/drivers/ata/l
  	.qc_prep		= ata_noop_qc_prep,
  	.qc_issue		= ata_dummy_qc_issue,
  	.error_handler		= ata_dummy_error_handler,
-diff -urNp linux-2.6.38.2/drivers/ata/libata-eh.c linux-2.6.38.2/drivers/ata/libata-eh.c
---- linux-2.6.38.2/drivers/ata/libata-eh.c	2011-03-23 17:20:06.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/libata-eh.c	2011-03-23 17:21:49.000000000 -0400
-@@ -3880,7 +3880,7 @@ void ata_do_eh(struct ata_port *ap, ata_
+diff -urNp linux-2.6.38.7/drivers/ata/libata-eh.c linux-2.6.38.7/drivers/ata/libata-eh.c
+--- linux-2.6.38.7/drivers/ata/libata-eh.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/libata-eh.c	2011-05-17 19:31:43.000000000 -0400
+@@ -2478,6 +2478,8 @@ void ata_eh_report(struct ata_port *ap)
+ {
+ 	struct ata_link *link;
+ 
++	pax_track_stack();
++
+ 	ata_for_each_link(link, ap, HOST_FIRST)
+ 		ata_eh_link_report(link);
+ }
+@@ -3882,7 +3884,7 @@ void ata_do_eh(struct ata_port *ap, ata_
   */
  void ata_std_error_handler(struct ata_port *ap)
  {
@@ -20965,9 +23291,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/libata-eh.c linux-2.6.38.2/drivers/ata/lib
  	ata_reset_fn_t hardreset = ops->hardreset;
  
  	/* ignore built-in hardreset if SCR access is not available */
-diff -urNp linux-2.6.38.2/drivers/ata/libata-pmp.c linux-2.6.38.2/drivers/ata/libata-pmp.c
---- linux-2.6.38.2/drivers/ata/libata-pmp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/libata-pmp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/libata-pmp.c linux-2.6.38.7/drivers/ata/libata-pmp.c
+--- linux-2.6.38.7/drivers/ata/libata-pmp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/libata-pmp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -912,7 +912,7 @@ static int sata_pmp_handle_link_fail(str
   */
  static int sata_pmp_eh_recover(struct ata_port *ap)
@@ -20977,9 +23303,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/libata-pmp.c linux-2.6.38.2/drivers/ata/li
  	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
  	struct ata_link *pmp_link = &ap->link;
  	struct ata_device *pmp_dev = pmp_link->device;
-diff -urNp linux-2.6.38.2/drivers/ata/pata_acpi.c linux-2.6.38.2/drivers/ata/pata_acpi.c
---- linux-2.6.38.2/drivers/ata/pata_acpi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_acpi.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_acpi.c linux-2.6.38.7/drivers/ata/pata_acpi.c
+--- linux-2.6.38.7/drivers/ata/pata_acpi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_acpi.c	2011-04-28 19:34:15.000000000 -0400
 @@ -216,7 +216,7 @@ static struct scsi_host_template pacpi_s
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -20989,9 +23315,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_acpi.c linux-2.6.38.2/drivers/ata/pat
  	.inherits		= &ata_bmdma_port_ops,
  	.qc_issue		= pacpi_qc_issue,
  	.cable_detect		= pacpi_cable_detect,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_ali.c linux-2.6.38.2/drivers/ata/pata_ali.c
---- linux-2.6.38.2/drivers/ata/pata_ali.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_ali.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_ali.c linux-2.6.38.7/drivers/ata/pata_ali.c
+--- linux-2.6.38.7/drivers/ata/pata_ali.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_ali.c	2011-04-28 19:34:15.000000000 -0400
 @@ -363,7 +363,7 @@ static struct scsi_host_template ali_sht
   *	Port operations for PIO only ALi
   */
@@ -21037,9 +23363,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_ali.c linux-2.6.38.2/drivers/ata/pata
  	.inherits	= &ali_dma_base_ops,
  	.check_atapi_dma = ali_check_atapi_dma,
  	.dev_config	= ali_warn_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_amd.c linux-2.6.38.2/drivers/ata/pata_amd.c
---- linux-2.6.38.2/drivers/ata/pata_amd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_amd.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_amd.c linux-2.6.38.7/drivers/ata/pata_amd.c
+--- linux-2.6.38.7/drivers/ata/pata_amd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_amd.c	2011-04-28 19:34:15.000000000 -0400
 @@ -397,28 +397,28 @@ static const struct ata_port_operations 
  	.prereset	= amd_pre_reset,
  };
@@ -21089,9 +23415,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_amd.c linux-2.6.38.2/drivers/ata/pata
  	.inherits	= &nv_base_port_ops,
  	.set_piomode	= nv133_set_piomode,
  	.set_dmamode	= nv133_set_dmamode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_artop.c linux-2.6.38.2/drivers/ata/pata_artop.c
---- linux-2.6.38.2/drivers/ata/pata_artop.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_artop.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_artop.c linux-2.6.38.7/drivers/ata/pata_artop.c
+--- linux-2.6.38.7/drivers/ata/pata_artop.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_artop.c	2011-04-28 19:34:15.000000000 -0400
 @@ -312,7 +312,7 @@ static struct scsi_host_template artop_s
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21110,9 +23436,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_artop.c linux-2.6.38.2/drivers/ata/pa
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= artop6260_cable_detect,
  	.set_piomode		= artop6260_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_at32.c linux-2.6.38.2/drivers/ata/pata_at32.c
---- linux-2.6.38.2/drivers/ata/pata_at32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_at32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_at32.c linux-2.6.38.7/drivers/ata/pata_at32.c
+--- linux-2.6.38.7/drivers/ata/pata_at32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_at32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -173,7 +173,7 @@ static struct scsi_host_template at32_sh
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21122,9 +23448,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_at32.c linux-2.6.38.2/drivers/ata/pat
  	.inherits		= &ata_sff_port_ops,
  	.cable_detect		= ata_cable_40wire,
  	.set_piomode		= pata_at32_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_at91.c linux-2.6.38.2/drivers/ata/pata_at91.c
---- linux-2.6.38.2/drivers/ata/pata_at91.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_at91.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_at91.c linux-2.6.38.7/drivers/ata/pata_at91.c
+--- linux-2.6.38.7/drivers/ata/pata_at91.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_at91.c	2011-04-28 19:34:15.000000000 -0400
 @@ -196,7 +196,7 @@ static struct scsi_host_template pata_at
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21134,9 +23460,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_at91.c linux-2.6.38.2/drivers/ata/pat
  	.inherits	= &ata_sff_port_ops,
  
  	.sff_data_xfer	= pata_at91_data_xfer_noirq,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_atiixp.c linux-2.6.38.2/drivers/ata/pata_atiixp.c
---- linux-2.6.38.2/drivers/ata/pata_atiixp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_atiixp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_atiixp.c linux-2.6.38.7/drivers/ata/pata_atiixp.c
+--- linux-2.6.38.7/drivers/ata/pata_atiixp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_atiixp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -214,7 +214,7 @@ static struct scsi_host_template atiixp_
  	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
  };
@@ -21146,9 +23472,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_atiixp.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  
  	.qc_prep 	= ata_bmdma_dumb_qc_prep,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_atp867x.c linux-2.6.38.2/drivers/ata/pata_atp867x.c
---- linux-2.6.38.2/drivers/ata/pata_atp867x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_atp867x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_atp867x.c linux-2.6.38.7/drivers/ata/pata_atp867x.c
+--- linux-2.6.38.7/drivers/ata/pata_atp867x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_atp867x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -275,7 +275,7 @@ static struct scsi_host_template atp867x
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21158,9 +23484,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_atp867x.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= atp867x_cable_detect,
  	.set_piomode		= atp867x_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_bf54x.c linux-2.6.38.2/drivers/ata/pata_bf54x.c
---- linux-2.6.38.2/drivers/ata/pata_bf54x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_bf54x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_bf54x.c linux-2.6.38.7/drivers/ata/pata_bf54x.c
+--- linux-2.6.38.7/drivers/ata/pata_bf54x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_bf54x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1420,7 +1420,7 @@ static struct scsi_host_template bfin_sh
  	.dma_boundary		= ATA_DMA_BOUNDARY,
  };
@@ -21170,9 +23496,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_bf54x.c linux-2.6.38.2/drivers/ata/pa
  	.inherits		= &ata_bmdma_port_ops,
  
  	.set_piomode		= bfin_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cmd640.c linux-2.6.38.2/drivers/ata/pata_cmd640.c
---- linux-2.6.38.2/drivers/ata/pata_cmd640.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cmd640.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cmd640.c linux-2.6.38.7/drivers/ata/pata_cmd640.c
+--- linux-2.6.38.7/drivers/ata/pata_cmd640.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cmd640.c	2011-04-28 19:34:15.000000000 -0400
 @@ -176,7 +176,7 @@ static struct scsi_host_template cmd640_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21182,9 +23508,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cmd640.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_sff_port_ops,
  	/* In theory xfer_noirq is not needed once we kill the prefetcher */
  	.sff_data_xfer	= ata_sff_data_xfer_noirq,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cmd64x.c linux-2.6.38.2/drivers/ata/pata_cmd64x.c
---- linux-2.6.38.2/drivers/ata/pata_cmd64x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cmd64x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cmd64x.c linux-2.6.38.7/drivers/ata/pata_cmd64x.c
+--- linux-2.6.38.7/drivers/ata/pata_cmd64x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cmd64x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -268,18 +268,18 @@ static const struct ata_port_operations 
  	.set_dmamode	= cmd64x_set_dmamode,
  };
@@ -21207,9 +23533,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cmd64x.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &cmd64x_base_ops,
  	.bmdma_stop	= cmd648_bmdma_stop,
  	.cable_detect	= cmd648_cable_detect,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5520.c linux-2.6.38.2/drivers/ata/pata_cs5520.c
---- linux-2.6.38.2/drivers/ata/pata_cs5520.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cs5520.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cs5520.c linux-2.6.38.7/drivers/ata/pata_cs5520.c
+--- linux-2.6.38.7/drivers/ata/pata_cs5520.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cs5520.c	2011-04-28 19:34:15.000000000 -0400
 @@ -108,7 +108,7 @@ static struct scsi_host_template cs5520_
  	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
  };
@@ -21219,9 +23545,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5520.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_bmdma_port_ops,
  	.qc_prep		= ata_bmdma_dumb_qc_prep,
  	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5530.c linux-2.6.38.2/drivers/ata/pata_cs5530.c
---- linux-2.6.38.2/drivers/ata/pata_cs5530.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cs5530.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cs5530.c linux-2.6.38.7/drivers/ata/pata_cs5530.c
+--- linux-2.6.38.7/drivers/ata/pata_cs5530.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cs5530.c	2011-04-28 19:34:15.000000000 -0400
 @@ -164,7 +164,7 @@ static struct scsi_host_template cs5530_
  	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
  };
@@ -21231,9 +23557,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5530.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  
  	.qc_prep 	= ata_bmdma_dumb_qc_prep,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5535.c linux-2.6.38.2/drivers/ata/pata_cs5535.c
---- linux-2.6.38.2/drivers/ata/pata_cs5535.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cs5535.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cs5535.c linux-2.6.38.7/drivers/ata/pata_cs5535.c
+--- linux-2.6.38.7/drivers/ata/pata_cs5535.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cs5535.c	2011-04-28 19:34:15.000000000 -0400
 @@ -160,7 +160,7 @@ static struct scsi_host_template cs5535_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21243,9 +23569,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5535.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= cs5535_cable_detect,
  	.set_piomode	= cs5535_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5536.c linux-2.6.38.2/drivers/ata/pata_cs5536.c
---- linux-2.6.38.2/drivers/ata/pata_cs5536.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cs5536.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cs5536.c linux-2.6.38.7/drivers/ata/pata_cs5536.c
+--- linux-2.6.38.7/drivers/ata/pata_cs5536.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cs5536.c	2011-04-28 19:34:15.000000000 -0400
 @@ -233,7 +233,7 @@ static struct scsi_host_template cs5536_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21255,9 +23581,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cs5536.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_bmdma32_port_ops,
  	.cable_detect		= cs5536_cable_detect,
  	.set_piomode		= cs5536_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_cypress.c linux-2.6.38.2/drivers/ata/pata_cypress.c
---- linux-2.6.38.2/drivers/ata/pata_cypress.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_cypress.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_cypress.c linux-2.6.38.7/drivers/ata/pata_cypress.c
+--- linux-2.6.38.7/drivers/ata/pata_cypress.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_cypress.c	2011-04-28 19:34:15.000000000 -0400
 @@ -115,7 +115,7 @@ static struct scsi_host_template cy82c69
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21267,9 +23593,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_cypress.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= ata_cable_40wire,
  	.set_piomode	= cy82c693_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_efar.c linux-2.6.38.2/drivers/ata/pata_efar.c
---- linux-2.6.38.2/drivers/ata/pata_efar.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_efar.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_efar.c linux-2.6.38.7/drivers/ata/pata_efar.c
+--- linux-2.6.38.7/drivers/ata/pata_efar.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_efar.c	2011-04-28 19:34:15.000000000 -0400
 @@ -238,7 +238,7 @@ static struct scsi_host_template efar_sh
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21279,9 +23605,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_efar.c linux-2.6.38.2/drivers/ata/pat
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= efar_cable_detect,
  	.set_piomode		= efar_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt366.c linux-2.6.38.2/drivers/ata/pata_hpt366.c
---- linux-2.6.38.2/drivers/ata/pata_hpt366.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_hpt366.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_hpt366.c linux-2.6.38.7/drivers/ata/pata_hpt366.c
+--- linux-2.6.38.7/drivers/ata/pata_hpt366.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_hpt366.c	2011-04-28 19:34:15.000000000 -0400
 @@ -275,7 +275,7 @@ static struct scsi_host_template hpt36x_
   *	Configuration for HPT366/68
   */
@@ -21291,9 +23617,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt366.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= hpt36x_cable_detect,
  	.mode_filter	= hpt366_filter,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt37x.c linux-2.6.38.2/drivers/ata/pata_hpt37x.c
---- linux-2.6.38.2/drivers/ata/pata_hpt37x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_hpt37x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_hpt37x.c linux-2.6.38.7/drivers/ata/pata_hpt37x.c
+--- linux-2.6.38.7/drivers/ata/pata_hpt37x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_hpt37x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -587,7 +587,7 @@ static struct scsi_host_template hpt37x_
   *	Configuration for HPT370
   */
@@ -21339,9 +23665,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt37x.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &hpt372_port_ops,
  	.cable_detect	= hpt374_fn1_cable_detect,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt3x2n.c linux-2.6.38.2/drivers/ata/pata_hpt3x2n.c
---- linux-2.6.38.2/drivers/ata/pata_hpt3x2n.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_hpt3x2n.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_hpt3x2n.c linux-2.6.38.7/drivers/ata/pata_hpt3x2n.c
+--- linux-2.6.38.7/drivers/ata/pata_hpt3x2n.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_hpt3x2n.c	2011-04-28 19:34:15.000000000 -0400
 @@ -348,7 +348,7 @@ static struct scsi_host_template hpt3x2n
   *	Configuration for HPT302N/371N.
   */
@@ -21360,9 +23686,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt3x2n.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &hpt3xxn_port_ops,
  	.mode_filter	= &hpt372n_filter,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt3x3.c linux-2.6.38.2/drivers/ata/pata_hpt3x3.c
---- linux-2.6.38.2/drivers/ata/pata_hpt3x3.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_hpt3x3.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_hpt3x3.c linux-2.6.38.7/drivers/ata/pata_hpt3x3.c
+--- linux-2.6.38.7/drivers/ata/pata_hpt3x3.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_hpt3x3.c	2011-04-28 19:34:15.000000000 -0400
 @@ -141,7 +141,7 @@ static struct scsi_host_template hpt3x3_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21372,9 +23698,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_hpt3x3.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= ata_cable_40wire,
  	.set_piomode	= hpt3x3_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_icside.c linux-2.6.38.2/drivers/ata/pata_icside.c
---- linux-2.6.38.2/drivers/ata/pata_icside.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_icside.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_icside.c linux-2.6.38.7/drivers/ata/pata_icside.c
+--- linux-2.6.38.7/drivers/ata/pata_icside.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_icside.c	2011-04-28 19:34:15.000000000 -0400
 @@ -320,7 +320,7 @@ static void pata_icside_postreset(struct
  	}
  }
@@ -21384,9 +23710,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_icside.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_bmdma_port_ops,
  	/* no need to build any PRD tables for DMA */
  	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_isapnp.c linux-2.6.38.2/drivers/ata/pata_isapnp.c
---- linux-2.6.38.2/drivers/ata/pata_isapnp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_isapnp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_isapnp.c linux-2.6.38.7/drivers/ata/pata_isapnp.c
+--- linux-2.6.38.7/drivers/ata/pata_isapnp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_isapnp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -23,12 +23,12 @@ static struct scsi_host_template isapnp_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21402,9 +23728,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_isapnp.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_sff_port_ops,
  	.cable_detect	= ata_cable_40wire,
  	/* No altstatus so we don't want to use the lost interrupt poll */
-diff -urNp linux-2.6.38.2/drivers/ata/pata_it8213.c linux-2.6.38.2/drivers/ata/pata_it8213.c
---- linux-2.6.38.2/drivers/ata/pata_it8213.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_it8213.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_it8213.c linux-2.6.38.7/drivers/ata/pata_it8213.c
+--- linux-2.6.38.7/drivers/ata/pata_it8213.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_it8213.c	2011-04-28 19:34:15.000000000 -0400
 @@ -233,7 +233,7 @@ static struct scsi_host_template it8213_
  };
  
@@ -21414,9 +23740,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_it8213.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= it8213_cable_detect,
  	.set_piomode		= it8213_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_it821x.c linux-2.6.38.2/drivers/ata/pata_it821x.c
---- linux-2.6.38.2/drivers/ata/pata_it821x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_it821x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_it821x.c linux-2.6.38.7/drivers/ata/pata_it821x.c
+--- linux-2.6.38.7/drivers/ata/pata_it821x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_it821x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -801,7 +801,7 @@ static struct scsi_host_template it821x_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21444,9 +23770,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_it821x.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  
  	.check_atapi_dma= it821x_check_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_ixp4xx_cf.c linux-2.6.38.2/drivers/ata/pata_ixp4xx_cf.c
---- linux-2.6.38.2/drivers/ata/pata_ixp4xx_cf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_ixp4xx_cf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_ixp4xx_cf.c linux-2.6.38.7/drivers/ata/pata_ixp4xx_cf.c
+--- linux-2.6.38.7/drivers/ata/pata_ixp4xx_cf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_ixp4xx_cf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -89,7 +89,7 @@ static struct scsi_host_template ixp4xx_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21456,9 +23782,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_ixp4xx_cf.c linux-2.6.38.2/drivers/at
  	.inherits		= &ata_sff_port_ops,
  	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
  	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_jmicron.c linux-2.6.38.2/drivers/ata/pata_jmicron.c
---- linux-2.6.38.2/drivers/ata/pata_jmicron.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_jmicron.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_jmicron.c linux-2.6.38.7/drivers/ata/pata_jmicron.c
+--- linux-2.6.38.7/drivers/ata/pata_jmicron.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_jmicron.c	2011-04-28 19:34:15.000000000 -0400
 @@ -111,7 +111,7 @@ static struct scsi_host_template jmicron
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21468,9 +23794,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_jmicron.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.prereset		= jmicron_pre_reset,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_legacy.c linux-2.6.38.2/drivers/ata/pata_legacy.c
---- linux-2.6.38.2/drivers/ata/pata_legacy.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_legacy.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_legacy.c linux-2.6.38.7/drivers/ata/pata_legacy.c
+--- linux-2.6.38.7/drivers/ata/pata_legacy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_legacy.c	2011-04-28 19:34:15.000000000 -0400
 @@ -116,7 +116,7 @@ struct legacy_probe {
  
  struct legacy_controller {
@@ -21582,9 +23908,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_legacy.c linux-2.6.38.2/drivers/ata/p
  	struct legacy_data *ld = &legacy_data[probe->slot];
  	struct ata_host *host = NULL;
  	struct ata_port *ap;
-diff -urNp linux-2.6.38.2/drivers/ata/pata_macio.c linux-2.6.38.2/drivers/ata/pata_macio.c
---- linux-2.6.38.2/drivers/ata/pata_macio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_macio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_macio.c linux-2.6.38.7/drivers/ata/pata_macio.c
+--- linux-2.6.38.7/drivers/ata/pata_macio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_macio.c	2011-04-28 19:34:15.000000000 -0400
 @@ -918,9 +918,8 @@ static struct scsi_host_template pata_ma
  	.slave_configure	= pata_macio_slave_config,
  };
@@ -21596,9 +23922,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_macio.c linux-2.6.38.2/drivers/ata/pa
  	.freeze			= pata_macio_freeze,
  	.set_piomode		= pata_macio_set_timings,
  	.set_dmamode		= pata_macio_set_timings,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_marvell.c linux-2.6.38.2/drivers/ata/pata_marvell.c
---- linux-2.6.38.2/drivers/ata/pata_marvell.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_marvell.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_marvell.c linux-2.6.38.7/drivers/ata/pata_marvell.c
+--- linux-2.6.38.7/drivers/ata/pata_marvell.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_marvell.c	2011-04-28 19:34:15.000000000 -0400
 @@ -100,7 +100,7 @@ static struct scsi_host_template marvell
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21608,9 +23934,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_marvell.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= marvell_cable_detect,
  	.prereset		= marvell_pre_reset,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_mpc52xx.c linux-2.6.38.2/drivers/ata/pata_mpc52xx.c
---- linux-2.6.38.2/drivers/ata/pata_mpc52xx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_mpc52xx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_mpc52xx.c linux-2.6.38.7/drivers/ata/pata_mpc52xx.c
+--- linux-2.6.38.7/drivers/ata/pata_mpc52xx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_mpc52xx.c	2011-04-28 19:34:15.000000000 -0400
 @@ -609,7 +609,7 @@ static struct scsi_host_template mpc52xx
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21620,9 +23946,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_mpc52xx.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.sff_dev_select		= mpc52xx_ata_dev_select,
  	.set_piomode		= mpc52xx_ata_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_mpiix.c linux-2.6.38.2/drivers/ata/pata_mpiix.c
---- linux-2.6.38.2/drivers/ata/pata_mpiix.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_mpiix.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_mpiix.c linux-2.6.38.7/drivers/ata/pata_mpiix.c
+--- linux-2.6.38.7/drivers/ata/pata_mpiix.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_mpiix.c	2011-04-28 19:34:15.000000000 -0400
 @@ -140,7 +140,7 @@ static struct scsi_host_template mpiix_s
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21632,9 +23958,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_mpiix.c linux-2.6.38.2/drivers/ata/pa
  	.inherits	= &ata_sff_port_ops,
  	.qc_issue	= mpiix_qc_issue,
  	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_netcell.c linux-2.6.38.2/drivers/ata/pata_netcell.c
---- linux-2.6.38.2/drivers/ata/pata_netcell.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_netcell.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_netcell.c linux-2.6.38.7/drivers/ata/pata_netcell.c
+--- linux-2.6.38.7/drivers/ata/pata_netcell.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_netcell.c	2011-04-28 19:34:15.000000000 -0400
 @@ -34,7 +34,7 @@ static struct scsi_host_template netcell
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21644,9 +23970,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_netcell.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= ata_cable_80wire,
  	.read_id	= netcell_read_id,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_ninja32.c linux-2.6.38.2/drivers/ata/pata_ninja32.c
---- linux-2.6.38.2/drivers/ata/pata_ninja32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_ninja32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_ninja32.c linux-2.6.38.7/drivers/ata/pata_ninja32.c
+--- linux-2.6.38.7/drivers/ata/pata_ninja32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_ninja32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -81,7 +81,7 @@ static struct scsi_host_template ninja32
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21656,9 +23982,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_ninja32.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_bmdma_port_ops,
  	.sff_dev_select = ninja32_dev_select,
  	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_ns87410.c linux-2.6.38.2/drivers/ata/pata_ns87410.c
---- linux-2.6.38.2/drivers/ata/pata_ns87410.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_ns87410.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_ns87410.c linux-2.6.38.7/drivers/ata/pata_ns87410.c
+--- linux-2.6.38.7/drivers/ata/pata_ns87410.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_ns87410.c	2011-04-28 19:34:15.000000000 -0400
 @@ -132,7 +132,7 @@ static struct scsi_host_template ns87410
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21668,9 +23994,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_ns87410.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_sff_port_ops,
  	.qc_issue	= ns87410_qc_issue,
  	.cable_detect	= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_ns87415.c linux-2.6.38.2/drivers/ata/pata_ns87415.c
---- linux-2.6.38.2/drivers/ata/pata_ns87415.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_ns87415.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_ns87415.c linux-2.6.38.7/drivers/ata/pata_ns87415.c
+--- linux-2.6.38.7/drivers/ata/pata_ns87415.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_ns87415.c	2011-04-28 19:34:15.000000000 -0400
 @@ -299,7 +299,7 @@ static u8 ns87560_bmdma_status(struct at
  }
  #endif		/* 87560 SuperIO Support */
@@ -21689,9 +24015,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_ns87415.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ns87415_pata_ops,
  	.sff_tf_read		= ns87560_tf_read,
  	.sff_check_status	= ns87560_check_status,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_octeon_cf.c linux-2.6.38.2/drivers/ata/pata_octeon_cf.c
---- linux-2.6.38.2/drivers/ata/pata_octeon_cf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_octeon_cf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_octeon_cf.c linux-2.6.38.7/drivers/ata/pata_octeon_cf.c
+--- linux-2.6.38.7/drivers/ata/pata_octeon_cf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_octeon_cf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -780,7 +780,7 @@ static unsigned int octeon_cf_qc_issue(s
  	return 0;
  }
@@ -21701,9 +24027,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_octeon_cf.c linux-2.6.38.2/drivers/at
  	.inherits		= &ata_sff_port_ops,
  	.check_atapi_dma	= octeon_cf_check_atapi_dma,
  	.qc_prep		= ata_noop_qc_prep,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_oldpiix.c linux-2.6.38.2/drivers/ata/pata_oldpiix.c
---- linux-2.6.38.2/drivers/ata/pata_oldpiix.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_oldpiix.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_oldpiix.c linux-2.6.38.7/drivers/ata/pata_oldpiix.c
+--- linux-2.6.38.7/drivers/ata/pata_oldpiix.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_oldpiix.c	2011-04-28 19:34:15.000000000 -0400
 @@ -208,7 +208,7 @@ static struct scsi_host_template oldpiix
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21713,9 +24039,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_oldpiix.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.qc_issue		= oldpiix_qc_issue,
  	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_opti.c linux-2.6.38.2/drivers/ata/pata_opti.c
---- linux-2.6.38.2/drivers/ata/pata_opti.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_opti.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_opti.c linux-2.6.38.7/drivers/ata/pata_opti.c
+--- linux-2.6.38.7/drivers/ata/pata_opti.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_opti.c	2011-04-28 19:34:15.000000000 -0400
 @@ -152,7 +152,7 @@ static struct scsi_host_template opti_sh
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21725,9 +24051,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_opti.c linux-2.6.38.2/drivers/ata/pat
  	.inherits	= &ata_sff_port_ops,
  	.cable_detect	= ata_cable_40wire,
  	.set_piomode	= opti_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_optidma.c linux-2.6.38.2/drivers/ata/pata_optidma.c
---- linux-2.6.38.2/drivers/ata/pata_optidma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_optidma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_optidma.c linux-2.6.38.7/drivers/ata/pata_optidma.c
+--- linux-2.6.38.7/drivers/ata/pata_optidma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_optidma.c	2011-04-28 19:34:15.000000000 -0400
 @@ -337,7 +337,7 @@ static struct scsi_host_template optidma
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21746,9 +24072,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_optidma.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &optidma_port_ops,
  	.set_piomode	= optiplus_set_pio_mode,
  	.set_dmamode	= optiplus_set_dma_mode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_palmld.c linux-2.6.38.2/drivers/ata/pata_palmld.c
---- linux-2.6.38.2/drivers/ata/pata_palmld.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_palmld.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_palmld.c linux-2.6.38.7/drivers/ata/pata_palmld.c
+--- linux-2.6.38.7/drivers/ata/pata_palmld.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_palmld.c	2011-04-28 19:34:15.000000000 -0400
 @@ -37,7 +37,7 @@ static struct scsi_host_template palmld_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21758,9 +24084,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_palmld.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_sff_port_ops,
  	.sff_data_xfer		= ata_sff_data_xfer_noirq,
  	.cable_detect		= ata_cable_40wire,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_pcmcia.c linux-2.6.38.2/drivers/ata/pata_pcmcia.c
---- linux-2.6.38.2/drivers/ata/pata_pcmcia.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_pcmcia.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_pcmcia.c linux-2.6.38.7/drivers/ata/pata_pcmcia.c
+--- linux-2.6.38.7/drivers/ata/pata_pcmcia.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_pcmcia.c	2011-04-28 19:34:15.000000000 -0400
 @@ -151,14 +151,14 @@ static struct scsi_host_template pcmcia_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21787,9 +24113,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_pcmcia.c linux-2.6.38.2/drivers/ata/p
  
  	/* Set up attributes in order to probe card and get resources */
  	pdev->config_flags |= CONF_ENABLE_IRQ | CONF_AUTO_SET_IO |
-diff -urNp linux-2.6.38.2/drivers/ata/pata_pdc2027x.c linux-2.6.38.2/drivers/ata/pata_pdc2027x.c
---- linux-2.6.38.2/drivers/ata/pata_pdc2027x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_pdc2027x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_pdc2027x.c linux-2.6.38.7/drivers/ata/pata_pdc2027x.c
+--- linux-2.6.38.7/drivers/ata/pata_pdc2027x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_pdc2027x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -132,14 +132,14 @@ static struct scsi_host_template pdc2027
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21807,9 +24133,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_pdc2027x.c linux-2.6.38.2/drivers/ata
  	.inherits		= &pdc2027x_pata100_ops,
  	.mode_filter		= pdc2027x_mode_filter,
  	.set_piomode		= pdc2027x_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_pdc202xx_old.c linux-2.6.38.2/drivers/ata/pata_pdc202xx_old.c
---- linux-2.6.38.2/drivers/ata/pata_pdc202xx_old.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_pdc202xx_old.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_pdc202xx_old.c linux-2.6.38.7/drivers/ata/pata_pdc202xx_old.c
+--- linux-2.6.38.7/drivers/ata/pata_pdc202xx_old.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_pdc202xx_old.c	2011-04-28 19:34:15.000000000 -0400
 @@ -295,7 +295,7 @@ static struct scsi_host_template pdc202x
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21828,9 +24154,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_pdc202xx_old.c linux-2.6.38.2/drivers
  	.inherits		= &pdc2024x_port_ops,
  
  	.check_atapi_dma	= pdc2026x_check_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_piccolo.c linux-2.6.38.2/drivers/ata/pata_piccolo.c
---- linux-2.6.38.2/drivers/ata/pata_piccolo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_piccolo.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_piccolo.c linux-2.6.38.7/drivers/ata/pata_piccolo.c
+--- linux-2.6.38.7/drivers/ata/pata_piccolo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_piccolo.c	2011-04-28 19:34:15.000000000 -0400
 @@ -67,7 +67,7 @@ static struct scsi_host_template tosh_sh
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21840,9 +24166,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_piccolo.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_bmdma_port_ops,
  	.cable_detect	= ata_cable_unknown,
  	.set_piomode	= tosh_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_platform.c linux-2.6.38.2/drivers/ata/pata_platform.c
---- linux-2.6.38.2/drivers/ata/pata_platform.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_platform.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_platform.c linux-2.6.38.7/drivers/ata/pata_platform.c
+--- linux-2.6.38.7/drivers/ata/pata_platform.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_platform.c	2011-04-28 19:34:15.000000000 -0400
 @@ -48,7 +48,7 @@ static struct scsi_host_template pata_pl
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21852,9 +24178,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_platform.c linux-2.6.38.2/drivers/ata
  	.inherits		= &ata_sff_port_ops,
  	.sff_data_xfer		= ata_sff_data_xfer_noirq,
  	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_pxa.c linux-2.6.38.2/drivers/ata/pata_pxa.c
---- linux-2.6.38.2/drivers/ata/pata_pxa.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_pxa.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_pxa.c linux-2.6.38.7/drivers/ata/pata_pxa.c
+--- linux-2.6.38.7/drivers/ata/pata_pxa.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_pxa.c	2011-04-28 19:34:15.000000000 -0400
 @@ -198,7 +198,7 @@ static struct scsi_host_template pxa_ata
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21864,9 +24190,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_pxa.c linux-2.6.38.2/drivers/ata/pata
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= ata_cable_40wire,
  
-diff -urNp linux-2.6.38.2/drivers/ata/pata_qdi.c linux-2.6.38.2/drivers/ata/pata_qdi.c
---- linux-2.6.38.2/drivers/ata/pata_qdi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_qdi.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_qdi.c linux-2.6.38.7/drivers/ata/pata_qdi.c
+--- linux-2.6.38.7/drivers/ata/pata_qdi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_qdi.c	2011-04-28 19:34:15.000000000 -0400
 @@ -157,7 +157,7 @@ static struct scsi_host_template qdi_sht
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21885,9 +24211,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_qdi.c linux-2.6.38.2/drivers/ata/pata
  	.inherits	= &qdi6500_port_ops,
  	.set_piomode	= qdi6580_set_piomode,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_radisys.c linux-2.6.38.2/drivers/ata/pata_radisys.c
---- linux-2.6.38.2/drivers/ata/pata_radisys.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_radisys.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_radisys.c linux-2.6.38.7/drivers/ata/pata_radisys.c
+--- linux-2.6.38.7/drivers/ata/pata_radisys.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_radisys.c	2011-04-28 19:34:15.000000000 -0400
 @@ -187,7 +187,7 @@ static struct scsi_host_template radisys
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21897,9 +24223,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_radisys.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &ata_bmdma_port_ops,
  	.qc_issue		= radisys_qc_issue,
  	.cable_detect		= ata_cable_unknown,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_rb532_cf.c linux-2.6.38.2/drivers/ata/pata_rb532_cf.c
---- linux-2.6.38.2/drivers/ata/pata_rb532_cf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_rb532_cf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_rb532_cf.c linux-2.6.38.7/drivers/ata/pata_rb532_cf.c
+--- linux-2.6.38.7/drivers/ata/pata_rb532_cf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_rb532_cf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -69,7 +69,7 @@ static irqreturn_t rb532_pata_irq_handle
  	return IRQ_HANDLED;
  }
@@ -21909,9 +24235,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_rb532_cf.c linux-2.6.38.2/drivers/ata
  	.inherits		= &ata_sff_port_ops,
  	.sff_data_xfer		= ata_sff_data_xfer32,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_rdc.c linux-2.6.38.2/drivers/ata/pata_rdc.c
---- linux-2.6.38.2/drivers/ata/pata_rdc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_rdc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_rdc.c linux-2.6.38.7/drivers/ata/pata_rdc.c
+--- linux-2.6.38.7/drivers/ata/pata_rdc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_rdc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -273,7 +273,7 @@ static void rdc_set_dmamode(struct ata_p
  	pci_write_config_byte(dev, 0x48, udma_enable);
  }
@@ -21921,9 +24247,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_rdc.c linux-2.6.38.2/drivers/ata/pata
  	.inherits		= &ata_bmdma32_port_ops,
  	.cable_detect		= rdc_pata_cable_detect,
  	.set_piomode		= rdc_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_rz1000.c linux-2.6.38.2/drivers/ata/pata_rz1000.c
---- linux-2.6.38.2/drivers/ata/pata_rz1000.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_rz1000.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_rz1000.c linux-2.6.38.7/drivers/ata/pata_rz1000.c
+--- linux-2.6.38.7/drivers/ata/pata_rz1000.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_rz1000.c	2011-04-28 19:34:15.000000000 -0400
 @@ -54,7 +54,7 @@ static struct scsi_host_template rz1000_
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21933,9 +24259,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_rz1000.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_sff_port_ops,
  	.cable_detect	= ata_cable_40wire,
  	.set_mode	= rz1000_set_mode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_samsung_cf.c linux-2.6.38.2/drivers/ata/pata_samsung_cf.c
---- linux-2.6.38.2/drivers/ata/pata_samsung_cf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_samsung_cf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_samsung_cf.c linux-2.6.38.7/drivers/ata/pata_samsung_cf.c
+--- linux-2.6.38.7/drivers/ata/pata_samsung_cf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_samsung_cf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -399,7 +399,7 @@ static struct scsi_host_template pata_s3
  	ATA_PIO_SHT(DRV_NAME),
  };
@@ -21954,9 +24280,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_samsung_cf.c linux-2.6.38.2/drivers/a
  	.inherits		= &ata_sff_port_ops,
  	.set_piomode		= pata_s3c_set_piomode,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_sc1200.c linux-2.6.38.2/drivers/ata/pata_sc1200.c
---- linux-2.6.38.2/drivers/ata/pata_sc1200.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_sc1200.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_sc1200.c linux-2.6.38.7/drivers/ata/pata_sc1200.c
+--- linux-2.6.38.7/drivers/ata/pata_sc1200.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_sc1200.c	2011-04-28 19:34:15.000000000 -0400
 @@ -207,7 +207,7 @@ static struct scsi_host_template sc1200_
  	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
  };
@@ -21966,9 +24292,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_sc1200.c linux-2.6.38.2/drivers/ata/p
  	.inherits	= &ata_bmdma_port_ops,
  	.qc_prep 	= ata_bmdma_dumb_qc_prep,
  	.qc_issue	= sc1200_qc_issue,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_scc.c linux-2.6.38.2/drivers/ata/pata_scc.c
---- linux-2.6.38.2/drivers/ata/pata_scc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_scc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_scc.c linux-2.6.38.7/drivers/ata/pata_scc.c
+--- linux-2.6.38.7/drivers/ata/pata_scc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_scc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -926,7 +926,7 @@ static struct scsi_host_template scc_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21978,9 +24304,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_scc.c linux-2.6.38.2/drivers/ata/pata
  	.inherits		= &ata_bmdma_port_ops,
  
  	.set_piomode		= scc_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_sch.c linux-2.6.38.2/drivers/ata/pata_sch.c
---- linux-2.6.38.2/drivers/ata/pata_sch.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_sch.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_sch.c linux-2.6.38.7/drivers/ata/pata_sch.c
+--- linux-2.6.38.7/drivers/ata/pata_sch.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_sch.c	2011-04-28 19:34:15.000000000 -0400
 @@ -75,7 +75,7 @@ static struct scsi_host_template sch_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -21990,9 +24316,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_sch.c linux-2.6.38.2/drivers/ata/pata
  	.inherits		= &ata_bmdma_port_ops,
  	.cable_detect		= ata_cable_unknown,
  	.set_piomode		= sch_set_piomode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_serverworks.c linux-2.6.38.2/drivers/ata/pata_serverworks.c
---- linux-2.6.38.2/drivers/ata/pata_serverworks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_serverworks.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_serverworks.c linux-2.6.38.7/drivers/ata/pata_serverworks.c
+--- linux-2.6.38.7/drivers/ata/pata_serverworks.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_serverworks.c	2011-04-28 19:34:15.000000000 -0400
 @@ -300,7 +300,7 @@ static struct scsi_host_template serverw
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22011,9 +24337,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_serverworks.c linux-2.6.38.2/drivers/
  	.inherits	= &serverworks_osb4_port_ops,
  	.mode_filter	= serverworks_csb_filter,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pata_sil680.c linux-2.6.38.2/drivers/ata/pata_sil680.c
---- linux-2.6.38.2/drivers/ata/pata_sil680.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_sil680.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_sil680.c linux-2.6.38.7/drivers/ata/pata_sil680.c
+--- linux-2.6.38.7/drivers/ata/pata_sil680.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_sil680.c	2011-04-28 19:34:15.000000000 -0400
 @@ -225,8 +225,7 @@ static struct scsi_host_template sil680_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22024,9 +24350,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_sil680.c linux-2.6.38.2/drivers/ata/p
  	.inherits		= &ata_bmdma32_port_ops,
  	.sff_exec_command	= sil680_sff_exec_command,
  	.sff_irq_check		= sil680_sff_irq_check,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_sis.c linux-2.6.38.2/drivers/ata/pata_sis.c
---- linux-2.6.38.2/drivers/ata/pata_sis.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_sis.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_sis.c linux-2.6.38.7/drivers/ata/pata_sis.c
+--- linux-2.6.38.7/drivers/ata/pata_sis.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_sis.c	2011-04-28 19:34:15.000000000 -0400
 @@ -503,47 +503,47 @@ static struct scsi_host_template sis_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22082,9 +24408,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_sis.c linux-2.6.38.2/drivers/ata/pata
  	.inherits		= &sis_base_ops,
  	.set_piomode		= sis_old_set_piomode,
  	.set_dmamode		= sis_old_set_dmamode,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_sl82c105.c linux-2.6.38.2/drivers/ata/pata_sl82c105.c
---- linux-2.6.38.2/drivers/ata/pata_sl82c105.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_sl82c105.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_sl82c105.c linux-2.6.38.7/drivers/ata/pata_sl82c105.c
+--- linux-2.6.38.7/drivers/ata/pata_sl82c105.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_sl82c105.c	2011-04-28 19:34:15.000000000 -0400
 @@ -241,7 +241,7 @@ static struct scsi_host_template sl82c10
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22094,9 +24420,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_sl82c105.c linux-2.6.38.2/drivers/ata
  	.inherits	= &ata_bmdma_port_ops,
  	.qc_defer	= sl82c105_qc_defer,
  	.bmdma_start 	= sl82c105_bmdma_start,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_triflex.c linux-2.6.38.2/drivers/ata/pata_triflex.c
---- linux-2.6.38.2/drivers/ata/pata_triflex.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_triflex.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_triflex.c linux-2.6.38.7/drivers/ata/pata_triflex.c
+--- linux-2.6.38.7/drivers/ata/pata_triflex.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_triflex.c	2011-04-28 19:34:15.000000000 -0400
 @@ -178,7 +178,7 @@ static struct scsi_host_template triflex
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22106,9 +24432,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_triflex.c linux-2.6.38.2/drivers/ata/
  	.inherits	= &ata_bmdma_port_ops,
  	.bmdma_start 	= triflex_bmdma_start,
  	.bmdma_stop	= triflex_bmdma_stop,
-diff -urNp linux-2.6.38.2/drivers/ata/pata_via.c linux-2.6.38.2/drivers/ata/pata_via.c
---- linux-2.6.38.2/drivers/ata/pata_via.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pata_via.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pata_via.c linux-2.6.38.7/drivers/ata/pata_via.c
+--- linux-2.6.38.7/drivers/ata/pata_via.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pata_via.c	2011-04-28 19:34:15.000000000 -0400
 @@ -441,7 +441,7 @@ static struct scsi_host_template via_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22127,9 +24453,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pata_via.c linux-2.6.38.2/drivers/ata/pata
  	.inherits	= &via_port_ops,
  	.sff_data_xfer	= ata_sff_data_xfer_noirq,
  };
-diff -urNp linux-2.6.38.2/drivers/ata/pdc_adma.c linux-2.6.38.2/drivers/ata/pdc_adma.c
---- linux-2.6.38.2/drivers/ata/pdc_adma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/pdc_adma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/pdc_adma.c linux-2.6.38.7/drivers/ata/pdc_adma.c
+--- linux-2.6.38.7/drivers/ata/pdc_adma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/pdc_adma.c	2011-04-28 19:34:15.000000000 -0400
 @@ -146,7 +146,7 @@ static struct scsi_host_template adma_at
  	.dma_boundary		= ADMA_DMA_BOUNDARY,
  };
@@ -22139,9 +24465,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/pdc_adma.c linux-2.6.38.2/drivers/ata/pdc_
  	.inherits		= &ata_sff_port_ops,
  
  	.lost_interrupt		= ATA_OP_NULL,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_dwc_460ex.c linux-2.6.38.2/drivers/ata/sata_dwc_460ex.c
---- linux-2.6.38.2/drivers/ata/sata_dwc_460ex.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_dwc_460ex.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_dwc_460ex.c linux-2.6.38.7/drivers/ata/sata_dwc_460ex.c
+--- linux-2.6.38.7/drivers/ata/sata_dwc_460ex.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_dwc_460ex.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1560,7 +1560,7 @@ static struct scsi_host_template sata_dw
  	.dma_boundary		= ATA_DMA_BOUNDARY,
  };
@@ -22151,9 +24477,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_dwc_460ex.c linux-2.6.38.2/drivers/at
  	.inherits		= &ata_sff_port_ops,
  
  	.error_handler		= sata_dwc_error_handler,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_fsl.c linux-2.6.38.2/drivers/ata/sata_fsl.c
---- linux-2.6.38.2/drivers/ata/sata_fsl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_fsl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_fsl.c linux-2.6.38.7/drivers/ata/sata_fsl.c
+--- linux-2.6.38.7/drivers/ata/sata_fsl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_fsl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1258,7 +1258,7 @@ static struct scsi_host_template sata_fs
  	.dma_boundary = ATA_DMA_BOUNDARY,
  };
@@ -22163,9 +24489,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_fsl.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &sata_pmp_port_ops,
  
  	.qc_defer = ata_std_qc_defer,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_inic162x.c linux-2.6.38.2/drivers/ata/sata_inic162x.c
---- linux-2.6.38.2/drivers/ata/sata_inic162x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_inic162x.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_inic162x.c linux-2.6.38.7/drivers/ata/sata_inic162x.c
+--- linux-2.6.38.7/drivers/ata/sata_inic162x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_inic162x.c	2011-04-28 19:34:15.000000000 -0400
 @@ -705,7 +705,7 @@ static int inic_port_start(struct ata_po
  	return 0;
  }
@@ -22175,9 +24501,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_inic162x.c linux-2.6.38.2/drivers/ata
  	.inherits		= &sata_port_ops,
  
  	.check_atapi_dma	= inic_check_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_mv.c linux-2.6.38.2/drivers/ata/sata_mv.c
---- linux-2.6.38.2/drivers/ata/sata_mv.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_mv.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_mv.c linux-2.6.38.7/drivers/ata/sata_mv.c
+--- linux-2.6.38.7/drivers/ata/sata_mv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_mv.c	2011-04-28 19:34:15.000000000 -0400
 @@ -663,7 +663,7 @@ static struct scsi_host_template mv6_sht
  	.dma_boundary		= MV_DMA_BOUNDARY,
  };
@@ -22205,9 +24531,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_mv.c linux-2.6.38.2/drivers/ata/sata_
  	.inherits		= &mv6_ops,
  	.dev_config		= ATA_OP_NULL,
  	.qc_prep		= mv_qc_prep_iie,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_nv.c linux-2.6.38.2/drivers/ata/sata_nv.c
---- linux-2.6.38.2/drivers/ata/sata_nv.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_nv.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_nv.c linux-2.6.38.7/drivers/ata/sata_nv.c
+--- linux-2.6.38.7/drivers/ata/sata_nv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_nv.c	2011-04-28 19:34:15.000000000 -0400
 @@ -465,7 +465,7 @@ static struct scsi_host_template nv_swnc
   * cases.  Define nv_hardreset() which only kicks in for post-boot
   * probing and use it for all variants.
@@ -22250,9 +24576,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_nv.c linux-2.6.38.2/drivers/ata/sata_
  	.inherits		= &nv_generic_ops,
  
  	.qc_defer		= ata_std_qc_defer,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_promise.c linux-2.6.38.2/drivers/ata/sata_promise.c
---- linux-2.6.38.2/drivers/ata/sata_promise.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_promise.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_promise.c linux-2.6.38.7/drivers/ata/sata_promise.c
+--- linux-2.6.38.7/drivers/ata/sata_promise.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_promise.c	2011-04-28 19:34:15.000000000 -0400
 @@ -196,7 +196,7 @@ static const struct ata_port_operations 
  	.error_handler		= pdc_error_handler,
  };
@@ -22279,9 +24605,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_promise.c linux-2.6.38.2/drivers/ata/
  	.inherits		= &pdc_common_ops,
  	.cable_detect		= pdc_pata_cable_detect,
  	.freeze			= pdc_freeze,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_qstor.c linux-2.6.38.2/drivers/ata/sata_qstor.c
---- linux-2.6.38.2/drivers/ata/sata_qstor.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_qstor.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_qstor.c linux-2.6.38.7/drivers/ata/sata_qstor.c
+--- linux-2.6.38.7/drivers/ata/sata_qstor.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_qstor.c	2011-04-28 19:34:15.000000000 -0400
 @@ -131,7 +131,7 @@ static struct scsi_host_template qs_ata_
  	.dma_boundary		= QS_DMA_BOUNDARY,
  };
@@ -22291,9 +24617,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_qstor.c linux-2.6.38.2/drivers/ata/sa
  	.inherits		= &ata_sff_port_ops,
  
  	.check_atapi_dma	= qs_check_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_sil24.c linux-2.6.38.2/drivers/ata/sata_sil24.c
---- linux-2.6.38.2/drivers/ata/sata_sil24.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_sil24.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_sil24.c linux-2.6.38.7/drivers/ata/sata_sil24.c
+--- linux-2.6.38.7/drivers/ata/sata_sil24.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_sil24.c	2011-04-28 19:34:15.000000000 -0400
 @@ -389,7 +389,7 @@ static struct scsi_host_template sil24_s
  	.dma_boundary		= ATA_DMA_BOUNDARY,
  };
@@ -22303,9 +24629,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_sil24.c linux-2.6.38.2/drivers/ata/sa
  	.inherits		= &sata_pmp_port_ops,
  
  	.qc_defer		= sil24_qc_defer,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_sil.c linux-2.6.38.2/drivers/ata/sata_sil.c
---- linux-2.6.38.2/drivers/ata/sata_sil.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_sil.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_sil.c linux-2.6.38.7/drivers/ata/sata_sil.c
+--- linux-2.6.38.7/drivers/ata/sata_sil.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_sil.c	2011-04-28 19:34:15.000000000 -0400
 @@ -182,7 +182,7 @@ static struct scsi_host_template sil_sht
  	.sg_tablesize		= ATA_MAX_PRD
  };
@@ -22315,9 +24641,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_sil.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_bmdma32_port_ops,
  	.dev_config		= sil_dev_config,
  	.set_mode		= sil_set_mode,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_sis.c linux-2.6.38.2/drivers/ata/sata_sis.c
---- linux-2.6.38.2/drivers/ata/sata_sis.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_sis.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_sis.c linux-2.6.38.7/drivers/ata/sata_sis.c
+--- linux-2.6.38.7/drivers/ata/sata_sis.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_sis.c	2011-04-28 19:34:15.000000000 -0400
 @@ -89,7 +89,7 @@ static struct scsi_host_template sis_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22327,9 +24653,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_sis.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_bmdma_port_ops,
  	.scr_read		= sis_scr_read,
  	.scr_write		= sis_scr_write,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_svw.c linux-2.6.38.2/drivers/ata/sata_svw.c
---- linux-2.6.38.2/drivers/ata/sata_svw.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_svw.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_svw.c linux-2.6.38.7/drivers/ata/sata_svw.c
+--- linux-2.6.38.7/drivers/ata/sata_svw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_svw.c	2011-04-28 19:34:15.000000000 -0400
 @@ -344,7 +344,7 @@ static struct scsi_host_template k2_sata
  };
  
@@ -22339,9 +24665,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_svw.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_bmdma_port_ops,
  	.sff_tf_load		= k2_sata_tf_load,
  	.sff_tf_read		= k2_sata_tf_read,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_sx4.c linux-2.6.38.2/drivers/ata/sata_sx4.c
---- linux-2.6.38.2/drivers/ata/sata_sx4.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_sx4.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_sx4.c linux-2.6.38.7/drivers/ata/sata_sx4.c
+--- linux-2.6.38.7/drivers/ata/sata_sx4.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_sx4.c	2011-04-28 19:34:15.000000000 -0400
 @@ -249,7 +249,7 @@ static struct scsi_host_template pdc_sat
  };
  
@@ -22351,9 +24677,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_sx4.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_sff_port_ops,
  
  	.check_atapi_dma	= pdc_check_atapi_dma,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_uli.c linux-2.6.38.2/drivers/ata/sata_uli.c
---- linux-2.6.38.2/drivers/ata/sata_uli.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_uli.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_uli.c linux-2.6.38.7/drivers/ata/sata_uli.c
+--- linux-2.6.38.7/drivers/ata/sata_uli.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_uli.c	2011-04-28 19:34:15.000000000 -0400
 @@ -80,7 +80,7 @@ static struct scsi_host_template uli_sht
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22363,9 +24689,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_uli.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_bmdma_port_ops,
  	.scr_read		= uli_scr_read,
  	.scr_write		= uli_scr_write,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_via.c linux-2.6.38.2/drivers/ata/sata_via.c
---- linux-2.6.38.2/drivers/ata/sata_via.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_via.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_via.c linux-2.6.38.7/drivers/ata/sata_via.c
+--- linux-2.6.38.7/drivers/ata/sata_via.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_via.c	2011-04-28 19:34:15.000000000 -0400
 @@ -115,32 +115,32 @@ static struct scsi_host_template svia_sh
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -22404,9 +24730,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_via.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &svia_base_ops,
  	.hardreset		= sata_std_hardreset,
  	.scr_read		= vt8251_scr_read,
-diff -urNp linux-2.6.38.2/drivers/ata/sata_vsc.c linux-2.6.38.2/drivers/ata/sata_vsc.c
---- linux-2.6.38.2/drivers/ata/sata_vsc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ata/sata_vsc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ata/sata_vsc.c linux-2.6.38.7/drivers/ata/sata_vsc.c
+--- linux-2.6.38.7/drivers/ata/sata_vsc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ata/sata_vsc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -300,7 +300,7 @@ static struct scsi_host_template vsc_sat
  };
  
@@ -22416,9 +24742,9 @@ diff -urNp linux-2.6.38.2/drivers/ata/sata_vsc.c linux-2.6.38.2/drivers/ata/sata
  	.inherits		= &ata_bmdma_port_ops,
  	/* The IRQ handling is not quite standard SFF behaviour so we
  	   cannot use the default lost interrupt handler */
-diff -urNp linux-2.6.38.2/drivers/atm/adummy.c linux-2.6.38.2/drivers/atm/adummy.c
---- linux-2.6.38.2/drivers/atm/adummy.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/adummy.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/adummy.c linux-2.6.38.7/drivers/atm/adummy.c
+--- linux-2.6.38.7/drivers/atm/adummy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/adummy.c	2011-04-28 19:34:15.000000000 -0400
 @@ -114,7 +114,7 @@ adummy_send(struct atm_vcc *vcc, struct 
  		vcc->pop(vcc, skb);
  	else
@@ -22428,9 +24754,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/adummy.c linux-2.6.38.2/drivers/atm/adummy
  
  	return 0;
  }
-diff -urNp linux-2.6.38.2/drivers/atm/ambassador.c linux-2.6.38.2/drivers/atm/ambassador.c
---- linux-2.6.38.2/drivers/atm/ambassador.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/ambassador.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/ambassador.c linux-2.6.38.7/drivers/atm/ambassador.c
+--- linux-2.6.38.7/drivers/atm/ambassador.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/ambassador.c	2011-04-28 19:34:15.000000000 -0400
 @@ -454,7 +454,7 @@ static void tx_complete (amb_dev * dev, 
    PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
    
@@ -22467,9 +24793,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/ambassador.c linux-2.6.38.2/drivers/atm/am
      return -ENOMEM; // ?
    }
    
-diff -urNp linux-2.6.38.2/drivers/atm/atmtcp.c linux-2.6.38.2/drivers/atm/atmtcp.c
---- linux-2.6.38.2/drivers/atm/atmtcp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/atmtcp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/atmtcp.c linux-2.6.38.7/drivers/atm/atmtcp.c
+--- linux-2.6.38.7/drivers/atm/atmtcp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/atmtcp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -207,7 +207,7 @@ static int atmtcp_v_send(struct atm_vcc 
  		if (vcc->pop) vcc->pop(vcc,skb);
  		else dev_kfree_skb(skb);
@@ -22519,9 +24845,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/atmtcp.c linux-2.6.38.2/drivers/atm/atmtcp
  done:
  	if (vcc->pop) vcc->pop(vcc,skb);
  	else dev_kfree_skb(skb);
-diff -urNp linux-2.6.38.2/drivers/atm/eni.c linux-2.6.38.2/drivers/atm/eni.c
---- linux-2.6.38.2/drivers/atm/eni.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/eni.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/eni.c linux-2.6.38.7/drivers/atm/eni.c
+--- linux-2.6.38.7/drivers/atm/eni.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/eni.c	2011-04-28 19:34:15.000000000 -0400
 @@ -526,7 +526,7 @@ static int rx_aal0(struct atm_vcc *vcc)
  		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
  		    vcc->dev->number);
@@ -22567,9 +24893,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/eni.c linux-2.6.38.2/drivers/atm/eni.c
  		wake_up(&eni_dev->tx_wait);
  dma_complete++;
  	}
-diff -urNp linux-2.6.38.2/drivers/atm/firestream.c linux-2.6.38.2/drivers/atm/firestream.c
---- linux-2.6.38.2/drivers/atm/firestream.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/firestream.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/firestream.c linux-2.6.38.7/drivers/atm/firestream.c
+--- linux-2.6.38.7/drivers/atm/firestream.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/firestream.c	2011-04-28 19:34:15.000000000 -0400
 @@ -749,7 +749,7 @@ static void process_txdone_queue (struct
  				}
  			}
@@ -22603,9 +24929,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/firestream.c linux-2.6.38.2/drivers/atm/fi
  			break;
  		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
  			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
-diff -urNp linux-2.6.38.2/drivers/atm/fore200e.c linux-2.6.38.2/drivers/atm/fore200e.c
---- linux-2.6.38.2/drivers/atm/fore200e.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/fore200e.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/fore200e.c linux-2.6.38.7/drivers/atm/fore200e.c
+--- linux-2.6.38.7/drivers/atm/fore200e.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/fore200e.c	2011-04-28 19:34:15.000000000 -0400
 @@ -933,9 +933,9 @@ fore200e_tx_irq(struct fore200e* fore200
  #endif
  		/* check error condition */
@@ -22662,9 +24988,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/fore200e.c linux-2.6.38.2/drivers/atm/fore
  
  	    fore200e->tx_sat++;
  	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
-diff -urNp linux-2.6.38.2/drivers/atm/he.c linux-2.6.38.2/drivers/atm/he.c
---- linux-2.6.38.2/drivers/atm/he.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/he.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/he.c linux-2.6.38.7/drivers/atm/he.c
+--- linux-2.6.38.7/drivers/atm/he.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/he.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1709,7 +1709,7 @@ he_service_rbrq(struct he_dev *he_dev, i
  
  		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
@@ -22746,9 +25072,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/he.c linux-2.6.38.2/drivers/atm/he.c
  
  	return 0;
  }
-diff -urNp linux-2.6.38.2/drivers/atm/horizon.c linux-2.6.38.2/drivers/atm/horizon.c
---- linux-2.6.38.2/drivers/atm/horizon.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/horizon.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/horizon.c linux-2.6.38.7/drivers/atm/horizon.c
+--- linux-2.6.38.7/drivers/atm/horizon.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/horizon.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1034,7 +1034,7 @@ static void rx_schedule (hrz_dev * dev, 
  	{
  	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
@@ -22767,9 +25093,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/horizon.c linux-2.6.38.2/drivers/atm/horiz
  	
  	// free the skb
  	hrz_kfree_skb (skb);
-diff -urNp linux-2.6.38.2/drivers/atm/idt77252.c linux-2.6.38.2/drivers/atm/idt77252.c
---- linux-2.6.38.2/drivers/atm/idt77252.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/idt77252.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/idt77252.c linux-2.6.38.7/drivers/atm/idt77252.c
+--- linux-2.6.38.7/drivers/atm/idt77252.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/idt77252.c	2011-04-28 19:34:15.000000000 -0400
 @@ -811,7 +811,7 @@ drain_scq(struct idt77252_dev *card, str
  		else
  			dev_kfree_skb(skb);
@@ -22924,9 +25250,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/idt77252.c linux-2.6.38.2/drivers/atm/idt7
  		return -ENOMEM;
  	}
  	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
-diff -urNp linux-2.6.38.2/drivers/atm/iphase.c linux-2.6.38.2/drivers/atm/iphase.c
---- linux-2.6.38.2/drivers/atm/iphase.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/iphase.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/iphase.c linux-2.6.38.7/drivers/atm/iphase.c
+--- linux-2.6.38.7/drivers/atm/iphase.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/iphase.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1124,7 +1124,7 @@ static int rx_pkt(struct atm_dev *dev)  
  	status = (u_short) (buf_desc_ptr->desc_mode);  
  	if (status & (RX_CER | RX_PTE | RX_OFL))  
@@ -23023,9 +25349,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/iphase.c linux-2.6.38.2/drivers/atm/iphase
            if (iavcc->vc_desc_cnt > 10) {
               vcc->tx_quota =  vcc->tx_quota * 3 / 4;
              printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
-diff -urNp linux-2.6.38.2/drivers/atm/lanai.c linux-2.6.38.2/drivers/atm/lanai.c
---- linux-2.6.38.2/drivers/atm/lanai.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/lanai.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/lanai.c linux-2.6.38.7/drivers/atm/lanai.c
+--- linux-2.6.38.7/drivers/atm/lanai.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/lanai.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1303,7 +1303,7 @@ static void lanai_send_one_aal5(struct l
  	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
  	lanai_endtx(lanai, lvcc);
@@ -23080,9 +25406,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/lanai.c linux-2.6.38.2/drivers/atm/lanai.c
  	lvcc->stats.x.aal5.service_rxcrc++;
  	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
  	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
-diff -urNp linux-2.6.38.2/drivers/atm/nicstar.c linux-2.6.38.2/drivers/atm/nicstar.c
---- linux-2.6.38.2/drivers/atm/nicstar.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/nicstar.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/nicstar.c linux-2.6.38.7/drivers/atm/nicstar.c
+--- linux-2.6.38.7/drivers/atm/nicstar.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/nicstar.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1654,7 +1654,7 @@ static int ns_send(struct atm_vcc *vcc, 
  	if ((vc = (vc_map *) vcc->dev_data) == NULL) {
  		printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n",
@@ -23284,10 +25610,10 @@ diff -urNp linux-2.6.38.2/drivers/atm/nicstar.c linux-2.6.38.2/drivers/atm/nicst
  			}
  		}
  
-diff -urNp linux-2.6.38.2/drivers/atm/solos-pci.c linux-2.6.38.2/drivers/atm/solos-pci.c
---- linux-2.6.38.2/drivers/atm/solos-pci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/solos-pci.c	2011-03-21 18:31:35.000000000 -0400
-@@ -717,7 +717,7 @@ void solos_bh(unsigned long card_arg)
+diff -urNp linux-2.6.38.7/drivers/atm/solos-pci.c linux-2.6.38.7/drivers/atm/solos-pci.c
+--- linux-2.6.38.7/drivers/atm/solos-pci.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/solos-pci.c	2011-05-16 21:47:08.000000000 -0400
+@@ -715,7 +715,7 @@ void solos_bh(unsigned long card_arg)
  				}
  				atm_charge(vcc, skb->truesize);
  				vcc->push(vcc, skb);
@@ -23296,7 +25622,16 @@ diff -urNp linux-2.6.38.2/drivers/atm/solos-pci.c linux-2.6.38.2/drivers/atm/sol
  				break;
  
  			case PKT_STATUS:
-@@ -1026,7 +1026,7 @@ static uint32_t fpga_tx(struct solos_car
+@@ -900,6 +900,8 @@ static int print_buffer(struct sk_buff *
+ 	char msg[500];
+ 	char item[10];
+ 
++	pax_track_stack();
++
+ 	len = buf->len;
+ 	for (i = 0; i < len; i++){
+ 		if(i % 8 == 0)
+@@ -1009,7 +1011,7 @@ static uint32_t fpga_tx(struct solos_car
  			vcc = SKB_CB(oldskb)->vcc;
  
  			if (vcc) {
@@ -23305,9 +25640,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/solos-pci.c linux-2.6.38.2/drivers/atm/sol
  				solos_pop(vcc, oldskb);
  			} else
  				dev_kfree_skb_irq(oldskb);
-diff -urNp linux-2.6.38.2/drivers/atm/suni.c linux-2.6.38.2/drivers/atm/suni.c
---- linux-2.6.38.2/drivers/atm/suni.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/suni.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/suni.c linux-2.6.38.7/drivers/atm/suni.c
+--- linux-2.6.38.7/drivers/atm/suni.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/suni.c	2011-04-28 19:34:15.000000000 -0400
 @@ -50,8 +50,8 @@ static DEFINE_SPINLOCK(sunis_lock);
  
  
@@ -23319,9 +25654,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/suni.c linux-2.6.38.2/drivers/atm/suni.c
  
  
  static void suni_hz(unsigned long from_timer)
-diff -urNp linux-2.6.38.2/drivers/atm/uPD98402.c linux-2.6.38.2/drivers/atm/uPD98402.c
---- linux-2.6.38.2/drivers/atm/uPD98402.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/uPD98402.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/uPD98402.c linux-2.6.38.7/drivers/atm/uPD98402.c
+--- linux-2.6.38.7/drivers/atm/uPD98402.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/uPD98402.c	2011-04-28 19:34:15.000000000 -0400
 @@ -42,7 +42,7 @@ static int fetch_stats(struct atm_dev *d
  	struct sonet_stats tmp;
   	int error = 0;
@@ -23366,9 +25701,9 @@ diff -urNp linux-2.6.38.2/drivers/atm/uPD98402.c linux-2.6.38.2/drivers/atm/uPD9
  	return 0;
  }
  
-diff -urNp linux-2.6.38.2/drivers/atm/zatm.c linux-2.6.38.2/drivers/atm/zatm.c
---- linux-2.6.38.2/drivers/atm/zatm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/atm/zatm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/atm/zatm.c linux-2.6.38.7/drivers/atm/zatm.c
+--- linux-2.6.38.7/drivers/atm/zatm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/atm/zatm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -459,7 +459,7 @@ printk("dummy: 0x%08lx, 0x%08lx\n",dummy
  		}
  		if (!size) {
@@ -23396,9 +25731,57 @@ diff -urNp linux-2.6.38.2/drivers/atm/zatm.c linux-2.6.38.2/drivers/atm/zatm.c
  	wake_up(&zatm_vcc->tx_wait);
  }
  
-diff -urNp linux-2.6.38.2/drivers/block/cciss.c linux-2.6.38.2/drivers/block/cciss.c
---- linux-2.6.38.2/drivers/block/cciss.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/block/cciss.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/base/power/wakeup.c linux-2.6.38.7/drivers/base/power/wakeup.c
+--- linux-2.6.38.7/drivers/base/power/wakeup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/base/power/wakeup.c	2011-04-28 19:57:25.000000000 -0400
+@@ -25,7 +25,7 @@
+ bool events_check_enabled;
+ 
+ /* The counter of registered wakeup events. */
+-static atomic_t event_count = ATOMIC_INIT(0);
++static atomic_unchecked_t event_count = ATOMIC_INIT(0);
+ /* A preserved old value of event_count. */
+ static unsigned int saved_count;
+ /* The counter of wakeup events being processed. */
+@@ -399,7 +399,7 @@ static void wakeup_source_deactivate(str
+ 	 * pm_save_wakeup_count() don't see the old value of event_count and
+ 	 * events_in_progress equal to zero at the same time.
+ 	 */
+-	atomic_inc(&event_count);
++	atomic_inc_unchecked(&event_count);
+ 	smp_mb__before_atomic_dec();
+ 	atomic_dec(&events_in_progress);
+ }
+@@ -556,7 +556,7 @@ bool pm_wakeup_pending(void)
+ 
+ 	spin_lock_irqsave(&events_lock, flags);
+ 	if (events_check_enabled) {
+-		ret = ((unsigned int)atomic_read(&event_count) != saved_count)
++		ret = ((unsigned int)atomic_read_unchecked(&event_count) != saved_count)
+ 			|| atomic_read(&events_in_progress);
+ 		events_check_enabled = !ret;
+ 	}
+@@ -590,7 +590,7 @@ bool pm_get_wakeup_count(unsigned int *c
+ 	}
+ 
+ 	ret = !atomic_read(&events_in_progress);
+-	*count = atomic_read(&event_count);
++	*count = atomic_read_unchecked(&event_count);
+ 	return ret;
+ }
+ 
+@@ -608,7 +608,7 @@ bool pm_save_wakeup_count(unsigned int c
+ 	bool ret = false;
+ 
+ 	spin_lock_irq(&events_lock);
+-	if (count == (unsigned int)atomic_read(&event_count)
++	if (count == (unsigned int)atomic_read_unchecked(&event_count)
+ 	    && !atomic_read(&events_in_progress)) {
+ 		saved_count = count;
+ 		events_check_enabled = true;
+diff -urNp linux-2.6.38.7/drivers/block/cciss.c linux-2.6.38.7/drivers/block/cciss.c
+--- linux-2.6.38.7/drivers/block/cciss.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/cciss.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1112,6 +1112,8 @@ static int cciss_ioctl32_passthru(struct
  	int err;
  	u32 cp;
@@ -23408,9 +25791,261 @@ diff -urNp linux-2.6.38.2/drivers/block/cciss.c linux-2.6.38.2/drivers/block/cci
  	err = 0;
  	err |=
  	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
-diff -urNp linux-2.6.38.2/drivers/char/agp/frontend.c linux-2.6.38.2/drivers/char/agp/frontend.c
---- linux-2.6.38.2/drivers/char/agp/frontend.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/agp/frontend.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/block/cpqarray.c linux-2.6.38.7/drivers/block/cpqarray.c
+--- linux-2.6.38.7/drivers/block/cpqarray.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/cpqarray.c	2011-05-16 21:47:08.000000000 -0400
+@@ -911,6 +911,8 @@ static void do_ida_request(struct reques
+ 	struct scatterlist tmp_sg[SG_MAX];
+ 	int i, dir, seg;
+ 
++	pax_track_stack();
++
+ 	if (blk_queue_plugged(q))
+ 		goto startio;
+ 
+diff -urNp linux-2.6.38.7/drivers/block/DAC960.c linux-2.6.38.7/drivers/block/DAC960.c
+--- linux-2.6.38.7/drivers/block/DAC960.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/DAC960.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1979,6 +1979,8 @@ static bool DAC960_V1_ReadDeviceConfigur
+   unsigned long flags;
+   int Channel, TargetID;
+ 
++  pax_track_stack();
++
+   if (!init_dma_loaf(Controller->PCIDevice, &local_dma, 
+ 		DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
+ 			sizeof(DAC960_SCSI_Inquiry_T) +
+diff -urNp linux-2.6.38.7/drivers/block/drbd/drbd_int.h linux-2.6.38.7/drivers/block/drbd/drbd_int.h
+--- linux-2.6.38.7/drivers/block/drbd/drbd_int.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/drbd/drbd_int.h	2011-04-28 19:57:25.000000000 -0400
+@@ -742,7 +742,7 @@ struct drbd_request;
+ struct drbd_epoch {
+ 	struct list_head list;
+ 	unsigned int barrier_nr;
+-	atomic_t epoch_size; /* increased on every request added. */
++	atomic_unchecked_t epoch_size; /* increased on every request added. */
+ 	atomic_t active;     /* increased on every req. added, and dec on every finished. */
+ 	unsigned long flags;
+ };
+@@ -1083,7 +1083,7 @@ struct drbd_conf {
+ 	void *int_dig_in;
+ 	void *int_dig_vv;
+ 	wait_queue_head_t seq_wait;
+-	atomic_t packet_seq;
++	atomic_unchecked_t packet_seq;
+ 	unsigned int peer_seq;
+ 	spinlock_t peer_seq_lock;
+ 	unsigned int minor;
+diff -urNp linux-2.6.38.7/drivers/block/drbd/drbd_main.c linux-2.6.38.7/drivers/block/drbd/drbd_main.c
+--- linux-2.6.38.7/drivers/block/drbd/drbd_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/drbd/drbd_main.c	2011-04-28 19:57:25.000000000 -0400
+@@ -2217,7 +2217,7 @@ static int _drbd_send_ack(struct drbd_co
+ 	p.sector   = sector;
+ 	p.block_id = block_id;
+ 	p.blksize  = blksize;
+-	p.seq_num  = cpu_to_be32(atomic_add_return(1, &mdev->packet_seq));
++	p.seq_num  = cpu_to_be32(atomic_add_return_unchecked(1, &mdev->packet_seq));
+ 
+ 	if (!mdev->meta.socket || mdev->state.conn < C_CONNECTED)
+ 		return FALSE;
+@@ -2517,7 +2517,7 @@ int drbd_send_dblock(struct drbd_conf *m
+ 	p.sector   = cpu_to_be64(req->sector);
+ 	p.block_id = (unsigned long)req;
+ 	p.seq_num  = cpu_to_be32(req->seq_num =
+-				 atomic_add_return(1, &mdev->packet_seq));
++				 atomic_add_return_unchecked(1, &mdev->packet_seq));
+ 
+ 	dp_flags = bio_flags_to_wire(mdev, req->master_bio->bi_rw);
+ 
+@@ -2795,7 +2795,7 @@ void drbd_init_set_defaults(struct drbd_
+ 	atomic_set(&mdev->unacked_cnt, 0);
+ 	atomic_set(&mdev->local_cnt, 0);
+ 	atomic_set(&mdev->net_cnt, 0);
+-	atomic_set(&mdev->packet_seq, 0);
++	atomic_set_unchecked(&mdev->packet_seq, 0);
+ 	atomic_set(&mdev->pp_in_use, 0);
+ 	atomic_set(&mdev->pp_in_use_by_net, 0);
+ 	atomic_set(&mdev->rs_sect_in, 0);
+@@ -2866,8 +2866,8 @@ void drbd_mdev_cleanup(struct drbd_conf 
+ 				mdev->receiver.t_state);
+ 
+ 	/* no need to lock it, I'm the only thread alive */
+-	if (atomic_read(&mdev->current_epoch->epoch_size) !=  0)
+-		dev_err(DEV, "epoch_size:%d\n", atomic_read(&mdev->current_epoch->epoch_size));
++	if (atomic_read_unchecked(&mdev->current_epoch->epoch_size) !=  0)
++		dev_err(DEV, "epoch_size:%d\n", atomic_read_unchecked(&mdev->current_epoch->epoch_size));
+ 	mdev->al_writ_cnt  =
+ 	mdev->bm_writ_cnt  =
+ 	mdev->read_cnt     =
+diff -urNp linux-2.6.38.7/drivers/block/drbd/drbd_nl.c linux-2.6.38.7/drivers/block/drbd/drbd_nl.c
+--- linux-2.6.38.7/drivers/block/drbd/drbd_nl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/drbd/drbd_nl.c	2011-04-28 19:57:25.000000000 -0400
+@@ -2238,7 +2238,7 @@ static void drbd_connector_callback(stru
+ 	module_put(THIS_MODULE);
+ }
+ 
+-static atomic_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
++static atomic_unchecked_t drbd_nl_seq = ATOMIC_INIT(2); /* two. */
+ 
+ static unsigned short *
+ __tl_add_blob(unsigned short *tl, enum drbd_tags tag, const void *data,
+@@ -2309,7 +2309,7 @@ void drbd_bcast_state(struct drbd_conf *
+ 	cn_reply->id.idx = CN_IDX_DRBD;
+ 	cn_reply->id.val = CN_VAL_DRBD;
+ 
+-	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
++	cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
+ 	cn_reply->ack = 0; /* not used here. */
+ 	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+ 		(int)((char *)tl - (char *)reply->tag_list);
+@@ -2341,7 +2341,7 @@ void drbd_bcast_ev_helper(struct drbd_co
+ 	cn_reply->id.idx = CN_IDX_DRBD;
+ 	cn_reply->id.val = CN_VAL_DRBD;
+ 
+-	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
++	cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
+ 	cn_reply->ack = 0; /* not used here. */
+ 	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+ 		(int)((char *)tl - (char *)reply->tag_list);
+@@ -2416,7 +2416,7 @@ void drbd_bcast_ee(struct drbd_conf *mde
+ 	cn_reply->id.idx = CN_IDX_DRBD;
+ 	cn_reply->id.val = CN_VAL_DRBD;
+ 
+-	cn_reply->seq = atomic_add_return(1,&drbd_nl_seq);
++	cn_reply->seq = atomic_add_return_unchecked(1,&drbd_nl_seq);
+ 	cn_reply->ack = 0; // not used here.
+ 	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+ 		(int)((char*)tl - (char*)reply->tag_list);
+@@ -2455,7 +2455,7 @@ void drbd_bcast_sync_progress(struct drb
+ 	cn_reply->id.idx = CN_IDX_DRBD;
+ 	cn_reply->id.val = CN_VAL_DRBD;
+ 
+-	cn_reply->seq = atomic_add_return(1, &drbd_nl_seq);
++	cn_reply->seq = atomic_add_return_unchecked(1, &drbd_nl_seq);
+ 	cn_reply->ack = 0; /* not used here. */
+ 	cn_reply->len = sizeof(struct drbd_nl_cfg_reply) +
+ 		(int)((char *)tl - (char *)reply->tag_list);
+diff -urNp linux-2.6.38.7/drivers/block/drbd/drbd_receiver.c linux-2.6.38.7/drivers/block/drbd/drbd_receiver.c
+--- linux-2.6.38.7/drivers/block/drbd/drbd_receiver.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/drbd/drbd_receiver.c	2011-04-28 19:57:25.000000000 -0400
+@@ -907,7 +907,7 @@ retry:
+ 	sock->sk->sk_sndtimeo = mdev->net_conf->timeout*HZ/10;
+ 	sock->sk->sk_rcvtimeo = MAX_SCHEDULE_TIMEOUT;
+ 
+-	atomic_set(&mdev->packet_seq, 0);
++	atomic_set_unchecked(&mdev->packet_seq, 0);
+ 	mdev->peer_seq = 0;
+ 
+ 	drbd_thread_start(&mdev->asender);
+@@ -1001,7 +1001,7 @@ static enum finish_epoch drbd_may_finish
+ 	do {
+ 		next_epoch = NULL;
+ 
+-		epoch_size = atomic_read(&epoch->epoch_size);
++		epoch_size = atomic_read_unchecked(&epoch->epoch_size);
+ 
+ 		switch (ev & ~EV_CLEANUP) {
+ 		case EV_PUT:
+@@ -1036,7 +1036,7 @@ static enum finish_epoch drbd_may_finish
+ 					rv = FE_DESTROYED;
+ 			} else {
+ 				epoch->flags = 0;
+-				atomic_set(&epoch->epoch_size, 0);
++				atomic_set_unchecked(&epoch->epoch_size, 0);
+ 				/* atomic_set(&epoch->active, 0); is already zero */
+ 				if (rv == FE_STILL_LIVE)
+ 					rv = FE_RECYCLED;
+@@ -1197,14 +1197,14 @@ static int receive_Barrier(struct drbd_c
+ 		drbd_wait_ee_list_empty(mdev, &mdev->active_ee);
+ 		drbd_flush(mdev);
+ 
+-		if (atomic_read(&mdev->current_epoch->epoch_size)) {
++		if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
+ 			epoch = kmalloc(sizeof(struct drbd_epoch), GFP_NOIO);
+ 			if (epoch)
+ 				break;
+ 		}
+ 
+ 		epoch = mdev->current_epoch;
+-		wait_event(mdev->ee_wait, atomic_read(&epoch->epoch_size) == 0);
++		wait_event(mdev->ee_wait, atomic_read_unchecked(&epoch->epoch_size) == 0);
+ 
+ 		D_ASSERT(atomic_read(&epoch->active) == 0);
+ 		D_ASSERT(epoch->flags == 0);
+@@ -1216,11 +1216,11 @@ static int receive_Barrier(struct drbd_c
+ 	}
+ 
+ 	epoch->flags = 0;
+-	atomic_set(&epoch->epoch_size, 0);
++	atomic_set_unchecked(&epoch->epoch_size, 0);
+ 	atomic_set(&epoch->active, 0);
+ 
+ 	spin_lock(&mdev->epoch_lock);
+-	if (atomic_read(&mdev->current_epoch->epoch_size)) {
++	if (atomic_read_unchecked(&mdev->current_epoch->epoch_size)) {
+ 		list_add(&epoch->list, &mdev->current_epoch->list);
+ 		mdev->current_epoch = epoch;
+ 		mdev->epochs++;
+@@ -1663,7 +1663,7 @@ static int receive_Data(struct drbd_conf
+ 		spin_unlock(&mdev->peer_seq_lock);
+ 
+ 		drbd_send_ack_dp(mdev, P_NEG_ACK, p, data_size);
+-		atomic_inc(&mdev->current_epoch->epoch_size);
++		atomic_inc_unchecked(&mdev->current_epoch->epoch_size);
+ 		return drbd_drain_block(mdev, data_size);
+ 	}
+ 
+@@ -1683,7 +1683,7 @@ static int receive_Data(struct drbd_conf
+ 
+ 	spin_lock(&mdev->epoch_lock);
+ 	e->epoch = mdev->current_epoch;
+-	atomic_inc(&e->epoch->epoch_size);
++	atomic_inc_unchecked(&e->epoch->epoch_size);
+ 	atomic_inc(&e->epoch->active);
+ 	spin_unlock(&mdev->epoch_lock);
+ 
+@@ -1866,7 +1866,7 @@ static int receive_Data(struct drbd_conf
+ out_interrupted:
+ 	/* yes, the epoch_size now is imbalanced.
+ 	 * but we drop the connection anyways, so we don't have a chance to
+-	 * receive a barrier... atomic_inc(&mdev->epoch_size); */
++	 * receive a barrier... atomic_inc_unchecked(&mdev->epoch_size); */
+ 	put_ldev(mdev);
+ 	drbd_free_ee(mdev, e);
+ 	return FALSE;
+@@ -3821,7 +3821,7 @@ static void drbd_disconnect(struct drbd_
+ 	D_ASSERT(list_empty(&mdev->done_ee));
+ 
+ 	/* ok, no more ee's on the fly, it is safe to reset the epoch_size */
+-	atomic_set(&mdev->current_epoch->epoch_size, 0);
++	atomic_set_unchecked(&mdev->current_epoch->epoch_size, 0);
+ 	D_ASSERT(list_empty(&mdev->current_epoch->list));
+ }
+ 
+diff -urNp linux-2.6.38.7/drivers/block/nbd.c linux-2.6.38.7/drivers/block/nbd.c
+--- linux-2.6.38.7/drivers/block/nbd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/block/nbd.c	2011-05-16 21:47:08.000000000 -0400
+@@ -157,6 +157,8 @@ static int sock_xmit(struct nbd_device *
+ 	struct kvec iov;
+ 	sigset_t blocked, oldset;
+ 
++	pax_track_stack();
++
+ 	if (unlikely(!sock)) {
+ 		printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
+ 		       lo->disk->disk_name, (send ? "send" : "recv"));
+@@ -571,6 +573,8 @@ static void do_nbd_request(struct reques
+ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
+ 		       unsigned int cmd, unsigned long arg)
+ {
++	pax_track_stack();
++
+ 	switch (cmd) {
+ 	case NBD_DISCONNECT: {
+ 		struct request sreq;
+diff -urNp linux-2.6.38.7/drivers/char/agp/frontend.c linux-2.6.38.7/drivers/char/agp/frontend.c
+--- linux-2.6.38.7/drivers/char/agp/frontend.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/agp/frontend.c	2011-04-28 19:34:15.000000000 -0400
 @@ -817,7 +817,7 @@ static int agpioc_reserve_wrap(struct ag
  	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
  		return -EFAULT;
@@ -23420,21 +26055,64 @@ diff -urNp linux-2.6.38.2/drivers/char/agp/frontend.c linux-2.6.38.2/drivers/cha
  		return -EFAULT;
  
  	client = agp_find_client_by_pid(reserve.pid);
-diff -urNp linux-2.6.38.2/drivers/char/agp/intel-agp.c linux-2.6.38.2/drivers/char/agp/intel-agp.c
---- linux-2.6.38.2/drivers/char/agp/intel-agp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/agp/intel-agp.c	2011-03-21 18:31:35.000000000 -0400
-@@ -903,7 +903,7 @@ static struct pci_device_id agp_intel_pc
- 	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_HB),
- 	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_M_HB),
- 	ID(PCI_DEVICE_ID_INTEL_SANDYBRIDGE_S_HB),
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
+diff -urNp linux-2.6.38.7/drivers/char/briq_panel.c linux-2.6.38.7/drivers/char/briq_panel.c
+--- linux-2.6.38.7/drivers/char/briq_panel.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/briq_panel.c	2011-04-28 19:34:15.000000000 -0400
+@@ -9,6 +9,7 @@
+ #include <linux/types.h>
+ #include <linux/errno.h>
+ #include <linux/tty.h>
++#include <linux/mutex.h>
+ #include <linux/timer.h>
+ #include <linux/kernel.h>
+ #include <linux/wait.h>
+@@ -34,6 +35,7 @@ static int		vfd_is_open;
+ static unsigned char	vfd[40];
+ static int		vfd_cursor;
+ static unsigned char	ledpb, led;
++static DEFINE_MUTEX(vfd_mutex);
+ 
+ static void update_vfd(void)
+ {
+@@ -140,12 +142,15 @@ static ssize_t briq_panel_write(struct f
+ 	if (!vfd_is_open)
+ 		return -EBUSY;
+ 
++	mutex_lock(&vfd_mutex);
+ 	for (;;) {
+ 		char c;
+ 		if (!indx)
+ 			break;
+-		if (get_user(c, buf))
++		if (get_user(c, buf)) {
++			mutex_unlock(&vfd_mutex);
+ 			return -EFAULT;
++		}
+ 		if (esc) {
+ 			set_led(c);
+ 			esc = 0;
+@@ -175,6 +180,7 @@ static ssize_t briq_panel_write(struct f
+ 		buf++;
+ 	}
+ 	update_vfd();
++	mutex_unlock(&vfd_mutex);
  
- MODULE_DEVICE_TABLE(pci, agp_intel_pci_table);
-diff -urNp linux-2.6.38.2/drivers/char/hpet.c linux-2.6.38.2/drivers/char/hpet.c
---- linux-2.6.38.2/drivers/char/hpet.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/hpet.c	2011-03-21 18:31:35.000000000 -0400
+ 	return len;
+ }
+diff -urNp linux-2.6.38.7/drivers/char/genrtc.c linux-2.6.38.7/drivers/char/genrtc.c
+--- linux-2.6.38.7/drivers/char/genrtc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/genrtc.c	2011-04-28 19:34:15.000000000 -0400
+@@ -273,6 +273,7 @@ static int gen_rtc_ioctl(struct file *fi
+ 	switch (cmd) {
+ 
+ 	case RTC_PLL_GET:
++	    memset(&pll, 0, sizeof(pll));
+ 	    if (get_rtc_pll(&pll))
+ 	 	    return -EINVAL;
+ 	    else
+diff -urNp linux-2.6.38.7/drivers/char/hpet.c linux-2.6.38.7/drivers/char/hpet.c
+--- linux-2.6.38.7/drivers/char/hpet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/hpet.c	2011-04-28 19:34:15.000000000 -0400
 @@ -553,7 +553,7 @@ static inline unsigned long hpet_time_di
  }
  
@@ -23444,18 +26122,9 @@ diff -urNp linux-2.6.38.2/drivers/char/hpet.c linux-2.6.38.2/drivers/char/hpet.c
  		  struct hpet_info *info)
  {
  	struct hpet_timer __iomem *timer;
-@@ -1043,7 +1043,7 @@ static struct acpi_driver hpet_acpi_driv
- 		},
- };
- 
--static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops };
-+static struct miscdevice hpet_misc = { HPET_MINOR, "hpet", &hpet_fops, {NULL, NULL}, NULL, NULL };
- 
- static int __init hpet_init(void)
- {
-diff -urNp linux-2.6.38.2/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.38.2/drivers/char/ipmi/ipmi_msghandler.c
---- linux-2.6.38.2/drivers/char/ipmi/ipmi_msghandler.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/ipmi/ipmi_msghandler.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.38.7/drivers/char/ipmi/ipmi_msghandler.c
+--- linux-2.6.38.7/drivers/char/ipmi/ipmi_msghandler.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/ipmi/ipmi_msghandler.c	2011-05-16 21:47:08.000000000 -0400
 @@ -414,7 +414,7 @@ struct ipmi_smi {
  	struct proc_dir_entry *proc_dir;
  	char                  proc_dir_name[10];
@@ -23486,9 +26155,18 @@ diff -urNp linux-2.6.38.2/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.38.2/dri
  
  	intf->proc_dir = NULL;
  
-diff -urNp linux-2.6.38.2/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.38.2/drivers/char/ipmi/ipmi_si_intf.c
---- linux-2.6.38.2/drivers/char/ipmi/ipmi_si_intf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/ipmi/ipmi_si_intf.c	2011-03-21 18:31:35.000000000 -0400
+@@ -4196,6 +4196,8 @@ static void send_panic_events(char *str)
+ 	struct ipmi_smi_msg               smi_msg;
+ 	struct ipmi_recv_msg              recv_msg;
+ 
++	pax_track_stack();
++
+ 	si = (struct ipmi_system_interface_addr *) &addr;
+ 	si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
+ 	si->channel = IPMI_BMC_CHANNEL;
+diff -urNp linux-2.6.38.7/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.38.7/drivers/char/ipmi/ipmi_si_intf.c
+--- linux-2.6.38.7/drivers/char/ipmi/ipmi_si_intf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/ipmi/ipmi_si_intf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -285,7 +285,7 @@ struct smi_info {
  	unsigned char slave_addr;
  
@@ -23519,9 +26197,67 @@ diff -urNp linux-2.6.38.2/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.38.2/driver
  
  	new_smi->interrupt_disabled = 1;
  	atomic_set(&new_smi->stop_operation, 0);
-diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
---- linux-2.6.38.2/drivers/char/mem.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/mem.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/istallion.c linux-2.6.38.7/drivers/char/istallion.c
+--- linux-2.6.38.7/drivers/char/istallion.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/istallion.c	2011-05-16 21:47:08.000000000 -0400
+@@ -186,7 +186,6 @@ static struct ktermios		stli_deftermios 
+  *	re-used for each stats call.
+  */
+ static comstats_t	stli_comstats;
+-static combrd_t		stli_brdstats;
+ static struct asystats	stli_cdkstats;
+ 
+ /*****************************************************************************/
+@@ -4005,6 +4004,7 @@ static int stli_getbrdstats(combrd_t __u
+ {
+ 	struct stlibrd *brdp;
+ 	unsigned int i;
++	combrd_t stli_brdstats;
+ 
+ 	if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
+ 		return -EFAULT;
+@@ -4226,6 +4226,8 @@ static int stli_getportstruct(struct stl
+ 	struct stliport stli_dummyport;
+ 	struct stliport *portp;
+ 
++	pax_track_stack();
++
+ 	if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
+ 		return -EFAULT;
+ 	portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
+@@ -4248,6 +4250,8 @@ static int stli_getbrdstruct(struct stli
+ 	struct stlibrd stli_dummybrd;
+ 	struct stlibrd *brdp;
+ 
++	pax_track_stack();
++
+ 	if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
+ 		return -EFAULT;
+ 	if (stli_dummybrd.brdnr >= STL_MAXBRDS)
+diff -urNp linux-2.6.38.7/drivers/char/Kconfig linux-2.6.38.7/drivers/char/Kconfig
+--- linux-2.6.38.7/drivers/char/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/Kconfig	2011-04-28 19:34:15.000000000 -0400
+@@ -90,7 +90,8 @@ config VT_HW_CONSOLE_BINDING
+ 
+ config DEVKMEM
+ 	bool "/dev/kmem virtual device support"
+-	default y
++	default n
++	depends on !GRKERNSEC_KMEM
+ 	help
+ 	  Say Y here if you want to support the /dev/kmem device. The
+ 	  /dev/kmem device is rarely used, but can be used for certain
+@@ -1132,6 +1133,7 @@ config DEVPORT
+ 	bool
+ 	depends on !M68K
+ 	depends on ISA || PCI
++	depends on !GRKERNSEC_KMEM
+ 	default y
+ 
+ source "drivers/s390/char/Kconfig"
+diff -urNp linux-2.6.38.7/drivers/char/mem.c linux-2.6.38.7/drivers/char/mem.c
+--- linux-2.6.38.7/drivers/char/mem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/mem.c	2011-04-28 19:34:15.000000000 -0400
 @@ -18,6 +18,7 @@
  #include <linux/raw.h>
  #include <linux/tty.h>
@@ -23541,7 +26277,33 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  static inline unsigned long size_inside_page(unsigned long start,
  					     unsigned long size)
  {
-@@ -120,6 +125,7 @@ static ssize_t read_mem(struct file *fil
+@@ -68,9 +73,13 @@ static inline int range_is_allowed(unsig
+ 
+ 	while (cursor < to) {
+ 		if (!devmem_is_allowed(pfn)) {
++#ifdef CONFIG_GRKERNSEC_KMEM
++			gr_handle_mem_readwrite(from, to);
++#else
+ 			printk(KERN_INFO
+ 		"Program %s tried to access /dev/mem between %Lx->%Lx.\n",
+ 				current->comm, from, to);
++#endif
+ 			return 0;
+ 		}
+ 		cursor += PAGE_SIZE;
+@@ -78,6 +87,11 @@ static inline int range_is_allowed(unsig
+ 	}
+ 	return 1;
+ }
++#elif defined(CONFIG_GRKERNSEC_KMEM)
++static inline int range_is_allowed(unsigned long pfn, unsigned long size)
++{
++	return 0;
++}
+ #else
+ static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+ {
+@@ -120,6 +134,7 @@ static ssize_t read_mem(struct file *fil
  
  	while (count > 0) {
  		unsigned long remaining;
@@ -23549,7 +26311,7 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  
  		sz = size_inside_page(p, count);
  
-@@ -135,7 +141,23 @@ static ssize_t read_mem(struct file *fil
+@@ -135,7 +150,23 @@ static ssize_t read_mem(struct file *fil
  		if (!ptr)
  			return -EFAULT;
  
@@ -23574,31 +26336,7 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  		unxlate_dev_mem_ptr(p, ptr);
  		if (remaining)
  			return -EFAULT;
-@@ -161,6 +183,11 @@ static ssize_t write_mem(struct file *fi
- 	if (!valid_phys_addr_range(p, count))
- 		return -EFAULT;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_mem_write();
-+	return -EPERM;
-+#endif
-+
- 	written = 0;
- 
- #ifdef __ARCH_HAS_NO_PAGE_ZERO_MAPPED
-@@ -316,6 +343,11 @@ static int mmap_mem(struct file *file, s
- 						&vma->vm_page_prot))
- 		return -EINVAL;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	if (gr_handle_mem_mmap(vma->vm_pgoff << PAGE_SHIFT, vma))
-+		return -EPERM;
-+#endif
-+
- 	vma->vm_page_prot = phys_mem_access_prot(file, vma->vm_pgoff,
- 						 size,
- 						 vma->vm_page_prot);
-@@ -398,9 +430,8 @@ static ssize_t read_kmem(struct file *fi
+@@ -398,9 +429,8 @@ static ssize_t read_kmem(struct file *fi
  			 size_t count, loff_t *ppos)
  {
  	unsigned long p = *ppos;
@@ -23609,7 +26347,7 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  
  	read = 0;
  	if (p < (unsigned long) high_memory) {
-@@ -422,6 +453,8 @@ static ssize_t read_kmem(struct file *fi
+@@ -422,6 +452,8 @@ static ssize_t read_kmem(struct file *fi
  		}
  #endif
  		while (low_count > 0) {
@@ -23618,7 +26356,7 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  			sz = size_inside_page(p, low_count);
  
  			/*
-@@ -431,7 +464,22 @@ static ssize_t read_kmem(struct file *fi
+@@ -431,7 +463,22 @@ static ssize_t read_kmem(struct file *fi
  			 */
  			kbuf = xlate_dev_kmem_ptr((char *)p);
  
@@ -23642,44 +26380,7 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  				return -EFAULT;
  			buf += sz;
  			p += sz;
-@@ -530,6 +578,11 @@ static ssize_t write_kmem(struct file *f
- 	char * kbuf; /* k-addr because vwrite() takes vmlist_lock rwlock */
- 	int err = 0;
- 
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_kmem_write();
-+	return -EPERM;
-+#endif
-+
- 	if (p < (unsigned long) high_memory) {
- 		unsigned long to_write = min_t(unsigned long, count,
- 					       (unsigned long)high_memory - p);
-@@ -731,6 +784,16 @@ static loff_t memory_lseek(struct file *
- 
- static int open_port(struct inode * inode, struct file * filp)
- {
-+#ifdef CONFIG_GRKERNSEC_KMEM
-+	gr_handle_open_port();
-+	return -EPERM;
-+#endif
-+
-+	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
-+}
-+
-+static int open_mem(struct inode * inode, struct file * filp)
-+{
- 	return capable(CAP_SYS_RAWIO) ? 0 : -EPERM;
- }
- 
-@@ -738,7 +801,6 @@ static int open_port(struct inode * inod
- #define full_lseek      null_lseek
- #define write_zero	write_null
- #define read_full       read_zero
--#define open_mem	open_port
- #define open_kmem	open_mem
- #define open_oldmem	open_mem
- 
-@@ -857,6 +919,9 @@ static const struct memdev {
+@@ -857,6 +904,9 @@ static const struct memdev {
  #ifdef CONFIG_CRASH_DUMP
  	[12] = { "oldmem", 0, &oldmem_fops, NULL },
  #endif
@@ -23689,9 +26390,9 @@ diff -urNp linux-2.6.38.2/drivers/char/mem.c linux-2.6.38.2/drivers/char/mem.c
  };
  
  static int memory_open(struct inode *inode, struct file *filp)
-diff -urNp linux-2.6.38.2/drivers/char/nvram.c linux-2.6.38.2/drivers/char/nvram.c
---- linux-2.6.38.2/drivers/char/nvram.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/nvram.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/nvram.c linux-2.6.38.7/drivers/char/nvram.c
+--- linux-2.6.38.7/drivers/char/nvram.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/nvram.c	2011-04-28 19:34:15.000000000 -0400
 @@ -246,7 +246,7 @@ static ssize_t nvram_read(struct file *f
  
  	spin_unlock_irq(&rtc_lock);
@@ -23701,21 +26402,9 @@ diff -urNp linux-2.6.38.2/drivers/char/nvram.c linux-2.6.38.2/drivers/char/nvram
  		return -EFAULT;
  
  	*ppos = i;
-@@ -435,7 +435,10 @@ static const struct file_operations nvra
- static struct miscdevice nvram_dev = {
- 	NVRAM_MINOR,
- 	"nvram",
--	&nvram_fops
-+	&nvram_fops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static int __init nvram_init(void)
-diff -urNp linux-2.6.38.2/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.38.2/drivers/char/pcmcia/ipwireless/tty.c
---- linux-2.6.38.2/drivers/char/pcmcia/ipwireless/tty.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/pcmcia/ipwireless/tty.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.38.7/drivers/char/pcmcia/ipwireless/tty.c
+--- linux-2.6.38.7/drivers/char/pcmcia/ipwireless/tty.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/pcmcia/ipwireless/tty.c	2011-04-28 19:34:15.000000000 -0400
 @@ -29,6 +29,7 @@
  #include <linux/tty_driver.h>
  #include <linux/tty_flip.h>
@@ -23838,9 +26527,9 @@ diff -urNp linux-2.6.38.2/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.38.2/dr
  				do_ipw_close(ttyj);
  			ipwireless_disassociate_network_ttys(network,
  							     ttyj->channel_idx);
-diff -urNp linux-2.6.38.2/drivers/char/random.c linux-2.6.38.2/drivers/char/random.c
---- linux-2.6.38.2/drivers/char/random.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/random.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/random.c linux-2.6.38.7/drivers/char/random.c
+--- linux-2.6.38.7/drivers/char/random.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/random.c	2011-04-28 19:34:15.000000000 -0400
 @@ -254,8 +254,13 @@
  /*
   * Configuration information
@@ -23891,9 +26580,21 @@ diff -urNp linux-2.6.38.2/drivers/char/random.c linux-2.6.38.2/drivers/char/rand
  static int max_write_thresh = INPUT_POOL_WORDS * 32;
  static char sysctl_bootid[16];
  
-diff -urNp linux-2.6.38.2/drivers/char/sonypi.c linux-2.6.38.2/drivers/char/sonypi.c
---- linux-2.6.38.2/drivers/char/sonypi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/sonypi.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/rocket.c linux-2.6.38.7/drivers/char/rocket.c
+--- linux-2.6.38.7/drivers/char/rocket.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/rocket.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1277,6 +1277,8 @@ static int get_ports(struct r_port *info
+ 	struct rocket_ports tmp;
+ 	int board;
+ 
++	pax_track_stack();
++
+ 	if (!retports)
+ 		return -EFAULT;
+ 	memset(&tmp, 0, sizeof (tmp));
+diff -urNp linux-2.6.38.7/drivers/char/sonypi.c linux-2.6.38.7/drivers/char/sonypi.c
+--- linux-2.6.38.7/drivers/char/sonypi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/sonypi.c	2011-04-28 19:34:15.000000000 -0400
 @@ -55,6 +55,7 @@
  #include <asm/uaccess.h>
  #include <asm/io.h>
@@ -23932,9 +26633,21 @@ diff -urNp linux-2.6.38.2/drivers/char/sonypi.c linux-2.6.38.2/drivers/char/sony
  	mutex_unlock(&sonypi_device.lock);
  
  	return 0;
-diff -urNp linux-2.6.38.2/drivers/char/tpm/tpm_bios.c linux-2.6.38.2/drivers/char/tpm/tpm_bios.c
---- linux-2.6.38.2/drivers/char/tpm/tpm_bios.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/tpm/tpm_bios.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/stallion.c linux-2.6.38.7/drivers/char/stallion.c
+--- linux-2.6.38.7/drivers/char/stallion.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/stallion.c	2011-05-16 21:47:08.000000000 -0400
+@@ -2407,6 +2407,8 @@ static int stl_getportstruct(struct stlp
+ 	struct stlport	stl_dummyport;
+ 	struct stlport	*portp;
+ 
++	pax_track_stack();
++
+ 	if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
+ 		return -EFAULT;
+ 	portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
+diff -urNp linux-2.6.38.7/drivers/char/tpm/tpm_bios.c linux-2.6.38.7/drivers/char/tpm/tpm_bios.c
+--- linux-2.6.38.7/drivers/char/tpm/tpm_bios.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/char/tpm/tpm_bios.c	2011-04-28 19:34:15.000000000 -0400
 @@ -173,7 +173,7 @@ static void *tpm_bios_measurements_start
  	event = addr;
  
@@ -23975,9 +26688,9 @@ diff -urNp linux-2.6.38.2/drivers/char/tpm/tpm_bios.c linux-2.6.38.2/drivers/cha
  
  	memcpy(log->bios_event_log, virt, len);
  
-diff -urNp linux-2.6.38.2/drivers/char/tpm/tpm.c linux-2.6.38.2/drivers/char/tpm/tpm.c
---- linux-2.6.38.2/drivers/char/tpm/tpm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/char/tpm/tpm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/char/tpm/tpm.c linux-2.6.38.7/drivers/char/tpm/tpm.c
+--- linux-2.6.38.7/drivers/char/tpm/tpm.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/char/tpm/tpm.c	2011-05-16 21:47:08.000000000 -0400
 @@ -411,7 +411,7 @@ static ssize_t tpm_transmit(struct tpm_c
  		    chip->vendor.req_complete_val)
  			goto out_recv;
@@ -23987,9 +26700,18 @@ diff -urNp linux-2.6.38.2/drivers/char/tpm/tpm.c linux-2.6.38.2/drivers/char/tpm
  			dev_err(chip->dev, "Operation Canceled\n");
  			rc = -ECANCELED;
  			goto out;
-diff -urNp linux-2.6.38.2/drivers/cpuidle/sysfs.c linux-2.6.38.2/drivers/cpuidle/sysfs.c
---- linux-2.6.38.2/drivers/cpuidle/sysfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/cpuidle/sysfs.c	2011-03-21 18:31:35.000000000 -0400
+@@ -844,6 +844,8 @@ ssize_t tpm_show_pubek(struct device *de
+ 
+ 	struct tpm_chip *chip = dev_get_drvdata(dev);
+ 
++	pax_track_stack();
++
+ 	tpm_cmd.header.in = tpm_readpubek_header;
+ 	err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
+ 			"attempting to read the PUBEK");
+diff -urNp linux-2.6.38.7/drivers/cpuidle/sysfs.c linux-2.6.38.7/drivers/cpuidle/sysfs.c
+--- linux-2.6.38.7/drivers/cpuidle/sysfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/cpuidle/sysfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -300,7 +300,7 @@ static struct kobj_type ktype_state_cpui
  	.release = cpuidle_state_sysfs_release,
  };
@@ -23999,29 +26721,33 @@ diff -urNp linux-2.6.38.2/drivers/cpuidle/sysfs.c linux-2.6.38.2/drivers/cpuidle
  {
  	kobject_put(&device->kobjs[i]->kobj);
  	wait_for_completion(&device->kobjs[i]->kobj_unregister);
-diff -urNp linux-2.6.38.2/drivers/edac/edac_core.h linux-2.6.38.2/drivers/edac/edac_core.h
---- linux-2.6.38.2/drivers/edac/edac_core.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/edac/edac_core.h	2011-03-21 18:31:35.000000000 -0400
-@@ -88,11 +88,11 @@ extern int edac_debug_level;
- 
- #else				/* !CONFIG_EDAC_DEBUG */
- 
--#define debugf0( ... )
--#define debugf1( ... )
--#define debugf2( ... )
--#define debugf3( ... )
--#define debugf4( ... )
-+#define debugf0( ... ) do {} while (0)
-+#define debugf1( ... ) do {} while (0)
-+#define debugf2( ... ) do {} while (0)
-+#define debugf3( ... ) do {} while (0)
-+#define debugf4( ... ) do {} while (0)
- 
- #endif				/* !CONFIG_EDAC_DEBUG */
- 
-diff -urNp linux-2.6.38.2/drivers/edac/edac_mc_sysfs.c linux-2.6.38.2/drivers/edac/edac_mc_sysfs.c
---- linux-2.6.38.2/drivers/edac/edac_mc_sysfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/edac/edac_mc_sysfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/crypto/hifn_795x.c linux-2.6.38.7/drivers/crypto/hifn_795x.c
+--- linux-2.6.38.7/drivers/crypto/hifn_795x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/crypto/hifn_795x.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1655,6 +1655,8 @@ static int hifn_test(struct hifn_device 
+ 		0xCA, 0x34, 0x2B, 0x2E};
+ 	struct scatterlist sg;
+ 
++	pax_track_stack();
++
+ 	memset(src, 0, sizeof(src));
+ 	memset(ctx.key, 0, sizeof(ctx.key));
+ 
+diff -urNp linux-2.6.38.7/drivers/crypto/padlock-aes.c linux-2.6.38.7/drivers/crypto/padlock-aes.c
+--- linux-2.6.38.7/drivers/crypto/padlock-aes.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/crypto/padlock-aes.c	2011-05-16 21:47:08.000000000 -0400
+@@ -109,6 +109,8 @@ static int aes_set_key(struct crypto_tfm
+ 	struct crypto_aes_ctx gen_aes;
+ 	int cpu;
+ 
++	pax_track_stack();
++
+ 	if (key_len % 8) {
+ 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
+ 		return -EINVAL;
+diff -urNp linux-2.6.38.7/drivers/edac/edac_mc_sysfs.c linux-2.6.38.7/drivers/edac/edac_mc_sysfs.c
+--- linux-2.6.38.7/drivers/edac/edac_mc_sysfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/edac/edac_mc_sysfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -761,7 +761,7 @@ static void edac_inst_grp_release(struct
  }
  
@@ -24031,9 +26757,95 @@ diff -urNp linux-2.6.38.2/drivers/edac/edac_mc_sysfs.c linux-2.6.38.2/drivers/ed
  	.show = inst_grp_show,
  	.store = inst_grp_store
  };
-diff -urNp linux-2.6.38.2/drivers/firewire/core-cdev.c linux-2.6.38.2/drivers/firewire/core-cdev.c
---- linux-2.6.38.2/drivers/firewire/core-cdev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/firewire/core-cdev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/edac/edac_pci_sysfs.c linux-2.6.38.7/drivers/edac/edac_pci_sysfs.c
+--- linux-2.6.38.7/drivers/edac/edac_pci_sysfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/edac/edac_pci_sysfs.c	2011-04-28 19:57:25.000000000 -0400
+@@ -26,8 +26,8 @@ static int edac_pci_log_pe = 1;		/* log 
+ static int edac_pci_log_npe = 1;	/* log PCI non-parity error errors */
+ static int edac_pci_poll_msec = 1000;	/* one second workq period */
+ 
+-static atomic_t pci_parity_count = ATOMIC_INIT(0);
+-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
++static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
++static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
+ 
+ static struct kobject *edac_pci_top_main_kobj;
+ static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
+@@ -582,7 +582,7 @@ static void edac_pci_dev_parity_test(str
+ 			edac_printk(KERN_CRIT, EDAC_PCI,
+ 				"Signaled System Error on %s\n",
+ 				pci_name(dev));
+-			atomic_inc(&pci_nonparity_count);
++			atomic_inc_unchecked(&pci_nonparity_count);
+ 		}
+ 
+ 		if (status & (PCI_STATUS_PARITY)) {
+@@ -590,7 +590,7 @@ static void edac_pci_dev_parity_test(str
+ 				"Master Data Parity Error on %s\n",
+ 				pci_name(dev));
+ 
+-			atomic_inc(&pci_parity_count);
++			atomic_inc_unchecked(&pci_parity_count);
+ 		}
+ 
+ 		if (status & (PCI_STATUS_DETECTED_PARITY)) {
+@@ -598,7 +598,7 @@ static void edac_pci_dev_parity_test(str
+ 				"Detected Parity Error on %s\n",
+ 				pci_name(dev));
+ 
+-			atomic_inc(&pci_parity_count);
++			atomic_inc_unchecked(&pci_parity_count);
+ 		}
+ 	}
+ 
+@@ -619,7 +619,7 @@ static void edac_pci_dev_parity_test(str
+ 				edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
+ 					"Signaled System Error on %s\n",
+ 					pci_name(dev));
+-				atomic_inc(&pci_nonparity_count);
++				atomic_inc_unchecked(&pci_nonparity_count);
+ 			}
+ 
+ 			if (status & (PCI_STATUS_PARITY)) {
+@@ -627,7 +627,7 @@ static void edac_pci_dev_parity_test(str
+ 					"Master Data Parity Error on "
+ 					"%s\n", pci_name(dev));
+ 
+-				atomic_inc(&pci_parity_count);
++				atomic_inc_unchecked(&pci_parity_count);
+ 			}
+ 
+ 			if (status & (PCI_STATUS_DETECTED_PARITY)) {
+@@ -635,7 +635,7 @@ static void edac_pci_dev_parity_test(str
+ 					"Detected Parity Error on %s\n",
+ 					pci_name(dev));
+ 
+-				atomic_inc(&pci_parity_count);
++				atomic_inc_unchecked(&pci_parity_count);
+ 			}
+ 		}
+ 	}
+@@ -677,7 +677,7 @@ void edac_pci_do_parity_check(void)
+ 	if (!check_pci_errors)
+ 		return;
+ 
+-	before_count = atomic_read(&pci_parity_count);
++	before_count = atomic_read_unchecked(&pci_parity_count);
+ 
+ 	/* scan all PCI devices looking for a Parity Error on devices and
+ 	 * bridges.
+@@ -689,7 +689,7 @@ void edac_pci_do_parity_check(void)
+ 	/* Only if operator has selected panic on PCI Error */
+ 	if (edac_pci_get_panic_on_pe()) {
+ 		/* If the count is different 'after' from 'before' */
+-		if (before_count != atomic_read(&pci_parity_count))
++		if (before_count != atomic_read_unchecked(&pci_parity_count))
+ 			panic("EDAC: PCI Parity Error");
+ 	}
+ }
+diff -urNp linux-2.6.38.7/drivers/firewire/core-cdev.c linux-2.6.38.7/drivers/firewire/core-cdev.c
+--- linux-2.6.38.7/drivers/firewire/core-cdev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/firewire/core-cdev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1329,8 +1329,7 @@ static int init_iso_resource(struct clie
  	int ret;
  
@@ -24044,9 +26856,29 @@ diff -urNp linux-2.6.38.2/drivers/firewire/core-cdev.c linux-2.6.38.2/drivers/fi
  		return -EINVAL;
  
  	r  = kmalloc(sizeof(*r), GFP_KERNEL);
-diff -urNp linux-2.6.38.2/drivers/firmware/dmi_scan.c linux-2.6.38.2/drivers/firmware/dmi_scan.c
---- linux-2.6.38.2/drivers/firmware/dmi_scan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/firmware/dmi_scan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/firewire/core-transaction.c linux-2.6.38.7/drivers/firewire/core-transaction.c
+--- linux-2.6.38.7/drivers/firewire/core-transaction.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/firewire/core-transaction.c	2011-05-16 21:47:08.000000000 -0400
+@@ -36,6 +36,7 @@
+ #include <linux/string.h>
+ #include <linux/timer.h>
+ #include <linux/types.h>
++#include <linux/sched.h>
+ 
+ #include <asm/byteorder.h>
+ 
+@@ -420,6 +421,8 @@ int fw_run_transaction(struct fw_card *c
+ 	struct transaction_callback_data d;
+ 	struct fw_transaction t;
+ 
++	pax_track_stack();
++
+ 	init_timer_on_stack(&t.split_timeout_timer);
+ 	init_completion(&d.done);
+ 	d.payload = payload;
+diff -urNp linux-2.6.38.7/drivers/firmware/dmi_scan.c linux-2.6.38.7/drivers/firmware/dmi_scan.c
+--- linux-2.6.38.7/drivers/firmware/dmi_scan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/firmware/dmi_scan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -449,11 +449,6 @@ void __init dmi_scan_machine(void)
  		}
  	}
@@ -24059,9 +26891,21 @@ diff -urNp linux-2.6.38.2/drivers/firmware/dmi_scan.c linux-2.6.38.2/drivers/fir
  		p = dmi_ioremap(0xF0000, 0x10000);
  		if (p == NULL)
  			goto error;
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.38.2/drivers/gpu/drm/drm_crtc_helper.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_crtc_helper.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_crtc_helper.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpio/vr41xx_giu.c linux-2.6.38.7/drivers/gpio/vr41xx_giu.c
+--- linux-2.6.38.7/drivers/gpio/vr41xx_giu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpio/vr41xx_giu.c	2011-04-28 19:57:25.000000000 -0400
+@@ -204,7 +204,7 @@ static int giu_get_irq(unsigned int irq)
+ 	printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
+ 	       maskl, pendl, maskh, pendh);
+ 
+-	atomic_inc(&irq_err_count);
++	atomic_inc_unchecked(&irq_err_count);
+ 
+ 	return -EINVAL;
+ }
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.38.7/drivers/gpu/drm/drm_crtc_helper.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_crtc_helper.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_crtc_helper.c	2011-05-16 21:47:08.000000000 -0400
 @@ -276,7 +276,7 @@ static bool drm_encoder_crtc_ok(struct d
  	struct drm_crtc *tmp;
  	int crtc_mask = 1;
@@ -24071,9 +26915,18 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.38.2/drive
  
  	dev = crtc->dev;
  
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_drv.c linux-2.6.38.2/drivers/gpu/drm/drm_drv.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_drv.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_drv.c	2011-03-21 18:31:35.000000000 -0400
+@@ -343,6 +343,8 @@ bool drm_crtc_helper_set_mode(struct drm
+ 	struct drm_encoder *encoder;
+ 	bool ret = true;
+ 
++	pax_track_stack();
++
+ 	crtc->enabled = drm_helper_crtc_in_use(crtc);
+ 	if (!crtc->enabled)
+ 		return true;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_drv.c linux-2.6.38.7/drivers/gpu/drm/drm_drv.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_drv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_drv.c	2011-04-28 19:34:15.000000000 -0400
 @@ -425,7 +425,7 @@ long drm_ioctl(struct file *filp,
  
  	dev = file_priv->minor->dev;
@@ -24083,9 +26936,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_drv.c linux-2.6.38.2/drivers/gpu/d
  	++file_priv->ioctl_count;
  
  	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_fops.c linux-2.6.38.2/drivers/gpu/drm/drm_fops.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_fops.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_fops.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_fops.c linux-2.6.38.7/drivers/gpu/drm/drm_fops.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_fops.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_fops.c	2011-04-28 19:34:15.000000000 -0400
 @@ -70,7 +70,7 @@ static int drm_setup(struct drm_device *
  	}
  
@@ -24135,9 +26988,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_fops.c linux-2.6.38.2/drivers/gpu/
  		if (atomic_read(&dev->ioctl_count)) {
  			DRM_ERROR("Device busy: %d\n",
  				  atomic_read(&dev->ioctl_count));
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_global.c linux-2.6.38.2/drivers/gpu/drm/drm_global.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_global.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_global.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_global.c linux-2.6.38.7/drivers/gpu/drm/drm_global.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_global.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_global.c	2011-04-28 19:34:15.000000000 -0400
 @@ -36,7 +36,7 @@
  struct drm_global_item {
  	struct mutex mutex;
@@ -24195,9 +27048,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_global.c linux-2.6.38.2/drivers/gp
  		ref->release(ref);
  		item->object = NULL;
  	}
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_info.c linux-2.6.38.2/drivers/gpu/drm/drm_info.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_info.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_info.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_info.c linux-2.6.38.7/drivers/gpu/drm/drm_info.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_info.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_info.c	2011-04-28 19:34:15.000000000 -0400
 @@ -86,10 +86,14 @@ int drm_vm_info(struct seq_file *m, void
  	struct drm_local_map *map;
  	struct drm_map_list *r_list;
@@ -24238,9 +27091,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_info.c linux-2.6.38.2/drivers/gpu/
  
  #if defined(__i386__)
  		pgprot = pgprot_val(vma->vm_page_prot);
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_ioctl.c linux-2.6.38.2/drivers/gpu/drm/drm_ioctl.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_ioctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_ioctl.c linux-2.6.38.7/drivers/gpu/drm/drm_ioctl.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_ioctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -353,7 +353,7 @@ int drm_getstats(struct drm_device *dev,
  			stats->data[i].value =
  			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
@@ -24250,9 +27103,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_ioctl.c linux-2.6.38.2/drivers/gpu
  		stats->data[i].type = dev->types[i];
  	}
  
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_lock.c linux-2.6.38.2/drivers/gpu/drm/drm_lock.c
---- linux-2.6.38.2/drivers/gpu/drm/drm_lock.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/drm_lock.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/drm_lock.c linux-2.6.38.7/drivers/gpu/drm/drm_lock.c
+--- linux-2.6.38.7/drivers/gpu/drm/drm_lock.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/drm_lock.c	2011-04-28 19:34:15.000000000 -0400
 @@ -89,7 +89,7 @@ int drm_lock(struct drm_device *dev, voi
  		if (drm_lock_take(&master->lock, lock->context)) {
  			master->lock.file_priv = file_priv;
@@ -24271,9 +27124,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/drm_lock.c linux-2.6.38.2/drivers/gpu/
  
  	if (drm_lock_free(&master->lock, lock->context)) {
  		/* FIXME: Should really bail out here. */
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i810/i810_dma.c linux-2.6.38.2/drivers/gpu/drm/i810/i810_dma.c
---- linux-2.6.38.2/drivers/gpu/drm/i810/i810_dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i810/i810_dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i810/i810_dma.c linux-2.6.38.7/drivers/gpu/drm/i810/i810_dma.c
+--- linux-2.6.38.7/drivers/gpu/drm/i810/i810_dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i810/i810_dma.c	2011-04-28 19:34:15.000000000 -0400
 @@ -953,8 +953,8 @@ static int i810_dma_vertex(struct drm_de
  				 dma->buflist[vertex->idx],
  				 vertex->discard, vertex->used);
@@ -24296,9 +27149,95 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i810/i810_dma.c linux-2.6.38.2/drivers
  	sarea_priv->last_enqueue = dev_priv->counter - 1;
  	sarea_priv->last_dispatch = (int)hw_status[5];
  
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7017.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7017.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7017.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i810/i810_drv.h linux-2.6.38.7/drivers/gpu/drm/i810/i810_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/i810/i810_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i810/i810_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -108,8 +108,8 @@ typedef struct drm_i810_private {
+ 	int page_flipping;
+ 
+ 	wait_queue_head_t irq_queue;
+-	atomic_t irq_received;
+-	atomic_t irq_emitted;
++	atomic_unchecked_t irq_received;
++	atomic_unchecked_t irq_emitted;
+ 
+ 	int front_offset;
+ } drm_i810_private_t;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i830/i830_drv.h linux-2.6.38.7/drivers/gpu/drm/i830/i830_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/i830/i830_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i830/i830_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -115,8 +115,8 @@ typedef struct drm_i830_private {
+ 	int page_flipping;
+ 
+ 	wait_queue_head_t irq_queue;
+-	atomic_t irq_received;
+-	atomic_t irq_emitted;
++	atomic_unchecked_t irq_received;
++	atomic_unchecked_t irq_emitted;
+ 
+ 	int use_mi_batchbuffer_start;
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i830/i830_irq.c linux-2.6.38.7/drivers/gpu/drm/i830/i830_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/i830/i830_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i830/i830_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -47,7 +47,7 @@ irqreturn_t i830_driver_irq_handler(DRM_
+ 
+ 	I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
+ 
+-	atomic_inc(&dev_priv->irq_received);
++	atomic_inc_unchecked(&dev_priv->irq_received);
+ 	wake_up_interruptible(&dev_priv->irq_queue);
+ 
+ 	return IRQ_HANDLED;
+@@ -60,14 +60,14 @@ static int i830_emit_irq(struct drm_devi
+ 
+ 	DRM_DEBUG("%s\n", __func__);
+ 
+-	atomic_inc(&dev_priv->irq_emitted);
++	atomic_inc_unchecked(&dev_priv->irq_emitted);
+ 
+ 	BEGIN_LP_RING(2);
+ 	OUT_RING(0);
+ 	OUT_RING(GFX_OP_USER_INTERRUPT);
+ 	ADVANCE_LP_RING();
+ 
+-	return atomic_read(&dev_priv->irq_emitted);
++	return atomic_read_unchecked(&dev_priv->irq_emitted);
+ }
+ 
+ static int i830_wait_irq(struct drm_device *dev, int irq_nr)
+@@ -79,7 +79,7 @@ static int i830_wait_irq(struct drm_devi
+ 
+ 	DRM_DEBUG("%s\n", __func__);
+ 
+-	if (atomic_read(&dev_priv->irq_received) >= irq_nr)
++	if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
+ 		return 0;
+ 
+ 	dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
+@@ -88,7 +88,7 @@ static int i830_wait_irq(struct drm_devi
+ 
+ 	for (;;) {
+ 		__set_current_state(TASK_INTERRUPTIBLE);
+-		if (atomic_read(&dev_priv->irq_received) >= irq_nr)
++		if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
+ 			break;
+ 		if ((signed)(end - jiffies) <= 0) {
+ 			DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
+@@ -163,8 +163,8 @@ void i830_driver_irq_preinstall(struct d
+ 	I830_WRITE16(I830REG_HWSTAM, 0xffff);
+ 	I830_WRITE16(I830REG_INT_MASK_R, 0x0);
+ 	I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
+-	atomic_set(&dev_priv->irq_received, 0);
+-	atomic_set(&dev_priv->irq_emitted, 0);
++	atomic_set_unchecked(&dev_priv->irq_received, 0);
++	atomic_set_unchecked(&dev_priv->irq_emitted, 0);
+ 	init_waitqueue_head(&dev_priv->irq_queue);
+ }
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7017.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7017.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7017.c	2011-04-28 19:34:15.000000000 -0400
 @@ -390,7 +390,7 @@ static void ch7017_destroy(struct intel_
  	}
  }
@@ -24308,9 +27247,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.38.2/drive
  	.init = ch7017_init,
  	.detect = ch7017_detect,
  	.mode_valid = ch7017_mode_valid,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7xxx.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7xxx.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-04-28 19:34:15.000000000 -0400
 @@ -320,7 +320,7 @@ static void ch7xxx_destroy(struct intel_
  	}
  }
@@ -24320,9 +27259,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.38.2/drive
  	.init = ch7xxx_init,
  	.detect = ch7xxx_detect,
  	.mode_valid = ch7xxx_mode_valid,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo.h linux-2.6.38.2/drivers/gpu/drm/i915/dvo.h
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo.h linux-2.6.38.7/drivers/gpu/drm/i915/dvo.h
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo.h	2011-04-28 19:34:15.000000000 -0400
 @@ -122,23 +122,23 @@ struct intel_dvo_dev_ops {
  	 *
  	 * \return singly-linked list of modes or NULL if no modes found.
@@ -24355,9 +27294,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo.h linux-2.6.38.2/drivers/gpu/
 +extern const struct intel_dvo_dev_ops ch7017_ops;
  
  #endif /* _INTEL_DVO_H */
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ivch.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ivch.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ivch.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ivch.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ivch.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo_ivch.c	2011-04-28 19:34:15.000000000 -0400
 @@ -410,7 +410,7 @@ static void ivch_destroy(struct intel_dv
  	}
  }
@@ -24367,9 +27306,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.38.2/drivers
  	.init = ivch_init,
  	.dpms = ivch_dpms,
  	.mode_valid = ivch_mode_valid,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.38.2/drivers/gpu/drm/i915/dvo_sil164.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo_sil164.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo_sil164.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.38.7/drivers/gpu/drm/i915/dvo_sil164.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo_sil164.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo_sil164.c	2011-04-28 19:34:15.000000000 -0400
 @@ -252,7 +252,7 @@ static void sil164_destroy(struct intel_
  	}
  }
@@ -24379,9 +27318,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.38.2/drive
  	.init = sil164_init,
  	.detect = sil164_detect,
  	.mode_valid = sil164_mode_valid,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.38.2/drivers/gpu/drm/i915/dvo_tfp410.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/dvo_tfp410.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/dvo_tfp410.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.38.7/drivers/gpu/drm/i915/dvo_tfp410.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/dvo_tfp410.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/dvo_tfp410.c	2011-04-28 19:34:15.000000000 -0400
 @@ -293,7 +293,7 @@ static void tfp410_destroy(struct intel_
  	}
  }
@@ -24391,9 +27330,21 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.38.2/drive
  	.init = tfp410_init,
  	.detect = tfp410_detect,
  	.mode_valid = tfp410_mode_valid,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/i915_dma.c linux-2.6.38.2/drivers/gpu/drm/i915/i915_dma.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/i915_dma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/i915_dma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.38.7/drivers/gpu/drm/i915/i915_debugfs.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_debugfs.c	2011-04-28 19:57:25.000000000 -0400
+@@ -496,7 +496,7 @@ static int i915_interrupt_info(struct se
+ 			   I915_READ(GTIMR));
+ 	}
+ 	seq_printf(m, "Interrupts received: %d\n",
+-		   atomic_read(&dev_priv->irq_received));
++		   atomic_read_unchecked(&dev_priv->irq_received));
+ 	for (i = 0; i < I915_NUM_RINGS; i++) {
+ 		if (IS_GEN6(dev)) {
+ 			seq_printf(m, "Graphics Interrupt mask (%s):	%08x\n",
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_dma.c linux-2.6.38.7/drivers/gpu/drm/i915/i915_dma.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_dma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_dma.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1159,7 +1159,7 @@ static bool i915_switcheroo_can_switch(s
  	bool can_switch;
  
@@ -24403,9 +27354,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/i915_dma.c linux-2.6.38.2/drivers
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/i915_drv.c linux-2.6.38.2/drivers/gpu/drm/i915/i915_drv.c
---- linux-2.6.38.2/drivers/gpu/drm/i915/i915_drv.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/i915/i915_drv.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.c linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.c	2011-04-28 19:34:15.000000000 -0400
 @@ -673,7 +673,7 @@ static const struct dev_pm_ops i915_pm_o
       .restore = i915_pm_resume,
  };
@@ -24415,9 +27366,219 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/i915/i915_drv.c linux-2.6.38.2/drivers
  	.fault = i915_gem_fault,
  	.open = drm_gem_vm_open,
  	.close = drm_gem_vm_close,
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.38.2/drivers/gpu/drm/nouveau/nouveau_state.c
---- linux-2.6.38.2/drivers/gpu/drm/nouveau/nouveau_state.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/nouveau/nouveau_state.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.h linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -288,7 +288,7 @@ typedef struct drm_i915_private {
+ 	int current_page;
+ 	int page_flipping;
+ 
+-	atomic_t irq_received;
++	atomic_unchecked_t irq_received;
+ 	u32 trace_irq_seqno;
+ 
+ 	/* protects the irq masks */
+@@ -843,7 +843,7 @@ struct drm_i915_gem_object {
+ 	 * will be page flipped away on the next vblank.  When it
+ 	 * reaches 0, dev_priv->pending_flip_queue will be woken up.
+ 	 */
+-	atomic_t pending_flip;
++	atomic_unchecked_t pending_flip;
+ };
+ 
+ #define to_intel_bo(x) container_of(x, struct drm_i915_gem_object, base)
+@@ -1229,7 +1229,7 @@ extern int intel_setup_gmbus(struct drm_
+ extern void intel_teardown_gmbus(struct drm_device *dev);
+ extern void intel_gmbus_set_speed(struct i2c_adapter *adapter, int speed);
+ extern void intel_gmbus_force_bit(struct i2c_adapter *adapter, bool force_bit);
+-extern inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
++static inline bool intel_gmbus_is_forced_bit(struct i2c_adapter *adapter)
+ {
+ 	return container_of(adapter, struct intel_gmbus, adapter)->force_bit;
+ }
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_gem_execbuffer.c linux-2.6.38.7/drivers/gpu/drm/i915/i915_gem_execbuffer.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_gem_execbuffer.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_gem_execbuffer.c	2011-04-28 19:57:25.000000000 -0400
+@@ -904,7 +904,7 @@ i915_gem_execbuffer_wait_for_flips(struc
+ 	flips = 0;
+ 	list_for_each_entry(obj, objects, exec_list) {
+ 		if (obj->base.write_domain)
+-			flips |= atomic_read(&obj->pending_flip);
++			flips |= atomic_read_unchecked(&obj->pending_flip);
+ 	}
+ 	if (flips) {
+ 		int plane, flip_mask, ret;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/i915_irq.c linux-2.6.38.7/drivers/gpu/drm/i915/i915_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/i915_irq.c	2011-04-18 17:27:13.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/i915_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1106,7 +1106,7 @@ irqreturn_t i915_driver_irq_handler(DRM_
+ 	int irq_received;
+ 	int ret = IRQ_NONE;
+ 
+-	atomic_inc(&dev_priv->irq_received);
++	atomic_inc_unchecked(&dev_priv->irq_received);
+ 
+ 	if (HAS_PCH_SPLIT(dev))
+ 		return ironlake_irq_handler(dev);
+@@ -1684,7 +1684,7 @@ void i915_driver_irq_preinstall(struct d
+ {
+ 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+ 
+-	atomic_set(&dev_priv->irq_received, 0);
++	atomic_set_unchecked(&dev_priv->irq_received, 0);
+ 
+ 	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
+ 	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/i915/intel_display.c linux-2.6.38.7/drivers/gpu/drm/i915/intel_display.c
+--- linux-2.6.38.7/drivers/gpu/drm/i915/intel_display.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/i915/intel_display.c	2011-05-22 23:06:03.000000000 -0400
+@@ -1631,7 +1631,7 @@ intel_pipe_set_base(struct drm_crtc *crt
+ 
+ 		wait_event(dev_priv->pending_flip_queue,
+ 			   atomic_read(&dev_priv->mm.wedged) ||
+-			   atomic_read(&obj->pending_flip) == 0);
++			   atomic_read_unchecked(&obj->pending_flip) == 0);
+ 
+ 		/* Big Hammer, we also need to ensure that any pending
+ 		 * MI_WAIT_FOR_EVENT inside a user batch buffer on the
+@@ -2042,7 +2042,7 @@ static void intel_crtc_wait_for_pending_
+ 	obj = to_intel_framebuffer(crtc->fb)->obj;
+ 	dev_priv = crtc->dev->dev_private;
+ 	wait_event(dev_priv->pending_flip_queue,
+-		   atomic_read(&obj->pending_flip) == 0);
++		   atomic_read_unchecked(&obj->pending_flip) == 0);
+ }
+ 
+ static bool intel_crtc_driving_pch(struct drm_crtc *crtc)
+@@ -5428,7 +5428,7 @@ static void do_intel_finish_page_flip(st
+ 
+ 	atomic_clear_mask(1 << intel_crtc->plane,
+ 			  &obj->pending_flip.counter);
+-	if (atomic_read(&obj->pending_flip) == 0)
++	if (atomic_read_unchecked(&obj->pending_flip) == 0)
+ 		wake_up(&dev_priv->pending_flip_queue);
+ 
+ 	schedule_work(&work->work);
+@@ -5557,7 +5557,7 @@ static int intel_crtc_page_flip(struct d
+ 	/* Block clients from rendering to the new back buffer until
+ 	 * the flip occurs and the object is no longer visible.
+ 	 */
+-	atomic_add(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
++	atomic_add_unchecked(1 << intel_crtc->plane, &work->old_fb_obj->pending_flip);
+ 
+ 	switch (INTEL_INFO(dev)->gen) {
+ 	case 2:
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/mga/mga_drv.h linux-2.6.38.7/drivers/gpu/drm/mga/mga_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/mga/mga_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/mga/mga_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -120,9 +120,9 @@ typedef struct drm_mga_private {
+ 	u32 clear_cmd;
+ 	u32 maccess;
+ 
+-	atomic_t vbl_received;          /**< Number of vblanks received. */
++	atomic_unchecked_t vbl_received;          /**< Number of vblanks received. */
+ 	wait_queue_head_t fence_queue;
+-	atomic_t last_fence_retired;
++	atomic_unchecked_t last_fence_retired;
+ 	u32 next_fence_to_post;
+ 
+ 	unsigned int fb_cpp;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/mga/mga_irq.c linux-2.6.38.7/drivers/gpu/drm/mga/mga_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/mga/mga_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/mga/mga_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -44,7 +44,7 @@ u32 mga_get_vblank_counter(struct drm_de
+ 	if (crtc != 0)
+ 		return 0;
+ 
+-	return atomic_read(&dev_priv->vbl_received);
++	return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+ 
+ 
+@@ -60,7 +60,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
+ 	/* VBLANK interrupt */
+ 	if (status & MGA_VLINEPEN) {
+ 		MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
+-		atomic_inc(&dev_priv->vbl_received);
++		atomic_inc_unchecked(&dev_priv->vbl_received);
+ 		drm_handle_vblank(dev, 0);
+ 		handled = 1;
+ 	}
+@@ -79,7 +79,7 @@ irqreturn_t mga_driver_irq_handler(DRM_I
+ 		if ((prim_start & ~0x03) != (prim_end & ~0x03))
+ 			MGA_WRITE(MGA_PRIMEND, prim_end);
+ 
+-		atomic_inc(&dev_priv->last_fence_retired);
++		atomic_inc_unchecked(&dev_priv->last_fence_retired);
+ 		DRM_WAKEUP(&dev_priv->fence_queue);
+ 		handled = 1;
+ 	}
+@@ -130,7 +130,7 @@ int mga_driver_fence_wait(struct drm_dev
+ 	 * using fences.
+ 	 */
+ 	DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
+-		    (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
++		    (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
+ 		      - *sequence) <= (1 << 23)));
+ 
+ 	*sequence = cur_fence;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_drv.h linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -226,7 +226,7 @@ struct nouveau_channel {
+ 		struct list_head pending;
+ 		uint32_t sequence;
+ 		uint32_t sequence_ack;
+-		atomic_t last_sequence_irq;
++		atomic_unchecked_t last_sequence_irq;
+ 	} fence;
+ 
+ 	/* DMA push buffer */
+@@ -661,7 +661,7 @@ struct drm_nouveau_private {
+ 		struct drm_global_reference mem_global_ref;
+ 		struct ttm_bo_global_ref bo_global_ref;
+ 		struct ttm_bo_device bdev;
+-		atomic_t validate_sequence;
++		atomic_unchecked_t validate_sequence;
+ 	} ttm;
+ 
+ 	struct {
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_fence.c linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_fence.c
+--- linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_fence.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_fence.c	2011-04-28 19:57:25.000000000 -0400
+@@ -83,7 +83,7 @@ nouveau_fence_update(struct nouveau_chan
+ 		if (USE_REFCNT(dev))
+ 			sequence = nvchan_rd32(chan, 0x48);
+ 		else
+-			sequence = atomic_read(&chan->fence.last_sequence_irq);
++			sequence = atomic_read_unchecked(&chan->fence.last_sequence_irq);
+ 
+ 		if (chan->fence.sequence_ack == sequence)
+ 			goto out;
+@@ -490,7 +490,7 @@ nouveau_fence_channel_init(struct nouvea
+ 
+ 	INIT_LIST_HEAD(&chan->fence.pending);
+ 	spin_lock_init(&chan->fence.lock);
+-	atomic_set(&chan->fence.last_sequence_irq, 0);
++	atomic_set_unchecked(&chan->fence.last_sequence_irq, 0);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_gem.c linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_gem.c
+--- linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_gem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_gem.c	2011-04-28 19:57:25.000000000 -0400
+@@ -241,7 +241,7 @@ validate_init(struct nouveau_channel *ch
+ 	int trycnt = 0;
+ 	int ret, i;
+ 
+-	sequence = atomic_add_return(1, &dev_priv->ttm.validate_sequence);
++	sequence = atomic_add_return_unchecked(1, &dev_priv->ttm.validate_sequence);
+ retry:
+ 	if (++trycnt > 100000) {
+ 		NV_ERROR(dev, "%s failed and gave up.\n", __func__);
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_state.c
+--- linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_state.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/nouveau/nouveau_state.c	2011-04-28 19:34:15.000000000 -0400
 @@ -621,7 +621,7 @@ static bool nouveau_switcheroo_can_switc
  	bool can_switch;
  
@@ -24427,9 +27588,102 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/nouveau/nouveau_state.c linux-2.6.38.2
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.38.2/drivers/gpu/drm/radeon/mkregtable.c
---- linux-2.6.38.2/drivers/gpu/drm/radeon/mkregtable.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/radeon/mkregtable.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/nouveau/nv04_graph.c linux-2.6.38.7/drivers/gpu/drm/nouveau/nv04_graph.c
+--- linux-2.6.38.7/drivers/gpu/drm/nouveau/nv04_graph.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/nouveau/nv04_graph.c	2011-04-28 19:57:25.000000000 -0400
+@@ -552,7 +552,7 @@ static int
+ nv04_graph_mthd_set_ref(struct nouveau_channel *chan,
+ 			u32 class, u32 mthd, u32 data)
+ {
+-	atomic_set(&chan->fence.last_sequence_irq, data);
++	atomic_set_unchecked(&chan->fence.last_sequence_irq, data);
+ 	return 0;
+ }
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/r128/r128_cce.c linux-2.6.38.7/drivers/gpu/drm/r128/r128_cce.c
+--- linux-2.6.38.7/drivers/gpu/drm/r128/r128_cce.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/r128/r128_cce.c	2011-04-28 19:57:25.000000000 -0400
+@@ -377,7 +377,7 @@ static int r128_do_init_cce(struct drm_d
+ 
+ 	/* GH: Simple idle check.
+ 	 */
+-	atomic_set(&dev_priv->idle_count, 0);
++	atomic_set_unchecked(&dev_priv->idle_count, 0);
+ 
+ 	/* We don't support anything other than bus-mastering ring mode,
+ 	 * but the ring can be in either AGP or PCI space for the ring
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/r128/r128_drv.h linux-2.6.38.7/drivers/gpu/drm/r128/r128_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/r128/r128_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/r128/r128_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -90,14 +90,14 @@ typedef struct drm_r128_private {
+ 	int is_pci;
+ 	unsigned long cce_buffers_offset;
+ 
+-	atomic_t idle_count;
++	atomic_unchecked_t idle_count;
+ 
+ 	int page_flipping;
+ 	int current_page;
+ 	u32 crtc_offset;
+ 	u32 crtc_offset_cntl;
+ 
+-	atomic_t vbl_received;
++	atomic_unchecked_t vbl_received;
+ 
+ 	u32 color_fmt;
+ 	unsigned int front_offset;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/r128/r128_irq.c linux-2.6.38.7/drivers/gpu/drm/r128/r128_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/r128/r128_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/r128/r128_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -42,7 +42,7 @@ u32 r128_get_vblank_counter(struct drm_d
+ 	if (crtc != 0)
+ 		return 0;
+ 
+-	return atomic_read(&dev_priv->vbl_received);
++	return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+ 
+ irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -56,7 +56,7 @@ irqreturn_t r128_driver_irq_handler(DRM_
+ 	/* VBLANK interrupt */
+ 	if (status & R128_CRTC_VBLANK_INT) {
+ 		R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
+-		atomic_inc(&dev_priv->vbl_received);
++		atomic_inc_unchecked(&dev_priv->vbl_received);
+ 		drm_handle_vblank(dev, 0);
+ 		return IRQ_HANDLED;
+ 	}
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/r128/r128_state.c linux-2.6.38.7/drivers/gpu/drm/r128/r128_state.c
+--- linux-2.6.38.7/drivers/gpu/drm/r128/r128_state.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/r128/r128_state.c	2011-04-28 19:57:25.000000000 -0400
+@@ -321,10 +321,10 @@ static void r128_clear_box(drm_r128_priv
+ 
+ static void r128_cce_performance_boxes(drm_r128_private_t *dev_priv)
+ {
+-	if (atomic_read(&dev_priv->idle_count) == 0)
++	if (atomic_read_unchecked(&dev_priv->idle_count) == 0)
+ 		r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
+ 	else
+-		atomic_set(&dev_priv->idle_count, 0);
++		atomic_set_unchecked(&dev_priv->idle_count, 0);
+ }
+ 
+ #endif
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/atom.c linux-2.6.38.7/drivers/gpu/drm/radeon/atom.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/atom.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/atom.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1245,6 +1245,8 @@ struct atom_context *atom_parse(struct c
+ 	char name[512];
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	ctx->card = card;
+ 	ctx->bios = bios;
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.38.7/drivers/gpu/drm/radeon/mkregtable.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/mkregtable.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/mkregtable.c	2011-04-28 19:34:15.000000000 -0400
 @@ -637,14 +637,14 @@ static int parser_auth(struct table *t, 
  	regex_t mask_rex;
  	regmatch_t match[4];
@@ -24447,9 +27701,21 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.38.2/dri
  
  	if (regcomp
  	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_device.c
---- linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_device.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_device.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_atombios.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_atombios.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_atombios.c	2011-05-22 23:06:03.000000000 -0400
+@@ -545,6 +545,8 @@ bool radeon_get_atom_connector_info_from
+ 	struct radeon_gpio_rec gpio;
+ 	struct radeon_hpd hpd;
+ 
++	pax_track_stack();
++
+ 	if (!atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset))
+ 		return false;
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_device.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_device.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_device.c	2011-04-28 19:34:15.000000000 -0400
 @@ -673,7 +673,7 @@ static bool radeon_switcheroo_can_switch
  	bool can_switch;
  
@@ -24459,9 +27725,101 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_device.c linux-2.6.38.2/
  	spin_unlock(&dev->count_lock);
  	return can_switch;
  }
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_state.c
---- linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_state.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_state.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_display.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_display.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_display.c	2011-05-16 21:47:08.000000000 -0400
+@@ -934,6 +934,8 @@ void radeon_compute_pll_legacy(struct ra
+ 	uint32_t post_div;
+ 	u32 pll_out_min, pll_out_max;
+ 
++	pax_track_stack();
++
+ 	DRM_DEBUG_KMS("PLL freq %llu %u %u\n", freq, pll->min_ref_div, pll->max_ref_div);
+ 	freq = freq * 1000;
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -255,7 +255,7 @@ typedef struct drm_radeon_private {
+ 
+ 	/* SW interrupt */
+ 	wait_queue_head_t swi_queue;
+-	atomic_t swi_emitted;
++	atomic_unchecked_t swi_emitted;
+ 	int vblank_crtc;
+ 	uint32_t irq_enable_reg;
+ 	uint32_t r500_disp_irq_reg;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_fence.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_fence.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_fence.c	2011-04-28 19:57:25.000000000 -0400
+@@ -49,7 +49,7 @@ int radeon_fence_emit(struct radeon_devi
+ 		write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
+ 		return 0;
+ 	}
+-	fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
++	fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
+ 	if (!rdev->cp.ready) {
+ 		/* FIXME: cp is not running assume everythings is done right
+ 		 * away
+@@ -354,7 +354,7 @@ int radeon_fence_driver_init(struct rade
+ 		return r;
+ 	}
+ 	WREG32(rdev->fence_drv.scratch_reg, 0);
+-	atomic_set(&rdev->fence_drv.seq, 0);
++	atomic_set_unchecked(&rdev->fence_drv.seq, 0);
+ 	INIT_LIST_HEAD(&rdev->fence_drv.created);
+ 	INIT_LIST_HEAD(&rdev->fence_drv.emited);
+ 	INIT_LIST_HEAD(&rdev->fence_drv.signaled);
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon.h linux-2.6.38.7/drivers/gpu/drm/radeon/radeon.h
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon.h	2011-04-28 19:57:25.000000000 -0400
+@@ -189,7 +189,7 @@ extern int sumo_get_temp(struct radeon_d
+  */
+ struct radeon_fence_driver {
+ 	uint32_t			scratch_reg;
+-	atomic_t			seq;
++	atomic_unchecked_t		seq;
+ 	uint32_t			last_seq;
+ 	unsigned long			last_jiffies;
+ 	unsigned long			last_timeout;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ioc32.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ioc32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ioc32.c	2011-04-28 19:34:15.000000000 -0400
+@@ -359,7 +359,7 @@ static int compat_radeon_cp_setparam(str
+ 	request = compat_alloc_user_space(sizeof(*request));
+ 	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
+ 	    || __put_user(req32.param, &request->param)
+-	    || __put_user((void __user *)(unsigned long)req32.value,
++	    || __put_user((unsigned long)req32.value,
+ 			  &request->value))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -225,8 +225,8 @@ static int radeon_emit_irq(struct drm_de
+ 	unsigned int ret;
+ 	RING_LOCALS;
+ 
+-	atomic_inc(&dev_priv->swi_emitted);
+-	ret = atomic_read(&dev_priv->swi_emitted);
++	atomic_inc_unchecked(&dev_priv->swi_emitted);
++	ret = atomic_read_unchecked(&dev_priv->swi_emitted);
+ 
+ 	BEGIN_RING(4);
+ 	OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
+@@ -352,7 +352,7 @@ int radeon_driver_irq_postinstall(struct
+ 	drm_radeon_private_t *dev_priv =
+ 	    (drm_radeon_private_t *) dev->dev_private;
+ 
+-	atomic_set(&dev_priv->swi_emitted, 0);
++	atomic_set_unchecked(&dev_priv->swi_emitted, 0);
+ 	DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
+ 
+ 	dev->max_vblank_count = 0x001fffff;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_state.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_state.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_state.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2168,7 +2168,7 @@ static int radeon_cp_clear(struct drm_de
  	if (sarea_priv->nbox > RADEON_NR_SAREA_CLIPRECTS)
  		sarea_priv->nbox = RADEON_NR_SAREA_CLIPRECTS;
@@ -24480,9 +27838,9 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.38.2/d
  
  	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
  
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_ttm.c
---- linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_ttm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_ttm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ttm.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ttm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/radeon_ttm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -603,8 +603,9 @@ void radeon_ttm_set_active_vram_size(str
  	man->size = size >> PAGE_SHIFT;
  }
@@ -24543,21 +27901,25 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.38.2/dri
  	vma->vm_ops = &radeon_ttm_vm_ops;
  	return 0;
  }
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo.c
---- linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo.c	2011-03-21 18:31:35.000000000 -0400
-@@ -40,7 +40,7 @@
- #include <asm/atomic.h>
- 
- #define TTM_ASSERT_LOCKED(param)
--#define TTM_DEBUG(fmt, arg...)
-+#define TTM_DEBUG(fmt, arg...) do {} while (0)
- #define TTM_BO_HASH_ORDER 13
- 
- static int ttm_bo_setup_vm(struct ttm_buffer_object *bo);
-diff -urNp linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo_vm.c
---- linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/radeon/rs690.c linux-2.6.38.7/drivers/gpu/drm/radeon/rs690.c
+--- linux-2.6.38.7/drivers/gpu/drm/radeon/rs690.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/radeon/rs690.c	2011-04-28 19:34:15.000000000 -0400
+@@ -304,9 +304,11 @@ void rs690_crtc_bandwidth_compute(struct
+ 		if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
+ 			rdev->pm.sideport_bandwidth.full)
+ 			rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
+-		read_delay_latency.full = dfixed_const(370 * 800 * 1000);
++		read_delay_latency.full = dfixed_const(800 * 1000);
+ 		read_delay_latency.full = dfixed_div(read_delay_latency,
+ 			rdev->pm.igp_sideport_mclk);
++		a.full = dfixed_const(370);
++		read_delay_latency.full = dfixed_mul(read_delay_latency, a);
+ 	} else {
+ 		if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
+ 			rdev->pm.k8_bandwidth.full)
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_bo_vm.c
+--- linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -69,11 +69,11 @@ static struct ttm_buffer_object *ttm_bo_
  	return best_bo;
  }
@@ -24615,9 +27977,223 @@ diff -urNp linux-2.6.38.2/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.38.2/drivers
  
  static const struct vm_operations_struct ttm_bo_vm_ops = {
  	.fault = ttm_bo_vm_fault,
-diff -urNp linux-2.6.38.2/drivers/hid/usbhid/hiddev.c linux-2.6.38.2/drivers/hid/usbhid/hiddev.c
---- linux-2.6.38.2/drivers/hid/usbhid/hiddev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hid/usbhid/hiddev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_page_alloc.c
+--- linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_page_alloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/ttm/ttm_page_alloc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -396,9 +396,9 @@ static int ttm_pool_get_num_unused_pages
+  */
+ static int ttm_pool_mm_shrink(struct shrinker *shrink, int shrink_pages, gfp_t gfp_mask)
+ {
+-	static atomic_t start_pool = ATOMIC_INIT(0);
++	static atomic_unchecked_t start_pool = ATOMIC_INIT(0);
+ 	unsigned i;
+-	unsigned pool_offset = atomic_add_return(1, &start_pool);
++	unsigned pool_offset = atomic_add_return_unchecked(1, &start_pool);
+ 	struct ttm_page_pool *pool;
+ 
+ 	pool_offset = pool_offset % NUM_POOLS;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/via/via_drv.h linux-2.6.38.7/drivers/gpu/drm/via/via_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/via/via_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/via/via_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -51,7 +51,7 @@ typedef struct drm_via_ring_buffer {
+ typedef uint32_t maskarray_t[5];
+ 
+ typedef struct drm_via_irq {
+-	atomic_t irq_received;
++	atomic_unchecked_t irq_received;
+ 	uint32_t pending_mask;
+ 	uint32_t enable_mask;
+ 	wait_queue_head_t irq_queue;
+@@ -75,7 +75,7 @@ typedef struct drm_via_private {
+ 	struct timeval last_vblank;
+ 	int last_vblank_valid;
+ 	unsigned usec_per_vblank;
+-	atomic_t vbl_received;
++	atomic_unchecked_t vbl_received;
+ 	drm_via_state_t hc_state;
+ 	char pci_buf[VIA_PCI_BUF_SIZE];
+ 	const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/via/via_irq.c linux-2.6.38.7/drivers/gpu/drm/via/via_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/via/via_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/via/via_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -102,7 +102,7 @@ u32 via_get_vblank_counter(struct drm_de
+ 	if (crtc != 0)
+ 		return 0;
+ 
+-	return atomic_read(&dev_priv->vbl_received);
++	return atomic_read_unchecked(&dev_priv->vbl_received);
+ }
+ 
+ irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
+@@ -117,8 +117,8 @@ irqreturn_t via_driver_irq_handler(DRM_I
+ 
+ 	status = VIA_READ(VIA_REG_INTERRUPT);
+ 	if (status & VIA_IRQ_VBLANK_PENDING) {
+-		atomic_inc(&dev_priv->vbl_received);
+-		if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
++		atomic_inc_unchecked(&dev_priv->vbl_received);
++		if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
+ 			do_gettimeofday(&cur_vblank);
+ 			if (dev_priv->last_vblank_valid) {
+ 				dev_priv->usec_per_vblank =
+@@ -128,7 +128,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
+ 			dev_priv->last_vblank = cur_vblank;
+ 			dev_priv->last_vblank_valid = 1;
+ 		}
+-		if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
++		if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
+ 			DRM_DEBUG("US per vblank is: %u\n",
+ 				  dev_priv->usec_per_vblank);
+ 		}
+@@ -138,7 +138,7 @@ irqreturn_t via_driver_irq_handler(DRM_I
+ 
+ 	for (i = 0; i < dev_priv->num_irqs; ++i) {
+ 		if (status & cur_irq->pending_mask) {
+-			atomic_inc(&cur_irq->irq_received);
++			atomic_inc_unchecked(&cur_irq->irq_received);
+ 			DRM_WAKEUP(&cur_irq->irq_queue);
+ 			handled = 1;
+ 			if (dev_priv->irq_map[drm_via_irq_dma0_td] == i)
+@@ -243,11 +243,11 @@ via_driver_irq_wait(struct drm_device *d
+ 		DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
+ 			    ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
+ 			     masks[irq][4]));
+-		cur_irq_sequence = atomic_read(&cur_irq->irq_received);
++		cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
+ 	} else {
+ 		DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
+ 			    (((cur_irq_sequence =
+-			       atomic_read(&cur_irq->irq_received)) -
++			       atomic_read_unchecked(&cur_irq->irq_received)) -
+ 			      *sequence) <= (1 << 23)));
+ 	}
+ 	*sequence = cur_irq_sequence;
+@@ -285,7 +285,7 @@ void via_driver_irq_preinstall(struct dr
+ 		}
+ 
+ 		for (i = 0; i < dev_priv->num_irqs; ++i) {
+-			atomic_set(&cur_irq->irq_received, 0);
++			atomic_set_unchecked(&cur_irq->irq_received, 0);
+ 			cur_irq->enable_mask = dev_priv->irq_masks[i][0];
+ 			cur_irq->pending_mask = dev_priv->irq_masks[i][1];
+ 			DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
+@@ -367,7 +367,7 @@ int via_wait_irq(struct drm_device *dev,
+ 	switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
+ 	case VIA_IRQ_RELATIVE:
+ 		irqwait->request.sequence +=
+-			atomic_read(&cur_irq->irq_received);
++			atomic_read_unchecked(&cur_irq->irq_received);
+ 		irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
+ 	case VIA_IRQ_ABSOLUTE:
+ 		break;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h
+--- linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_drv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -240,7 +240,7 @@ struct vmw_private {
+ 	 * Fencing and IRQs.
+ 	 */
+ 
+-	atomic_t fence_seq;
++	atomic_unchecked_t fence_seq;
+ 	wait_queue_head_t fence_queue;
+ 	wait_queue_head_t fifo_queue;
+ 	atomic_t fence_queue_waiters;
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+--- linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c	2011-04-28 19:57:25.000000000 -0400
+@@ -151,7 +151,7 @@ int vmw_wait_lag(struct vmw_private *dev
+ 	while (!vmw_lag_lt(queue, us)) {
+ 		spin_lock(&queue->lock);
+ 		if (list_empty(&queue->head))
+-			sequence = atomic_read(&dev_priv->fence_seq);
++			sequence = atomic_read_unchecked(&dev_priv->fence_seq);
+ 		else {
+ 			fence = list_first_entry(&queue->head,
+ 						 struct vmw_fence, head);
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c
+--- linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_fifo.c	2011-04-28 19:57:25.000000000 -0400
+@@ -137,7 +137,7 @@ int vmw_fifo_init(struct vmw_private *de
+ 		 (unsigned int) min,
+ 		 (unsigned int) fifo->capabilities);
+ 
+-	atomic_set(&dev_priv->fence_seq, dev_priv->last_read_sequence);
++	atomic_set_unchecked(&dev_priv->fence_seq, dev_priv->last_read_sequence);
+ 	iowrite32(dev_priv->last_read_sequence, fifo_mem + SVGA_FIFO_FENCE);
+ 	vmw_fence_queue_init(&fifo->fence_queue);
+ 	return vmw_fifo_send_fence(dev_priv, &dummy);
+@@ -476,7 +476,7 @@ int vmw_fifo_send_fence(struct vmw_priva
+ 
+ 	fm = vmw_fifo_reserve(dev_priv, bytes);
+ 	if (unlikely(fm == NULL)) {
+-		*sequence = atomic_read(&dev_priv->fence_seq);
++		*sequence = atomic_read_unchecked(&dev_priv->fence_seq);
+ 		ret = -ENOMEM;
+ 		(void)vmw_fallback_wait(dev_priv, false, true, *sequence,
+ 					false, 3*HZ);
+@@ -484,7 +484,7 @@ int vmw_fifo_send_fence(struct vmw_priva
+ 	}
+ 
+ 	do {
+-		*sequence = atomic_add_return(1, &dev_priv->fence_seq);
++		*sequence = atomic_add_return_unchecked(1, &dev_priv->fence_seq);
+ 	} while (*sequence == 0);
+ 
+ 	if (!(fifo_state->capabilities & SVGA_FIFO_CAP_FENCE)) {
+@@ -534,7 +534,7 @@ static int vmw_fifo_vm_fault(struct vm_a
+ 	return VM_FAULT_SIGBUS;
+ }
+ 
+-static struct vm_operations_struct vmw_fifo_vm_ops = {
++static const struct vm_operations_struct vmw_fifo_vm_ops = {
+ 	.fault = vmw_fifo_vm_fault,
+ 	.open = NULL,
+ 	.close = NULL
+diff -urNp linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c
+--- linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/gpu/drm/vmwgfx/vmwgfx_irq.c	2011-04-28 19:57:25.000000000 -0400
+@@ -100,7 +100,7 @@ bool vmw_fence_signaled(struct vmw_priva
+ 	 * emitted. Then the fence is stale and signaled.
+ 	 */
+ 
+-	ret = ((atomic_read(&dev_priv->fence_seq) - sequence)
++	ret = ((atomic_read_unchecked(&dev_priv->fence_seq) - sequence)
+ 	       > VMW_FENCE_WRAP);
+ 
+ 	return ret;
+@@ -131,7 +131,7 @@ int vmw_fallback_wait(struct vmw_private
+ 
+ 	if (fifo_idle)
+ 		down_read(&fifo_state->rwsem);
+-	signal_seq = atomic_read(&dev_priv->fence_seq);
++	signal_seq = atomic_read_unchecked(&dev_priv->fence_seq);
+ 	ret = 0;
+ 
+ 	for (;;) {
+diff -urNp linux-2.6.38.7/drivers/hid/hid-core.c linux-2.6.38.7/drivers/hid/hid-core.c
+--- linux-2.6.38.7/drivers/hid/hid-core.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/drivers/hid/hid-core.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1846,7 +1846,7 @@ static bool hid_ignore(struct hid_device
+ 
+ int hid_add_device(struct hid_device *hdev)
+ {
+-	static atomic_t id = ATOMIC_INIT(0);
++	static atomic_unchecked_t id = ATOMIC_INIT(0);
+ 	int ret;
+ 
+ 	if (WARN_ON(hdev->status & HID_STAT_ADDED))
+@@ -1861,7 +1861,7 @@ int hid_add_device(struct hid_device *hd
+ 	/* XXX hack, any other cleaner solution after the driver core
+ 	 * is converted to allow more than 20 bytes as the device name? */
+ 	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
+-		     hdev->vendor, hdev->product, atomic_inc_return(&id));
++		     hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
+ 
+ 	hid_debug_register(hdev, dev_name(&hdev->dev));
+ 	ret = device_add(&hdev->dev);
+diff -urNp linux-2.6.38.7/drivers/hid/usbhid/hiddev.c linux-2.6.38.7/drivers/hid/usbhid/hiddev.c
+--- linux-2.6.38.7/drivers/hid/usbhid/hiddev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/hid/usbhid/hiddev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -613,7 +613,7 @@ static long hiddev_ioctl(struct file *fi
  		break;
  
@@ -24627,57 +28203,111 @@ diff -urNp linux-2.6.38.2/drivers/hid/usbhid/hiddev.c linux-2.6.38.2/drivers/hid
  			break;
  
  		for (i = 0; i < hid->maxcollection; i++)
-diff -urNp linux-2.6.38.2/drivers/hwmon/k8temp.c linux-2.6.38.2/drivers/hwmon/k8temp.c
---- linux-2.6.38.2/drivers/hwmon/k8temp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hwmon/k8temp.c	2011-03-21 18:31:35.000000000 -0400
-@@ -138,7 +138,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
- 
- static const struct pci_device_id k8temp_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_AMD, PCI_DEVICE_ID_AMD_K8_NB_MISC) },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
+diff -urNp linux-2.6.38.7/drivers/hwmon/lis3lv02d.c linux-2.6.38.7/drivers/hwmon/lis3lv02d.c
+--- linux-2.6.38.7/drivers/hwmon/lis3lv02d.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/hwmon/lis3lv02d.c	2011-04-28 19:57:25.000000000 -0400
+@@ -436,7 +436,7 @@ static irqreturn_t lis302dl_interrupt(in
+ 	 * the lid is closed. This leads to interrupts as soon as a little move
+ 	 * is done.
+ 	 */
+-	atomic_inc(&lis3_dev.count);
++	atomic_inc_unchecked(&lis3_dev.count);
  
- MODULE_DEVICE_TABLE(pci, k8temp_ids);
-diff -urNp linux-2.6.38.2/drivers/hwmon/sis5595.c linux-2.6.38.2/drivers/hwmon/sis5595.c
---- linux-2.6.38.2/drivers/hwmon/sis5595.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hwmon/sis5595.c	2011-03-21 18:31:35.000000000 -0400
-@@ -701,7 +701,7 @@ static struct sis5595_data *sis5595_upda
+ 	wake_up_interruptible(&lis3_dev.misc_wait);
+ 	kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
+@@ -519,7 +519,7 @@ static int lis3lv02d_misc_open(struct in
+ 	if (lis3_dev.pm_dev)
+ 		pm_runtime_get_sync(lis3_dev.pm_dev);
  
- static const struct pci_device_id sis5595_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
+-	atomic_set(&lis3_dev.count, 0);
++	atomic_set_unchecked(&lis3_dev.count, 0);
+ 	return 0;
+ }
  
- MODULE_DEVICE_TABLE(pci, sis5595_pci_ids);
-diff -urNp linux-2.6.38.2/drivers/hwmon/via686a.c linux-2.6.38.2/drivers/hwmon/via686a.c
---- linux-2.6.38.2/drivers/hwmon/via686a.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hwmon/via686a.c	2011-03-21 18:31:35.000000000 -0400
-@@ -779,7 +779,7 @@ static struct via686a_data *via686a_upda
+@@ -546,7 +546,7 @@ static ssize_t lis3lv02d_misc_read(struc
+ 	add_wait_queue(&lis3_dev.misc_wait, &wait);
+ 	while (true) {
+ 		set_current_state(TASK_INTERRUPTIBLE);
+-		data = atomic_xchg(&lis3_dev.count, 0);
++		data = atomic_xchg_unchecked(&lis3_dev.count, 0);
+ 		if (data)
+ 			break;
  
- static const struct pci_device_id via686a_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_82C686_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
+@@ -584,7 +584,7 @@ out:
+ static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
+ {
+ 	poll_wait(file, &lis3_dev.misc_wait, wait);
+-	if (atomic_read(&lis3_dev.count))
++	if (atomic_read_unchecked(&lis3_dev.count))
+ 		return POLLIN | POLLRDNORM;
+ 	return 0;
+ }
+diff -urNp linux-2.6.38.7/drivers/hwmon/lis3lv02d.h linux-2.6.38.7/drivers/hwmon/lis3lv02d.h
+--- linux-2.6.38.7/drivers/hwmon/lis3lv02d.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/hwmon/lis3lv02d.h	2011-04-28 19:57:25.000000000 -0400
+@@ -265,7 +265,7 @@ struct lis3lv02d {
+ 	struct input_polled_dev	*idev;     /* input device */
+ 	struct platform_device	*pdev;     /* platform device */
+ 	struct regulator_bulk_data regulators[2];
+-	atomic_t		count;     /* interrupt count after last read */
++	atomic_unchecked_t	count;     /* interrupt count after last read */
+ 	union axis_conversion	ac;        /* hw -> logical axis */
+ 	int			mapped_btns[3];
+ 
+diff -urNp linux-2.6.38.7/drivers/hwmon/sht15.c linux-2.6.38.7/drivers/hwmon/sht15.c
+--- linux-2.6.38.7/drivers/hwmon/sht15.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/drivers/hwmon/sht15.c	2011-04-28 19:57:25.000000000 -0400
+@@ -113,7 +113,7 @@ struct sht15_data {
+ 	int				supply_uV;
+ 	int				supply_uV_valid;
+ 	struct work_struct		update_supply_work;
+-	atomic_t			interrupt_handled;
++	atomic_unchecked_t		interrupt_handled;
  };
  
- MODULE_DEVICE_TABLE(pci, via686a_pci_ids);
-diff -urNp linux-2.6.38.2/drivers/hwmon/vt8231.c linux-2.6.38.2/drivers/hwmon/vt8231.c
---- linux-2.6.38.2/drivers/hwmon/vt8231.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hwmon/vt8231.c	2011-03-21 18:31:35.000000000 -0400
-@@ -701,7 +701,7 @@ static struct platform_driver vt8231_dri
- 
- static const struct pci_device_id vt8231_pci_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_VIA, PCI_DEVICE_ID_VIA_8231_4) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
+ /**
+@@ -246,13 +246,13 @@ static inline int sht15_update_single_va
+ 		return ret;
  
- MODULE_DEVICE_TABLE(pci, vt8231_pci_ids);
-diff -urNp linux-2.6.38.2/drivers/hwmon/w83791d.c linux-2.6.38.2/drivers/hwmon/w83791d.c
---- linux-2.6.38.2/drivers/hwmon/w83791d.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/hwmon/w83791d.c	2011-03-21 18:31:35.000000000 -0400
+ 	gpio_direction_input(data->pdata->gpio_data);
+-	atomic_set(&data->interrupt_handled, 0);
++	atomic_set_unchecked(&data->interrupt_handled, 0);
+ 
+ 	enable_irq(gpio_to_irq(data->pdata->gpio_data));
+ 	if (gpio_get_value(data->pdata->gpio_data) == 0) {
+ 		disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
+ 		/* Only relevant if the interrupt hasn't occured. */
+-		if (!atomic_read(&data->interrupt_handled))
++		if (!atomic_read_unchecked(&data->interrupt_handled))
+ 			schedule_work(&data->read_work);
+ 	}
+ 	ret = wait_event_timeout(data->wait_queue,
+@@ -399,7 +399,7 @@ static irqreturn_t sht15_interrupt_fired
+ 	struct sht15_data *data = d;
+ 	/* First disable the interrupt */
+ 	disable_irq_nosync(irq);
+-	atomic_inc(&data->interrupt_handled);
++	atomic_inc_unchecked(&data->interrupt_handled);
+ 	/* Then schedule a reading work struct */
+ 	if (data->flag != SHT15_READING_NOTHING)
+ 		schedule_work(&data->read_work);
+@@ -450,11 +450,11 @@ static void sht15_bh_read_data(struct wo
+ 		   here as could have gone low in meantime so verify
+ 		   it hasn't!
+ 		*/
+-		atomic_set(&data->interrupt_handled, 0);
++		atomic_set_unchecked(&data->interrupt_handled, 0);
+ 		enable_irq(gpio_to_irq(data->pdata->gpio_data));
+ 		/* If still not occured or another handler has been scheduled */
+ 		if (gpio_get_value(data->pdata->gpio_data)
+-		    || atomic_read(&data->interrupt_handled))
++		    || atomic_read_unchecked(&data->interrupt_handled))
+ 			return;
+ 	}
+ 	/* Read the data back from the device */
+diff -urNp linux-2.6.38.7/drivers/hwmon/w83791d.c linux-2.6.38.7/drivers/hwmon/w83791d.c
+--- linux-2.6.38.7/drivers/hwmon/w83791d.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/hwmon/w83791d.c	2011-04-28 19:34:15.000000000 -0400
 @@ -329,8 +329,8 @@ static int w83791d_detect(struct i2c_cli
  			  struct i2c_board_info *info);
  static int w83791d_remove(struct i2c_client *client);
@@ -24689,66 +28319,9 @@ diff -urNp linux-2.6.38.2/drivers/hwmon/w83791d.c linux-2.6.38.2/drivers/hwmon/w
  static struct w83791d_data *w83791d_update_device(struct device *dev);
  
  #ifdef DEBUG
-diff -urNp linux-2.6.38.2/drivers/i2c/busses/i2c-i801.c linux-2.6.38.2/drivers/i2c/busses/i2c-i801.c
---- linux-2.6.38.2/drivers/i2c/busses/i2c-i801.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/i2c/busses/i2c-i801.c	2011-03-21 18:31:35.000000000 -0400
-@@ -621,7 +621,7 @@ static const struct pci_device_id i801_i
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF0) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF1) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_PATSBURG_SMBUS_IDF2) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, i801_ids);
-diff -urNp linux-2.6.38.2/drivers/i2c/busses/i2c-piix4.c linux-2.6.38.2/drivers/i2c/busses/i2c-piix4.c
---- linux-2.6.38.2/drivers/i2c/busses/i2c-piix4.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/i2c/busses/i2c-piix4.c	2011-03-21 18:31:35.000000000 -0400
-@@ -124,7 +124,7 @@ static struct dmi_system_id __devinitdat
- 		.ident = "IBM",
- 		.matches = { DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
- 	},
--	{ },
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static int __devinit piix4_setup(struct pci_dev *PIIX4_dev,
-@@ -491,7 +491,7 @@ static const struct pci_device_id piix4_
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1000SB) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SERVERWORKS,
- 		     PCI_DEVICE_ID_SERVERWORKS_HT1100LD) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, piix4_ids);
-diff -urNp linux-2.6.38.2/drivers/i2c/busses/i2c-sis630.c linux-2.6.38.2/drivers/i2c/busses/i2c-sis630.c
---- linux-2.6.38.2/drivers/i2c/busses/i2c-sis630.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/i2c/busses/i2c-sis630.c	2011-03-21 18:31:35.000000000 -0400
-@@ -471,7 +471,7 @@ static struct i2c_adapter sis630_adapter
- static const struct pci_device_id sis630_ids[] __devinitconst = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_503) },
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_LPC) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis630_ids);
-diff -urNp linux-2.6.38.2/drivers/i2c/busses/i2c-sis96x.c linux-2.6.38.2/drivers/i2c/busses/i2c-sis96x.c
---- linux-2.6.38.2/drivers/i2c/busses/i2c-sis96x.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/i2c/busses/i2c-sis96x.c	2011-03-21 18:31:35.000000000 -0400
-@@ -247,7 +247,7 @@ static struct i2c_adapter sis96x_adapter
- 
- static const struct pci_device_id sis96x_ids[] = {
- 	{ PCI_DEVICE(PCI_VENDOR_ID_SI, PCI_DEVICE_ID_SI_SMBUS) },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE (pci, sis96x_ids);
-diff -urNp linux-2.6.38.2/drivers/ide/ide-cd.c linux-2.6.38.2/drivers/ide/ide-cd.c
---- linux-2.6.38.2/drivers/ide/ide-cd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/ide/ide-cd.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ide/ide-cd.c linux-2.6.38.7/drivers/ide/ide-cd.c
+--- linux-2.6.38.7/drivers/ide/ide-cd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ide/ide-cd.c	2011-04-28 19:34:15.000000000 -0400
 @@ -776,7 +776,7 @@ static void cdrom_do_block_pc(ide_drive_
  		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
  		if ((unsigned long)buf & alignment
@@ -24758,9 +28331,33 @@ diff -urNp linux-2.6.38.2/drivers/ide/ide-cd.c linux-2.6.38.2/drivers/ide/ide-cd
  			drive->dma = 0;
  	}
  }
-diff -urNp linux-2.6.38.2/drivers/infiniband/core/cm.c linux-2.6.38.2/drivers/infiniband/core/cm.c
---- linux-2.6.38.2/drivers/infiniband/core/cm.c	2011-03-23 17:20:07.000000000 -0400
-+++ linux-2.6.38.2/drivers/infiniband/core/cm.c	2011-03-23 17:21:50.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/ide/ide-floppy.c linux-2.6.38.7/drivers/ide/ide-floppy.c
+--- linux-2.6.38.7/drivers/ide/ide-floppy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ide/ide-floppy.c	2011-05-16 21:47:08.000000000 -0400
+@@ -379,6 +379,8 @@ static int ide_floppy_get_capacity(ide_d
+ 	u8 pc_buf[256], header_len, desc_cnt;
+ 	int i, rc = 1, blocks, length;
+ 
++	pax_track_stack();
++
+ 	ide_debug_log(IDE_DBG_FUNC, "enter");
+ 
+ 	drive->bios_cyl = 0;
+diff -urNp linux-2.6.38.7/drivers/ide/setup-pci.c linux-2.6.38.7/drivers/ide/setup-pci.c
+--- linux-2.6.38.7/drivers/ide/setup-pci.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/ide/setup-pci.c	2011-05-16 21:47:08.000000000 -0400
+@@ -542,6 +542,8 @@ int ide_pci_init_two(struct pci_dev *dev
+ 	int ret, i, n_ports = dev2 ? 4 : 2;
+ 	struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
+ 
++	pax_track_stack();
++
+ 	for (i = 0; i < n_ports / 2; i++) {
+ 		ret = ide_setup_pci_controller(pdev[i], d, !i);
+ 		if (ret < 0)
+diff -urNp linux-2.6.38.7/drivers/infiniband/core/cm.c linux-2.6.38.7/drivers/infiniband/core/cm.c
+--- linux-2.6.38.7/drivers/infiniband/core/cm.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/core/cm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -113,7 +113,7 @@ static char const counter_group_names[CM
  
  struct cm_counter_group {
@@ -24900,9 +28497,525 @@ diff -urNp linux-2.6.38.2/drivers/infiniband/core/cm.c linux-2.6.38.2/drivers/in
  }
  
  static const struct sysfs_ops cm_counter_ops = {
-diff -urNp linux-2.6.38.2/drivers/infiniband/hw/qib/qib.h linux-2.6.38.2/drivers/infiniband/hw/qib/qib.h
---- linux-2.6.38.2/drivers/infiniband/hw/qib/qib.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/infiniband/hw/qib/qib.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/infiniband/core/fmr_pool.c linux-2.6.38.7/drivers/infiniband/core/fmr_pool.c
+--- linux-2.6.38.7/drivers/infiniband/core/fmr_pool.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/core/fmr_pool.c	2011-04-28 19:57:25.000000000 -0400
+@@ -97,8 +97,8 @@ struct ib_fmr_pool {
+ 
+ 	struct task_struct       *thread;
+ 
+-	atomic_t                  req_ser;
+-	atomic_t                  flush_ser;
++	atomic_unchecked_t        req_ser;
++	atomic_unchecked_t        flush_ser;
+ 
+ 	wait_queue_head_t         force_wait;
+ };
+@@ -179,10 +179,10 @@ static int ib_fmr_cleanup_thread(void *p
+ 	struct ib_fmr_pool *pool = pool_ptr;
+ 
+ 	do {
+-		if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
++		if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
+ 			ib_fmr_batch_release(pool);
+ 
+-			atomic_inc(&pool->flush_ser);
++			atomic_inc_unchecked(&pool->flush_ser);
+ 			wake_up_interruptible(&pool->force_wait);
+ 
+ 			if (pool->flush_function)
+@@ -190,7 +190,7 @@ static int ib_fmr_cleanup_thread(void *p
+ 		}
+ 
+ 		set_current_state(TASK_INTERRUPTIBLE);
+-		if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
++		if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
+ 		    !kthread_should_stop())
+ 			schedule();
+ 		__set_current_state(TASK_RUNNING);
+@@ -282,8 +282,8 @@ struct ib_fmr_pool *ib_create_fmr_pool(s
+ 	pool->dirty_watermark = params->dirty_watermark;
+ 	pool->dirty_len       = 0;
+ 	spin_lock_init(&pool->pool_lock);
+-	atomic_set(&pool->req_ser,   0);
+-	atomic_set(&pool->flush_ser, 0);
++	atomic_set_unchecked(&pool->req_ser,   0);
++	atomic_set_unchecked(&pool->flush_ser, 0);
+ 	init_waitqueue_head(&pool->force_wait);
+ 
+ 	pool->thread = kthread_run(ib_fmr_cleanup_thread,
+@@ -411,11 +411,11 @@ int ib_flush_fmr_pool(struct ib_fmr_pool
+ 	}
+ 	spin_unlock_irq(&pool->pool_lock);
+ 
+-	serial = atomic_inc_return(&pool->req_ser);
++	serial = atomic_inc_return_unchecked(&pool->req_ser);
+ 	wake_up_process(pool->thread);
+ 
+ 	if (wait_event_interruptible(pool->force_wait,
+-				     atomic_read(&pool->flush_ser) - serial >= 0))
++				     atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
+ 		return -EINTR;
+ 
+ 	return 0;
+@@ -525,7 +525,7 @@ int ib_fmr_pool_unmap(struct ib_pool_fmr
+ 		} else {
+ 			list_add_tail(&fmr->list, &pool->dirty_list);
+ 			if (++pool->dirty_len >= pool->dirty_watermark) {
+-				atomic_inc(&pool->req_ser);
++				atomic_inc_unchecked(&pool->req_ser);
+ 				wake_up_process(pool->thread);
+ 			}
+ 		}
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/cxgb4/mem.c linux-2.6.38.7/drivers/infiniband/hw/cxgb4/mem.c
+--- linux-2.6.38.7/drivers/infiniband/hw/cxgb4/mem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/cxgb4/mem.c	2011-04-28 19:57:25.000000000 -0400
+@@ -122,7 +122,7 @@ static int write_tpt_entry(struct c4iw_r
+ 	int err;
+ 	struct fw_ri_tpte tpt;
+ 	u32 stag_idx;
+-	static atomic_t key;
++	static atomic_unchecked_t key;
+ 
+ 	if (c4iw_fatal_error(rdev))
+ 		return -EIO;
+@@ -135,7 +135,7 @@ static int write_tpt_entry(struct c4iw_r
+ 					     &rdev->resource.tpt_fifo_lock);
+ 		if (!stag_idx)
+ 			return -ENOMEM;
+-		*stag = (stag_idx << 8) | (atomic_inc_return(&key) & 0xff);
++		*stag = (stag_idx << 8) | (atomic_inc_return_unchecked(&key) & 0xff);
+ 	}
+ 	PDBG("%s stag_state 0x%0x type 0x%0x pdid 0x%0x, stag_idx 0x%x\n",
+ 	     __func__, stag_state, type, pdid, stag_idx);
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_fs.c
+--- linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_fs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_fs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -113,6 +113,8 @@ static ssize_t atomic_counters_read(stru
+ 	struct infinipath_counters counters;
+ 	struct ipath_devdata *dd;
+ 
++	pax_track_stack();
++
+ 	dd = file->f_path.dentry->d_inode->i_private;
+ 	dd->ipath_f_read_counters(dd, &counters);
+ 
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_rc.c linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_rc.c
+--- linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_rc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_rc.c	2011-05-11 18:35:16.000000000 -0400
+@@ -1868,7 +1868,7 @@ void ipath_rc_rcv(struct ipath_ibdev *de
+ 		struct ib_atomic_eth *ateth;
+ 		struct ipath_ack_entry *e;
+ 		u64 vaddr;
+-		atomic64_t *maddr;
++		atomic64_unchecked_t *maddr;
+ 		u64 sdata;
+ 		u32 rkey;
+ 		u8 next;
+@@ -1903,11 +1903,11 @@ void ipath_rc_rcv(struct ipath_ibdev *de
+ 					    IB_ACCESS_REMOTE_ATOMIC)))
+ 			goto nack_acc_unlck;
+ 		/* Perform atomic OP and save result. */
+-		maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
++		maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
+ 		sdata = be64_to_cpu(ateth->swap_data);
+ 		e = &qp->s_ack_queue[qp->r_head_ack_queue];
+ 		e->atomic_data = (opcode == OP(FETCH_ADD)) ?
+-			(u64) atomic64_add_return(sdata, maddr) - sdata :
++			(u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
+ 			(u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
+ 				      be64_to_cpu(ateth->compare_data),
+ 				      sdata);
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_ruc.c linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_ruc.c
+--- linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_ruc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/ipath/ipath_ruc.c	2011-05-11 18:35:16.000000000 -0400
+@@ -266,7 +266,7 @@ static void ipath_ruc_loopback(struct ip
+ 	unsigned long flags;
+ 	struct ib_wc wc;
+ 	u64 sdata;
+-	atomic64_t *maddr;
++	atomic64_unchecked_t *maddr;
+ 	enum ib_wc_status send_status;
+ 
+ 	/*
+@@ -382,11 +382,11 @@ again:
+ 					    IB_ACCESS_REMOTE_ATOMIC)))
+ 			goto acc_err;
+ 		/* Perform atomic OP and save result. */
+-		maddr = (atomic64_t *) qp->r_sge.sge.vaddr;
++		maddr = (atomic64_unchecked_t *) qp->r_sge.sge.vaddr;
+ 		sdata = wqe->wr.wr.atomic.compare_add;
+ 		*(u64 *) sqp->s_sge.sge.vaddr =
+ 			(wqe->wr.opcode == IB_WR_ATOMIC_FETCH_AND_ADD) ?
+-			(u64) atomic64_add_return(sdata, maddr) - sdata :
++			(u64) atomic64_add_return_unchecked(sdata, maddr) - sdata :
+ 			(u64) cmpxchg((u64 *) qp->r_sge.sge.vaddr,
+ 				      sdata, wqe->wr.wr.atomic.swap);
+ 		goto send_comp;
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/nes/nes.c linux-2.6.38.7/drivers/infiniband/hw/nes/nes.c
+--- linux-2.6.38.7/drivers/infiniband/hw/nes/nes.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/nes/nes.c	2011-04-28 19:57:25.000000000 -0400
+@@ -103,7 +103,7 @@ MODULE_PARM_DESC(limit_maxrdreqsz, "Limi
+ LIST_HEAD(nes_adapter_list);
+ static LIST_HEAD(nes_dev_list);
+ 
+-atomic_t qps_destroyed;
++atomic_unchecked_t qps_destroyed;
+ 
+ static unsigned int ee_flsh_adapter;
+ static unsigned int sysfs_nonidx_addr;
+@@ -274,7 +274,7 @@ static void nes_cqp_rem_ref_callback(str
+ 	struct nes_qp *nesqp = cqp_request->cqp_callback_pointer;
+ 	struct nes_adapter *nesadapter = nesdev->nesadapter;
+ 
+-	atomic_inc(&qps_destroyed);
++	atomic_inc_unchecked(&qps_destroyed);
+ 
+ 	/* Free the control structures */
+ 
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.38.7/drivers/infiniband/hw/nes/nes_cm.c
+--- linux-2.6.38.7/drivers/infiniband/hw/nes/nes_cm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/nes/nes_cm.c	2011-04-28 19:57:25.000000000 -0400
+@@ -68,14 +68,14 @@ u32 cm_packets_dropped;
+ u32 cm_packets_retrans;
+ u32 cm_packets_created;
+ u32 cm_packets_received;
+-atomic_t cm_listens_created;
+-atomic_t cm_listens_destroyed;
++atomic_unchecked_t cm_listens_created;
++atomic_unchecked_t cm_listens_destroyed;
+ u32 cm_backlog_drops;
+-atomic_t cm_loopbacks;
+-atomic_t cm_nodes_created;
+-atomic_t cm_nodes_destroyed;
+-atomic_t cm_accel_dropped_pkts;
+-atomic_t cm_resets_recvd;
++atomic_unchecked_t cm_loopbacks;
++atomic_unchecked_t cm_nodes_created;
++atomic_unchecked_t cm_nodes_destroyed;
++atomic_unchecked_t cm_accel_dropped_pkts;
++atomic_unchecked_t cm_resets_recvd;
+ 
+ static inline int mini_cm_accelerated(struct nes_cm_core *,
+ 	struct nes_cm_node *);
+@@ -151,13 +151,13 @@ static struct nes_cm_ops nes_cm_api = {
+ 
+ static struct nes_cm_core *g_cm_core;
+ 
+-atomic_t cm_connects;
+-atomic_t cm_accepts;
+-atomic_t cm_disconnects;
+-atomic_t cm_closes;
+-atomic_t cm_connecteds;
+-atomic_t cm_connect_reqs;
+-atomic_t cm_rejects;
++atomic_unchecked_t cm_connects;
++atomic_unchecked_t cm_accepts;
++atomic_unchecked_t cm_disconnects;
++atomic_unchecked_t cm_closes;
++atomic_unchecked_t cm_connecteds;
++atomic_unchecked_t cm_connect_reqs;
++atomic_unchecked_t cm_rejects;
+ 
+ 
+ /**
+@@ -1045,7 +1045,7 @@ static int mini_cm_dec_refcnt_listen(str
+ 		kfree(listener);
+ 		listener = NULL;
+ 		ret = 0;
+-		atomic_inc(&cm_listens_destroyed);
++		atomic_inc_unchecked(&cm_listens_destroyed);
+ 	} else {
+ 		spin_unlock_irqrestore(&cm_core->listen_list_lock, flags);
+ 	}
+@@ -1242,7 +1242,7 @@ static struct nes_cm_node *make_cm_node(
+ 		  cm_node->rem_mac);
+ 
+ 	add_hte_node(cm_core, cm_node);
+-	atomic_inc(&cm_nodes_created);
++	atomic_inc_unchecked(&cm_nodes_created);
+ 
+ 	return cm_node;
+ }
+@@ -1300,7 +1300,7 @@ static int rem_ref_cm_node(struct nes_cm
+ 	}
+ 
+ 	atomic_dec(&cm_core->node_cnt);
+-	atomic_inc(&cm_nodes_destroyed);
++	atomic_inc_unchecked(&cm_nodes_destroyed);
+ 	nesqp = cm_node->nesqp;
+ 	if (nesqp) {
+ 		nesqp->cm_node = NULL;
+@@ -1367,7 +1367,7 @@ static int process_options(struct nes_cm
+ 
+ static void drop_packet(struct sk_buff *skb)
+ {
+-	atomic_inc(&cm_accel_dropped_pkts);
++	atomic_inc_unchecked(&cm_accel_dropped_pkts);
+ 	dev_kfree_skb_any(skb);
+ }
+ 
+@@ -1430,7 +1430,7 @@ static void handle_rst_pkt(struct nes_cm
+ {
+ 
+ 	int	reset = 0;	/* whether to send reset in case of err.. */
+-	atomic_inc(&cm_resets_recvd);
++	atomic_inc_unchecked(&cm_resets_recvd);
+ 	nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
+ 			" refcnt=%d\n", cm_node, cm_node->state,
+ 			atomic_read(&cm_node->ref_count));
+@@ -2059,7 +2059,7 @@ static struct nes_cm_node *mini_cm_conne
+ 				rem_ref_cm_node(cm_node->cm_core, cm_node);
+ 				return NULL;
+ 			}
+-			atomic_inc(&cm_loopbacks);
++			atomic_inc_unchecked(&cm_loopbacks);
+ 			loopbackremotenode->loopbackpartner = cm_node;
+ 			loopbackremotenode->tcp_cntxt.rcv_wscale =
+ 				NES_CM_DEFAULT_RCV_WND_SCALE;
+@@ -2334,7 +2334,7 @@ static int mini_cm_recv_pkt(struct nes_c
+ 			add_ref_cm_node(cm_node);
+ 		} else if (cm_node->state == NES_CM_STATE_TSA) {
+ 			rem_ref_cm_node(cm_core, cm_node);
+-			atomic_inc(&cm_accel_dropped_pkts);
++			atomic_inc_unchecked(&cm_accel_dropped_pkts);
+ 			dev_kfree_skb_any(skb);
+ 			break;
+ 		}
+@@ -2640,7 +2640,7 @@ static int nes_cm_disconn_true(struct ne
+ 
+ 	if ((cm_id) && (cm_id->event_handler)) {
+ 		if (issue_disconn) {
+-			atomic_inc(&cm_disconnects);
++			atomic_inc_unchecked(&cm_disconnects);
+ 			cm_event.event = IW_CM_EVENT_DISCONNECT;
+ 			cm_event.status = disconn_status;
+ 			cm_event.local_addr = cm_id->local_addr;
+@@ -2662,7 +2662,7 @@ static int nes_cm_disconn_true(struct ne
+ 		}
+ 
+ 		if (issue_close) {
+-			atomic_inc(&cm_closes);
++			atomic_inc_unchecked(&cm_closes);
+ 			nes_disconnect(nesqp, 1);
+ 
+ 			cm_id->provider_data = nesqp;
+@@ -2793,7 +2793,7 @@ int nes_accept(struct iw_cm_id *cm_id, s
+ 
+ 	nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
+ 		nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
+-	atomic_inc(&cm_accepts);
++	atomic_inc_unchecked(&cm_accepts);
+ 
+ 	nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
+ 			netdev_refcnt_read(nesvnic->netdev));
+@@ -3003,7 +3003,7 @@ int nes_reject(struct iw_cm_id *cm_id, c
+ 
+ 	struct nes_cm_core *cm_core;
+ 
+-	atomic_inc(&cm_rejects);
++	atomic_inc_unchecked(&cm_rejects);
+ 	cm_node = (struct nes_cm_node *) cm_id->provider_data;
+ 	loopback = cm_node->loopbackpartner;
+ 	cm_core = cm_node->cm_core;
+@@ -3069,7 +3069,7 @@ int nes_connect(struct iw_cm_id *cm_id, 
+ 		ntohl(cm_id->local_addr.sin_addr.s_addr),
+ 		ntohs(cm_id->local_addr.sin_port));
+ 
+-	atomic_inc(&cm_connects);
++	atomic_inc_unchecked(&cm_connects);
+ 	nesqp->active_conn = 1;
+ 
+ 	/* cache the cm_id in the qp */
+@@ -3175,7 +3175,7 @@ int nes_create_listen(struct iw_cm_id *c
+ 			g_cm_core->api->stop_listener(g_cm_core, (void *)cm_node);
+ 			return err;
+ 		}
+-		atomic_inc(&cm_listens_created);
++		atomic_inc_unchecked(&cm_listens_created);
+ 	}
+ 
+ 	cm_id->add_ref(cm_id);
+@@ -3280,7 +3280,7 @@ static void cm_event_connected(struct ne
+ 	if (nesqp->destroyed) {
+ 		return;
+ 	}
+-	atomic_inc(&cm_connecteds);
++	atomic_inc_unchecked(&cm_connecteds);
+ 	nes_debug(NES_DBG_CM, "QP%u attempting to connect to  0x%08X:0x%04X on"
+ 			" local port 0x%04X. jiffies = %lu.\n",
+ 			nesqp->hwqp.qp_id,
+@@ -3495,7 +3495,7 @@ static void cm_event_reset(struct nes_cm
+ 
+ 	cm_id->add_ref(cm_id);
+ 	ret = cm_id->event_handler(cm_id, &cm_event);
+-	atomic_inc(&cm_closes);
++	atomic_inc_unchecked(&cm_closes);
+ 	cm_event.event = IW_CM_EVENT_CLOSE;
+ 	cm_event.status = IW_CM_EVENT_STATUS_OK;
+ 	cm_event.provider_data = cm_id->provider_data;
+@@ -3531,7 +3531,7 @@ static void cm_event_mpa_req(struct nes_
+ 		return;
+ 	cm_id = cm_node->cm_id;
+ 
+-	atomic_inc(&cm_connect_reqs);
++	atomic_inc_unchecked(&cm_connect_reqs);
+ 	nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
+ 			cm_node, cm_id, jiffies);
+ 
+@@ -3569,7 +3569,7 @@ static void cm_event_mpa_reject(struct n
+ 		return;
+ 	cm_id = cm_node->cm_id;
+ 
+-	atomic_inc(&cm_connect_reqs);
++	atomic_inc_unchecked(&cm_connect_reqs);
+ 	nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
+ 			cm_node, cm_id, jiffies);
+ 
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/nes/nes.h linux-2.6.38.7/drivers/infiniband/hw/nes/nes.h
+--- linux-2.6.38.7/drivers/infiniband/hw/nes/nes.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/nes/nes.h	2011-04-28 19:57:25.000000000 -0400
+@@ -175,17 +175,17 @@ extern unsigned int nes_debug_level;
+ extern unsigned int wqm_quanta;
+ extern struct list_head nes_adapter_list;
+ 
+-extern atomic_t cm_connects;
+-extern atomic_t cm_accepts;
+-extern atomic_t cm_disconnects;
+-extern atomic_t cm_closes;
+-extern atomic_t cm_connecteds;
+-extern atomic_t cm_connect_reqs;
+-extern atomic_t cm_rejects;
+-extern atomic_t mod_qp_timouts;
+-extern atomic_t qps_created;
+-extern atomic_t qps_destroyed;
+-extern atomic_t sw_qps_destroyed;
++extern atomic_unchecked_t cm_connects;
++extern atomic_unchecked_t cm_accepts;
++extern atomic_unchecked_t cm_disconnects;
++extern atomic_unchecked_t cm_closes;
++extern atomic_unchecked_t cm_connecteds;
++extern atomic_unchecked_t cm_connect_reqs;
++extern atomic_unchecked_t cm_rejects;
++extern atomic_unchecked_t mod_qp_timouts;
++extern atomic_unchecked_t qps_created;
++extern atomic_unchecked_t qps_destroyed;
++extern atomic_unchecked_t sw_qps_destroyed;
+ extern u32 mh_detected;
+ extern u32 mh_pauses_sent;
+ extern u32 cm_packets_sent;
+@@ -194,14 +194,14 @@ extern u32 cm_packets_created;
+ extern u32 cm_packets_received;
+ extern u32 cm_packets_dropped;
+ extern u32 cm_packets_retrans;
+-extern atomic_t cm_listens_created;
+-extern atomic_t cm_listens_destroyed;
++extern atomic_unchecked_t cm_listens_created;
++extern atomic_unchecked_t cm_listens_destroyed;
+ extern u32 cm_backlog_drops;
+-extern atomic_t cm_loopbacks;
+-extern atomic_t cm_nodes_created;
+-extern atomic_t cm_nodes_destroyed;
+-extern atomic_t cm_accel_dropped_pkts;
+-extern atomic_t cm_resets_recvd;
++extern atomic_unchecked_t cm_loopbacks;
++extern atomic_unchecked_t cm_nodes_created;
++extern atomic_unchecked_t cm_nodes_destroyed;
++extern atomic_unchecked_t cm_accel_dropped_pkts;
++extern atomic_unchecked_t cm_resets_recvd;
+ 
+ extern u32 int_mod_timer_init;
+ extern u32 int_mod_cq_depth_256;
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.38.7/drivers/infiniband/hw/nes/nes_nic.c
+--- linux-2.6.38.7/drivers/infiniband/hw/nes/nes_nic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/nes/nes_nic.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1302,31 +1302,31 @@ static void nes_netdev_get_ethtool_stats
+ 	target_stat_values[++index] = mh_detected;
+ 	target_stat_values[++index] = mh_pauses_sent;
+ 	target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
+-	target_stat_values[++index] = atomic_read(&cm_connects);
+-	target_stat_values[++index] = atomic_read(&cm_accepts);
+-	target_stat_values[++index] = atomic_read(&cm_disconnects);
+-	target_stat_values[++index] = atomic_read(&cm_connecteds);
+-	target_stat_values[++index] = atomic_read(&cm_connect_reqs);
+-	target_stat_values[++index] = atomic_read(&cm_rejects);
+-	target_stat_values[++index] = atomic_read(&mod_qp_timouts);
+-	target_stat_values[++index] = atomic_read(&qps_created);
+-	target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
+-	target_stat_values[++index] = atomic_read(&qps_destroyed);
+-	target_stat_values[++index] = atomic_read(&cm_closes);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
++	target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
++	target_stat_values[++index] = atomic_read_unchecked(&qps_created);
++	target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
++	target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
+ 	target_stat_values[++index] = cm_packets_sent;
+ 	target_stat_values[++index] = cm_packets_bounced;
+ 	target_stat_values[++index] = cm_packets_created;
+ 	target_stat_values[++index] = cm_packets_received;
+ 	target_stat_values[++index] = cm_packets_dropped;
+ 	target_stat_values[++index] = cm_packets_retrans;
+-	target_stat_values[++index] = atomic_read(&cm_listens_created);
+-	target_stat_values[++index] = atomic_read(&cm_listens_destroyed);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_listens_created);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_listens_destroyed);
+ 	target_stat_values[++index] = cm_backlog_drops;
+-	target_stat_values[++index] = atomic_read(&cm_loopbacks);
+-	target_stat_values[++index] = atomic_read(&cm_nodes_created);
+-	target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
+-	target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
+-	target_stat_values[++index] = atomic_read(&cm_resets_recvd);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
++	target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
+ 	target_stat_values[++index] = nesadapter->free_4kpbl;
+ 	target_stat_values[++index] = nesadapter->free_256pbl;
+ 	target_stat_values[++index] = int_mod_timer_init;
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.38.7/drivers/infiniband/hw/nes/nes_verbs.c
+--- linux-2.6.38.7/drivers/infiniband/hw/nes/nes_verbs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/nes/nes_verbs.c	2011-04-28 19:57:25.000000000 -0400
+@@ -46,9 +46,9 @@
+ 
+ #include <rdma/ib_umem.h>
+ 
+-atomic_t mod_qp_timouts;
+-atomic_t qps_created;
+-atomic_t sw_qps_destroyed;
++atomic_unchecked_t mod_qp_timouts;
++atomic_unchecked_t qps_created;
++atomic_unchecked_t sw_qps_destroyed;
+ 
+ static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
+ 
+@@ -1141,7 +1141,7 @@ static struct ib_qp *nes_create_qp(struc
+ 	if (init_attr->create_flags)
+ 		return ERR_PTR(-EINVAL);
+ 
+-	atomic_inc(&qps_created);
++	atomic_inc_unchecked(&qps_created);
+ 	switch (init_attr->qp_type) {
+ 		case IB_QPT_RC:
+ 			if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
+@@ -1470,7 +1470,7 @@ static int nes_destroy_qp(struct ib_qp *
+ 	struct iw_cm_event cm_event;
+ 	int ret;
+ 
+-	atomic_inc(&sw_qps_destroyed);
++	atomic_inc_unchecked(&sw_qps_destroyed);
+ 	nesqp->destroyed = 1;
+ 
+ 	/* Blow away the connection if it exists. */
+diff -urNp linux-2.6.38.7/drivers/infiniband/hw/qib/qib.h linux-2.6.38.7/drivers/infiniband/hw/qib/qib.h
+--- linux-2.6.38.7/drivers/infiniband/hw/qib/qib.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/infiniband/hw/qib/qib.h	2011-04-28 19:34:15.000000000 -0400
 @@ -51,6 +51,7 @@
  #include <linux/completion.h>
  #include <linux/kref.h>
@@ -24911,76 +29024,91 @@ diff -urNp linux-2.6.38.2/drivers/infiniband/hw/qib/qib.h linux-2.6.38.2/drivers
  
  #include "qib_common.h"
  #include "qib_verbs.h"
-diff -urNp linux-2.6.38.2/drivers/input/keyboard/atkbd.c linux-2.6.38.2/drivers/input/keyboard/atkbd.c
---- linux-2.6.38.2/drivers/input/keyboard/atkbd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/keyboard/atkbd.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1250,7 +1250,7 @@ static struct serio_device_id atkbd_seri
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
+diff -urNp linux-2.6.38.7/drivers/input/gameport/gameport.c linux-2.6.38.7/drivers/input/gameport/gameport.c
+--- linux-2.6.38.7/drivers/input/gameport/gameport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/gameport/gameport.c	2011-04-28 19:57:25.000000000 -0400
+@@ -488,14 +488,14 @@ EXPORT_SYMBOL(gameport_set_phys);
+  */
+ static void gameport_init_port(struct gameport *gameport)
+ {
+-	static atomic_t gameport_no = ATOMIC_INIT(0);
++	static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
+ 
+ 	__module_get(THIS_MODULE);
+ 
+ 	mutex_init(&gameport->drv_mutex);
+ 	device_initialize(&gameport->dev);
+ 	dev_set_name(&gameport->dev, "gameport%lu",
+-			(unsigned long)atomic_inc_return(&gameport_no) - 1);
++			(unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
+ 	gameport->dev.bus = &gameport_bus;
+ 	gameport->dev.release = gameport_release_port;
+ 	if (gameport->parent)
+diff -urNp linux-2.6.38.7/drivers/input/input.c linux-2.6.38.7/drivers/input/input.c
+--- linux-2.6.38.7/drivers/input/input.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/input.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1820,7 +1820,7 @@ static void input_cleanse_bitmasks(struc
+  */
+ int input_register_device(struct input_dev *dev)
+ {
+-	static atomic_t input_no = ATOMIC_INIT(0);
++	static atomic_unchecked_t input_no = ATOMIC_INIT(0);
+ 	struct input_handler *handler;
+ 	const char *path;
+ 	int error;
+@@ -1853,7 +1853,7 @@ int input_register_device(struct input_d
+ 		dev->setkeycode_new = input_default_setkeycode;
  
- MODULE_DEVICE_TABLE(serio, atkbd_serio_ids);
-diff -urNp linux-2.6.38.2/drivers/input/mouse/lifebook.c linux-2.6.38.2/drivers/input/mouse/lifebook.c
---- linux-2.6.38.2/drivers/input/mouse/lifebook.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/mouse/lifebook.c	2011-03-21 18:31:35.000000000 -0400
-@@ -123,7 +123,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "LifeBook B142"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL}
- };
+ 	dev_set_name(&dev->dev, "input%ld",
+-		     (unsigned long) atomic_inc_return(&input_no) - 1);
++		     (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
  
- void __init lifebook_module_init(void)
-diff -urNp linux-2.6.38.2/drivers/input/mouse/psmouse-base.c linux-2.6.38.2/drivers/input/mouse/psmouse-base.c
---- linux-2.6.38.2/drivers/input/mouse/psmouse-base.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/mouse/psmouse-base.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1462,7 +1462,7 @@ static struct serio_device_id psmouse_se
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
+ 	error = device_add(&dev->dev);
+ 	if (error)
+diff -urNp linux-2.6.38.7/drivers/input/joystick/sidewinder.c linux-2.6.38.7/drivers/input/joystick/sidewinder.c
+--- linux-2.6.38.7/drivers/input/joystick/sidewinder.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/joystick/sidewinder.c	2011-05-18 20:23:44.000000000 -0400
+@@ -30,6 +30,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ #include <linux/init.h>
+ #include <linux/input.h>
+ #include <linux/gameport.h>
+@@ -428,6 +429,8 @@ static int sw_read(struct sw *sw)
+ 	unsigned char buf[SW_LENGTH];
+ 	int i;
  
- MODULE_DEVICE_TABLE(serio, psmouse_serio_ids);
-diff -urNp linux-2.6.38.2/drivers/input/mouse/synaptics.c linux-2.6.38.2/drivers/input/mouse/synaptics.c
---- linux-2.6.38.2/drivers/input/mouse/synaptics.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/mouse/synaptics.c	2011-03-21 18:31:35.000000000 -0400
-@@ -559,7 +559,7 @@ static void synaptics_process_packet(str
- 				break;
- 			case 2:
- 				if (SYN_MODEL_PEN(priv->model_id))
--					;   /* Nothing, treat a pen as a single finger */
-+					break;   /* Nothing, treat a pen as a single finger */
- 				break;
- 			case 4 ... 15:
- 				if (SYN_CAP_PALMDETECT(priv->capabilities))
-@@ -825,7 +825,6 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_SYS_VENDOR, "TOSHIBA"),
- 			DMI_MATCH(DMI_PRODUCT_NAME, "PORTEGE M300"),
- 		},
--
- 	},
- 	{
- 		/* Toshiba Portege M300 */
-@@ -834,9 +833,8 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Portable PC"),
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Version 1.0"),
- 		},
--
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- #endif
- };
++	pax_track_stack();
++
+ 	i = sw_read_packet(sw->gameport, buf, sw->length, 0);
+ 
+ 	if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) {		/* Broken packet, try to fix */
+diff -urNp linux-2.6.38.7/drivers/input/joystick/xpad.c linux-2.6.38.7/drivers/input/joystick/xpad.c
+--- linux-2.6.38.7/drivers/input/joystick/xpad.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/joystick/xpad.c	2011-04-28 19:57:25.000000000 -0400
+@@ -689,7 +689,7 @@ static void xpad_led_set(struct led_clas
+ 
+ static int xpad_led_probe(struct usb_xpad *xpad)
+ {
+-	static atomic_t led_seq	= ATOMIC_INIT(0);
++	static atomic_unchecked_t led_seq	= ATOMIC_INIT(0);
+ 	long led_no;
+ 	struct xpad_led *led;
+ 	struct led_classdev *led_cdev;
+@@ -702,7 +702,7 @@ static int xpad_led_probe(struct usb_xpa
+ 	if (!led)
+ 		return -ENOMEM;
+ 
+-	led_no = (long)atomic_inc_return(&led_seq) - 1;
++	led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
  
-diff -urNp linux-2.6.38.2/drivers/input/mousedev.c linux-2.6.38.2/drivers/input/mousedev.c
---- linux-2.6.38.2/drivers/input/mousedev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/mousedev.c	2011-03-21 18:31:35.000000000 -0400
+ 	snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
+ 	led->xpad = xpad;
+diff -urNp linux-2.6.38.7/drivers/input/mousedev.c linux-2.6.38.7/drivers/input/mousedev.c
+--- linux-2.6.38.7/drivers/input/mousedev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/mousedev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -764,7 +764,7 @@ static ssize_t mousedev_read(struct file
  
  	spin_unlock_irq(&client->packet_lock);
@@ -24990,87 +29118,70 @@ diff -urNp linux-2.6.38.2/drivers/input/mousedev.c linux-2.6.38.2/drivers/input/
  		return -EFAULT;
  
  	return count;
-@@ -1067,7 +1067,7 @@ static struct input_handler mousedev_han
- 
- #ifdef CONFIG_INPUT_MOUSEDEV_PSAUX
- static struct miscdevice psaux_mouse = {
--	PSMOUSE_MINOR, "psaux", &mousedev_fops
-+	PSMOUSE_MINOR, "psaux", &mousedev_fops, {NULL, NULL}, NULL, NULL
- };
- static int psaux_registered;
- #endif
-diff -urNp linux-2.6.38.2/drivers/input/serio/i8042-x86ia64io.h linux-2.6.38.2/drivers/input/serio/i8042-x86ia64io.h
---- linux-2.6.38.2/drivers/input/serio/i8042-x86ia64io.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/serio/i8042-x86ia64io.h	2011-03-21 18:31:35.000000000 -0400
-@@ -183,7 +183,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_VERSION, "Rev 1"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- /*
-@@ -431,7 +431,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro V13"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_reset_table[] = {
-@@ -505,7 +505,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "Vostro 1720"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #ifdef CONFIG_PNP
-@@ -524,7 +524,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- static const struct dmi_system_id __initconst i8042_dmi_laptop_table[] = {
-@@ -548,7 +548,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_CHASSIS_TYPE, "14"), /* Sub-Notebook */
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- #endif
- 
-@@ -640,7 +640,7 @@ static const struct dmi_system_id __init
- 			DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 4280"),
- 		},
- 	},
--	{ }
-+	{ NULL, NULL, {DMI_MATCH(DMI_NONE, {0})}, NULL }
- };
- 
- #endif /* CONFIG_X86 */
-diff -urNp linux-2.6.38.2/drivers/input/serio/serio_raw.c linux-2.6.38.2/drivers/input/serio/serio_raw.c
---- linux-2.6.38.2/drivers/input/serio/serio_raw.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/input/serio/serio_raw.c	2011-03-21 18:31:35.000000000 -0400
-@@ -376,7 +376,7 @@ static struct serio_device_id serio_raw_
- 		.id	= SERIO_ANY,
- 		.extra	= SERIO_ANY,
- 	},
--	{ 0 }
-+	{ 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(serio, serio_raw_serio_ids);
-diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/common.c linux-2.6.38.2/drivers/isdn/gigaset/common.c
---- linux-2.6.38.2/drivers/isdn/gigaset/common.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/isdn/gigaset/common.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/input/serio/serio.c linux-2.6.38.7/drivers/input/serio/serio.c
+--- linux-2.6.38.7/drivers/input/serio/serio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/input/serio/serio.c	2011-04-28 19:57:25.000000000 -0400
+@@ -497,7 +497,7 @@ static void serio_release_port(struct de
+  */
+ static void serio_init_port(struct serio *serio)
+ {
+-	static atomic_t serio_no = ATOMIC_INIT(0);
++	static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
+ 
+ 	__module_get(THIS_MODULE);
+ 
+@@ -508,7 +508,7 @@ static void serio_init_port(struct serio
+ 	mutex_init(&serio->drv_mutex);
+ 	device_initialize(&serio->dev);
+ 	dev_set_name(&serio->dev, "serio%ld",
+-			(long)atomic_inc_return(&serio_no) - 1);
++			(long)atomic_inc_return_unchecked(&serio_no) - 1);
+ 	serio->dev.bus = &serio_bus;
+ 	serio->dev.release = serio_release_port;
+ 	serio->dev.groups = serio_device_attr_groups;
+diff -urNp linux-2.6.38.7/drivers/isdn/capi/capi.c linux-2.6.38.7/drivers/isdn/capi/capi.c
+--- linux-2.6.38.7/drivers/isdn/capi/capi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/capi/capi.c	2011-04-28 19:57:25.000000000 -0400
+@@ -89,8 +89,8 @@ struct capiminor {
+ 
+ 	struct capi20_appl	*ap;
+ 	u32			ncci;
+-	atomic_t		datahandle;
+-	atomic_t		msgid;
++	atomic_unchecked_t	datahandle;
++	atomic_unchecked_t	msgid;
+ 
+ 	struct tty_port port;
+ 	int                ttyinstop;
+@@ -414,7 +414,7 @@ gen_data_b3_resp_for(struct capiminor *m
+ 		capimsg_setu16(s, 2, mp->ap->applid);
+ 		capimsg_setu8 (s, 4, CAPI_DATA_B3);
+ 		capimsg_setu8 (s, 5, CAPI_RESP);
+-		capimsg_setu16(s, 6, atomic_inc_return(&mp->msgid));
++		capimsg_setu16(s, 6, atomic_inc_return_unchecked(&mp->msgid));
+ 		capimsg_setu32(s, 8, mp->ncci);
+ 		capimsg_setu16(s, 12, datahandle);
+ 	}
+@@ -547,14 +547,14 @@ static void handle_minor_send(struct cap
+ 		mp->outbytes -= len;
+ 		spin_unlock_bh(&mp->outlock);
+ 
+-		datahandle = atomic_inc_return(&mp->datahandle);
++		datahandle = atomic_inc_return_unchecked(&mp->datahandle);
+ 		skb_push(skb, CAPI_DATA_B3_REQ_LEN);
+ 		memset(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
+ 		capimsg_setu16(skb->data, 0, CAPI_DATA_B3_REQ_LEN);
+ 		capimsg_setu16(skb->data, 2, mp->ap->applid);
+ 		capimsg_setu8 (skb->data, 4, CAPI_DATA_B3);
+ 		capimsg_setu8 (skb->data, 5, CAPI_REQ);
+-		capimsg_setu16(skb->data, 6, atomic_inc_return(&mp->msgid));
++		capimsg_setu16(skb->data, 6, atomic_inc_return_unchecked(&mp->msgid));
+ 		capimsg_setu32(skb->data, 8, mp->ncci);	/* NCCI */
+ 		capimsg_setu32(skb->data, 12, (u32)(long)skb->data);/* Data32 */
+ 		capimsg_setu16(skb->data, 16, len);	/* Data length */
+diff -urNp linux-2.6.38.7/drivers/isdn/gigaset/common.c linux-2.6.38.7/drivers/isdn/gigaset/common.c
+--- linux-2.6.38.7/drivers/isdn/gigaset/common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/gigaset/common.c	2011-04-28 19:34:15.000000000 -0400
 @@ -723,7 +723,7 @@ struct cardstate *gigaset_initcs(struct 
  	cs->commands_pending = 0;
  	cs->cur_at_seq = 0;
@@ -25080,9 +29191,9 @@ diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/common.c linux-2.6.38.2/drivers/i
  	cs->dev = NULL;
  	cs->tty = NULL;
  	cs->tty_dev = NULL;
-diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/gigaset.h linux-2.6.38.2/drivers/isdn/gigaset/gigaset.h
---- linux-2.6.38.2/drivers/isdn/gigaset/gigaset.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/isdn/gigaset/gigaset.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/isdn/gigaset/gigaset.h linux-2.6.38.7/drivers/isdn/gigaset/gigaset.h
+--- linux-2.6.38.7/drivers/isdn/gigaset/gigaset.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/gigaset/gigaset.h	2011-04-28 19:34:15.000000000 -0400
 @@ -35,6 +35,7 @@
  #include <linux/tty_driver.h>
  #include <linux/list.h>
@@ -25100,9 +29211,9 @@ diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/gigaset.h linux-2.6.38.2/drivers/
  	struct tty_struct *tty;
  	struct tasklet_struct if_wake_tasklet;
  	unsigned control_state;
-diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/interface.c linux-2.6.38.2/drivers/isdn/gigaset/interface.c
---- linux-2.6.38.2/drivers/isdn/gigaset/interface.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/isdn/gigaset/interface.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/isdn/gigaset/interface.c linux-2.6.38.7/drivers/isdn/gigaset/interface.c
+--- linux-2.6.38.7/drivers/isdn/gigaset/interface.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/gigaset/interface.c	2011-04-28 19:34:15.000000000 -0400
 @@ -160,9 +160,7 @@ static int if_open(struct tty_struct *tt
  		return -ERESTARTSYS;
  	tty->driver_data = cs;
@@ -25190,9 +29301,9 @@ diff -urNp linux-2.6.38.2/drivers/isdn/gigaset/interface.c linux-2.6.38.2/driver
  		dev_warn(cs->dev, "%s: device not opened\n", __func__);
  		goto out;
  	}
-diff -urNp linux-2.6.38.2/drivers/isdn/hardware/avm/b1.c linux-2.6.38.2/drivers/isdn/hardware/avm/b1.c
---- linux-2.6.38.2/drivers/isdn/hardware/avm/b1.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/isdn/hardware/avm/b1.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/avm/b1.c linux-2.6.38.7/drivers/isdn/hardware/avm/b1.c
+--- linux-2.6.38.7/drivers/isdn/hardware/avm/b1.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/avm/b1.c	2011-04-28 19:34:15.000000000 -0400
 @@ -176,7 +176,7 @@ int b1_load_t4file(avmcard *card, capilo
  	}
  	if (left) {
@@ -25211,9 +29322,131 @@ diff -urNp linux-2.6.38.2/drivers/isdn/hardware/avm/b1.c linux-2.6.38.2/drivers/
  				return -EFAULT;
  		} else {
  			memcpy(buf, dp, left);
-diff -urNp linux-2.6.38.2/drivers/isdn/icn/icn.c linux-2.6.38.2/drivers/isdn/icn/icn.c
---- linux-2.6.38.2/drivers/isdn/icn/icn.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/isdn/icn/icn.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.38.7/drivers/isdn/hardware/eicon/capidtmf.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/capidtmf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/capidtmf.c	2011-05-16 21:47:08.000000000 -0400
+@@ -498,6 +498,7 @@ void capidtmf_recv_block (t_capidtmf_sta
+   byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
+     short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
+ 
++  pax_track_stack();
+ 
+   if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
+   {
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.38.7/drivers/isdn/hardware/eicon/capifunc.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/capifunc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/capifunc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1055,6 +1055,8 @@ static int divacapi_connect_didd(void)
+ 	IDI_SYNC_REQ req;
+ 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+ 
++	pax_track_stack();
++
+ 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+ 
+ 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.38.7/drivers/isdn/hardware/eicon/diddfunc.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/diddfunc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/diddfunc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -54,6 +54,8 @@ static int DIVA_INIT_FUNCTION connect_di
+ 	IDI_SYNC_REQ req;
+ 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+ 
++	pax_track_stack();
++
+ 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+ 
+ 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.38.7/drivers/isdn/hardware/eicon/divasfunc.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/divasfunc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/divasfunc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -161,6 +161,8 @@ static int DIVA_INIT_FUNCTION connect_di
+ 	IDI_SYNC_REQ req;
+ 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+ 
++	pax_track_stack();
++
+ 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+ 
+ 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.38.7/drivers/isdn/hardware/eicon/idifunc.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/idifunc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/idifunc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -188,6 +188,8 @@ static int DIVA_INIT_FUNCTION connect_di
+ 	IDI_SYNC_REQ req;
+ 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+ 
++	pax_track_stack();
++
+ 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+ 
+ 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/message.c linux-2.6.38.7/drivers/isdn/hardware/eicon/message.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/message.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/message.c	2011-05-16 21:47:08.000000000 -0400
+@@ -4889,6 +4889,8 @@ static void sig_ind(PLCI *plci)
+   dword d;
+   word w;
+ 
++  pax_track_stack();
++
+   a = plci->adapter;
+   Id = ((word)plci->Id<<8)|a->Id;
+   PUT_WORD(&SS_Ind[4],0x0000);
+@@ -7484,6 +7486,8 @@ static word add_b1(PLCI *plci, API_PARSE
+   word j, n, w;
+   dword d;
+ 
++  pax_track_stack();
++
+ 
+   for(i=0;i<8;i++) bp_parms[i].length = 0;
+   for(i=0;i<2;i++) global_config[i].length = 0;
+@@ -7958,6 +7962,8 @@ static word add_b23(PLCI *plci, API_PARS
+   const byte llc3[] = {4,3,2,2,6,6,0};
+   const byte header[] = {0,2,3,3,0,0,0};
+ 
++  pax_track_stack();
++
+   for(i=0;i<8;i++) bp_parms[i].length = 0;
+   for(i=0;i<6;i++) b2_config_parms[i].length = 0;
+   for(i=0;i<5;i++) b3_config_parms[i].length = 0;
+@@ -14760,6 +14766,8 @@ static void group_optimization(DIVA_CAPI
+   word appl_number_group_type[MAX_APPL];
+   PLCI   *auxplci;
+ 
++  pax_track_stack();
++
+   set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
+ 
+   if(!a->group_optimization_enabled)
+diff -urNp linux-2.6.38.7/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.38.7/drivers/isdn/hardware/eicon/mntfunc.c
+--- linux-2.6.38.7/drivers/isdn/hardware/eicon/mntfunc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/hardware/eicon/mntfunc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -79,6 +79,8 @@ static int DIVA_INIT_FUNCTION connect_di
+ 	IDI_SYNC_REQ req;
+ 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
+ 
++	pax_track_stack();
++
+ 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
+ 
+ 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
+diff -urNp linux-2.6.38.7/drivers/isdn/i4l/isdn_common.c linux-2.6.38.7/drivers/isdn/i4l/isdn_common.c
+--- linux-2.6.38.7/drivers/isdn/i4l/isdn_common.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/i4l/isdn_common.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1292,6 +1292,8 @@ isdn_ioctl(struct file *file, uint cmd, 
+ 	} iocpar;
+ 	void __user *argp = (void __user *)arg;
+ 
++	pax_track_stack();
++
+ #define name  iocpar.name
+ #define bname iocpar.bname
+ #define iocts iocpar.iocts
+diff -urNp linux-2.6.38.7/drivers/isdn/icn/icn.c linux-2.6.38.7/drivers/isdn/icn/icn.c
+--- linux-2.6.38.7/drivers/isdn/icn/icn.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/isdn/icn/icn.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1045,7 +1045,7 @@ icn_writecmd(const u_char * buf, int len
  		if (count > len)
  			count = len;
@@ -25223,86 +29456,9 @@ diff -urNp linux-2.6.38.2/drivers/isdn/icn/icn.c linux-2.6.38.2/drivers/isdn/icn
  				return -EFAULT;
  		} else
  			memcpy(msg, buf, count);
-diff -urNp linux-2.6.38.2/drivers/leds/leds-lp5521.c linux-2.6.38.2/drivers/leds/leds-lp5521.c
---- linux-2.6.38.2/drivers/leds/leds-lp5521.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/leds/leds-lp5521.c	2011-03-21 18:31:35.000000000 -0400
-@@ -534,7 +534,7 @@ static ssize_t lp5521_selftest(struct de
- }
- 
- /* led class device attributes */
--static DEVICE_ATTR(led_current, S_IRUGO | S_IWUGO, show_current, store_current);
-+static DEVICE_ATTR(led_current, S_IRUGO | S_IWUSR, show_current, store_current);
- static DEVICE_ATTR(max_current, S_IRUGO , show_max_current, NULL);
- 
- static struct attribute *lp5521_led_attributes[] = {
-@@ -548,15 +548,15 @@ static struct attribute_group lp5521_led
- };
- 
- /* device attributes */
--static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUSR,
- 		   show_engine1_mode, store_engine1_mode);
--static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUSR,
- 		   show_engine2_mode, store_engine2_mode);
--static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUSR,
- 		   show_engine3_mode, store_engine3_mode);
--static DEVICE_ATTR(engine1_load, S_IWUGO, NULL, store_engine1_load);
--static DEVICE_ATTR(engine2_load, S_IWUGO, NULL, store_engine2_load);
--static DEVICE_ATTR(engine3_load, S_IWUGO, NULL, store_engine3_load);
-+static DEVICE_ATTR(engine1_load, S_IWUSR, NULL, store_engine1_load);
-+static DEVICE_ATTR(engine2_load, S_IWUSR, NULL, store_engine2_load);
-+static DEVICE_ATTR(engine3_load, S_IWUSR, NULL, store_engine3_load);
- static DEVICE_ATTR(selftest, S_IRUGO, lp5521_selftest, NULL);
- 
- static struct attribute *lp5521_attributes[] = {
-diff -urNp linux-2.6.38.2/drivers/leds/leds-lp5523.c linux-2.6.38.2/drivers/leds/leds-lp5523.c
---- linux-2.6.38.2/drivers/leds/leds-lp5523.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/leds/leds-lp5523.c	2011-03-21 18:31:35.000000000 -0400
-@@ -713,7 +713,7 @@ static ssize_t store_current(struct devi
- }
- 
- /* led class device attributes */
--static DEVICE_ATTR(led_current, S_IRUGO | S_IWUGO, show_current, store_current);
-+static DEVICE_ATTR(led_current, S_IRUGO | S_IWUSR, show_current, store_current);
- static DEVICE_ATTR(max_current, S_IRUGO , show_max_current, NULL);
- 
- static struct attribute *lp5523_led_attributes[] = {
-@@ -727,21 +727,21 @@ static struct attribute_group lp5523_led
- };
- 
- /* device attributes */
--static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine1_mode, S_IRUGO | S_IWUSR,
- 		   show_engine1_mode, store_engine1_mode);
--static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine2_mode, S_IRUGO | S_IWUSR,
- 		   show_engine2_mode, store_engine2_mode);
--static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine3_mode, S_IRUGO | S_IWUSR,
- 		   show_engine3_mode, store_engine3_mode);
--static DEVICE_ATTR(engine1_leds, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine1_leds, S_IRUGO | S_IWUSR,
- 		   show_engine1_leds, store_engine1_leds);
--static DEVICE_ATTR(engine2_leds, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine2_leds, S_IRUGO | S_IWUSR,
- 		   show_engine2_leds, store_engine2_leds);
--static DEVICE_ATTR(engine3_leds, S_IRUGO | S_IWUGO,
-+static DEVICE_ATTR(engine3_leds, S_IRUGO | S_IWUSR,
- 		   show_engine3_leds, store_engine3_leds);
--static DEVICE_ATTR(engine1_load, S_IWUGO, NULL, store_engine1_load);
--static DEVICE_ATTR(engine2_load, S_IWUGO, NULL, store_engine2_load);
--static DEVICE_ATTR(engine3_load, S_IWUGO, NULL, store_engine3_load);
-+static DEVICE_ATTR(engine1_load, S_IWUSR, NULL, store_engine1_load);
-+static DEVICE_ATTR(engine2_load, S_IWUSR, NULL, store_engine2_load);
-+static DEVICE_ATTR(engine3_load, S_IWUSR, NULL, store_engine3_load);
- static DEVICE_ATTR(selftest, S_IRUGO, lp5523_selftest, NULL);
- 
- static struct attribute *lp5523_attributes[] = {
-diff -urNp linux-2.6.38.2/drivers/lguest/core.c linux-2.6.38.2/drivers/lguest/core.c
---- linux-2.6.38.2/drivers/lguest/core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/lguest/core.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/lguest/core.c linux-2.6.38.7/drivers/lguest/core.c
+--- linux-2.6.38.7/drivers/lguest/core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/lguest/core.c	2011-04-28 19:34:15.000000000 -0400
 @@ -92,9 +92,17 @@ static __init int map_switcher(void)
  	 * it's worked so far.  The end address needs +1 because __get_vm_area
  	 * allocates an extra guard page, so we need space for that.
@@ -25330,9 +29486,9 @@ diff -urNp linux-2.6.38.2/drivers/lguest/core.c linux-2.6.38.2/drivers/lguest/co
  	       end_switcher_text - start_switcher_text);
  
  	printk(KERN_INFO "lguest: mapped switcher at %p\n",
-diff -urNp linux-2.6.38.2/drivers/lguest/x86/core.c linux-2.6.38.2/drivers/lguest/x86/core.c
---- linux-2.6.38.2/drivers/lguest/x86/core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/lguest/x86/core.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/lguest/x86/core.c linux-2.6.38.7/drivers/lguest/x86/core.c
+--- linux-2.6.38.7/drivers/lguest/x86/core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/lguest/x86/core.c	2011-04-28 19:34:15.000000000 -0400
 @@ -59,7 +59,7 @@ static struct {
  /* Offset from where switcher.S was compiled to where we've copied it */
  static unsigned long switcher_offset(void)
@@ -25374,9 +29530,9 @@ diff -urNp linux-2.6.38.2/drivers/lguest/x86/core.c linux-2.6.38.2/drivers/lgues
  	lguest_entry.segment = LGUEST_CS;
  
  	/*
-diff -urNp linux-2.6.38.2/drivers/lguest/x86/switcher_32.S linux-2.6.38.2/drivers/lguest/x86/switcher_32.S
---- linux-2.6.38.2/drivers/lguest/x86/switcher_32.S	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/lguest/x86/switcher_32.S	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/lguest/x86/switcher_32.S linux-2.6.38.7/drivers/lguest/x86/switcher_32.S
+--- linux-2.6.38.7/drivers/lguest/x86/switcher_32.S	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/lguest/x86/switcher_32.S	2011-04-28 19:34:15.000000000 -0400
 @@ -87,6 +87,7 @@
  #include <asm/page.h>
  #include <asm/segment.h>
@@ -25435,21 +29591,66 @@ diff -urNp linux-2.6.38.2/drivers/lguest/x86/switcher_32.S linux-2.6.38.2/driver
  
  // Every interrupt can come to us here
  // But we must truly tell each apart.
-diff -urNp linux-2.6.38.2/drivers/md/bitmap.c linux-2.6.38.2/drivers/md/bitmap.c
---- linux-2.6.38.2/drivers/md/bitmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/md/bitmap.c	2011-03-21 18:31:35.000000000 -0400
-@@ -55,7 +55,7 @@
- #  if DEBUG > 0
- #    define PRINTK(x...) printk(KERN_DEBUG x)
- #  else
--#    define PRINTK(x...)
-+#    define PRINTK(x...) do {} while (0)
- #  endif
- #endif
+diff -urNp linux-2.6.38.7/drivers/md/dm.c linux-2.6.38.7/drivers/md/dm.c
+--- linux-2.6.38.7/drivers/md/dm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/dm.c	2011-04-28 19:57:25.000000000 -0400
+@@ -162,9 +162,9 @@ struct mapped_device {
+ 	/*
+ 	 * Event handling.
+ 	 */
+-	atomic_t event_nr;
++	atomic_unchecked_t event_nr;
+ 	wait_queue_head_t eventq;
+-	atomic_t uevent_seq;
++	atomic_unchecked_t uevent_seq;
+ 	struct list_head uevent_list;
+ 	spinlock_t uevent_lock; /* Protect access to uevent_list */
+ 
+@@ -1855,8 +1855,8 @@ static struct mapped_device *alloc_dev(i
+ 	rwlock_init(&md->map_lock);
+ 	atomic_set(&md->holders, 1);
+ 	atomic_set(&md->open_count, 0);
+-	atomic_set(&md->event_nr, 0);
+-	atomic_set(&md->uevent_seq, 0);
++	atomic_set_unchecked(&md->event_nr, 0);
++	atomic_set_unchecked(&md->uevent_seq, 0);
+ 	INIT_LIST_HEAD(&md->uevent_list);
+ 	spin_lock_init(&md->uevent_lock);
+ 
+@@ -1990,7 +1990,7 @@ static void event_callback(void *context
+ 
+ 	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
+ 
+-	atomic_inc(&md->event_nr);
++	atomic_inc_unchecked(&md->event_nr);
+ 	wake_up(&md->eventq);
+ }
+ 
+@@ -2569,18 +2569,18 @@ int dm_kobject_uevent(struct mapped_devi
  
-diff -urNp linux-2.6.38.2/drivers/md/dm-ioctl.c linux-2.6.38.2/drivers/md/dm-ioctl.c
---- linux-2.6.38.2/drivers/md/dm-ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/md/dm-ioctl.c	2011-03-21 18:31:35.000000000 -0400
+ uint32_t dm_next_uevent_seq(struct mapped_device *md)
+ {
+-	return atomic_add_return(1, &md->uevent_seq);
++	return atomic_add_return_unchecked(1, &md->uevent_seq);
+ }
+ 
+ uint32_t dm_get_event_nr(struct mapped_device *md)
+ {
+-	return atomic_read(&md->event_nr);
++	return atomic_read_unchecked(&md->event_nr);
+ }
+ 
+ int dm_wait_event(struct mapped_device *md, int event_nr)
+ {
+ 	return wait_event_interruptible(md->eventq,
+-			(event_nr != atomic_read(&md->event_nr)));
++			(event_nr != atomic_read_unchecked(&md->event_nr)));
+ }
+ 
+ void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
+diff -urNp linux-2.6.38.7/drivers/md/dm-ioctl.c linux-2.6.38.7/drivers/md/dm-ioctl.c
+--- linux-2.6.38.7/drivers/md/dm-ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/dm-ioctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1541,7 +1541,7 @@ static int validate_params(uint cmd, str
  	    cmd == DM_LIST_VERSIONS_CMD)
  		return 0;
@@ -25459,9 +29660,125 @@ diff -urNp linux-2.6.38.2/drivers/md/dm-ioctl.c linux-2.6.38.2/drivers/md/dm-ioc
  		if (!*param->name) {
  			DMWARN("name not supplied when creating device");
  			return -EINVAL;
-diff -urNp linux-2.6.38.2/drivers/md/dm-table.c linux-2.6.38.2/drivers/md/dm-table.c
---- linux-2.6.38.2/drivers/md/dm-table.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/md/dm-table.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/md/dm-raid1.c linux-2.6.38.7/drivers/md/dm-raid1.c
+--- linux-2.6.38.7/drivers/md/dm-raid1.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/dm-raid1.c	2011-04-28 19:57:25.000000000 -0400
+@@ -42,7 +42,7 @@ enum dm_raid1_error {
+ 
+ struct mirror {
+ 	struct mirror_set *ms;
+-	atomic_t error_count;
++	atomic_unchecked_t error_count;
+ 	unsigned long error_type;
+ 	struct dm_dev *dev;
+ 	sector_t offset;
+@@ -187,7 +187,7 @@ static struct mirror *get_valid_mirror(s
+ 	struct mirror *m;
+ 
+ 	for (m = ms->mirror; m < ms->mirror + ms->nr_mirrors; m++)
+-		if (!atomic_read(&m->error_count))
++		if (!atomic_read_unchecked(&m->error_count))
+ 			return m;
+ 
+ 	return NULL;
+@@ -219,7 +219,7 @@ static void fail_mirror(struct mirror *m
+ 	 * simple way to tell if a device has encountered
+ 	 * errors.
+ 	 */
+-	atomic_inc(&m->error_count);
++	atomic_inc_unchecked(&m->error_count);
+ 
+ 	if (test_and_set_bit(error_type, &m->error_type))
+ 		return;
+@@ -410,7 +410,7 @@ static struct mirror *choose_mirror(stru
+ 	struct mirror *m = get_default_mirror(ms);
+ 
+ 	do {
+-		if (likely(!atomic_read(&m->error_count)))
++		if (likely(!atomic_read_unchecked(&m->error_count)))
+ 			return m;
+ 
+ 		if (m-- == ms->mirror)
+@@ -424,7 +424,7 @@ static int default_ok(struct mirror *m)
+ {
+ 	struct mirror *default_mirror = get_default_mirror(m->ms);
+ 
+-	return !atomic_read(&default_mirror->error_count);
++	return !atomic_read_unchecked(&default_mirror->error_count);
+ }
+ 
+ static int mirror_available(struct mirror_set *ms, struct bio *bio)
+@@ -561,7 +561,7 @@ static void do_reads(struct mirror_set *
+ 		 */
+ 		if (likely(region_in_sync(ms, region, 1)))
+ 			m = choose_mirror(ms, bio->bi_sector);
+-		else if (m && atomic_read(&m->error_count))
++		else if (m && atomic_read_unchecked(&m->error_count))
+ 			m = NULL;
+ 
+ 		if (likely(m))
+@@ -941,7 +941,7 @@ static int get_mirror(struct mirror_set 
+ 	}
+ 
+ 	ms->mirror[mirror].ms = ms;
+-	atomic_set(&(ms->mirror[mirror].error_count), 0);
++	atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
+ 	ms->mirror[mirror].error_type = 0;
+ 	ms->mirror[mirror].offset = offset;
+ 
+@@ -1349,7 +1349,7 @@ static void mirror_resume(struct dm_targ
+  */
+ static char device_status_char(struct mirror *m)
+ {
+-	if (!atomic_read(&(m->error_count)))
++	if (!atomic_read_unchecked(&(m->error_count)))
+ 		return 'A';
+ 
+ 	return (test_bit(DM_RAID1_FLUSH_ERROR, &(m->error_type))) ? 'F' :
+diff -urNp linux-2.6.38.7/drivers/md/dm-stripe.c linux-2.6.38.7/drivers/md/dm-stripe.c
+--- linux-2.6.38.7/drivers/md/dm-stripe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/dm-stripe.c	2011-04-28 19:57:25.000000000 -0400
+@@ -20,7 +20,7 @@ struct stripe {
+ 	struct dm_dev *dev;
+ 	sector_t physical_start;
+ 
+-	atomic_t error_count;
++	atomic_unchecked_t error_count;
+ };
+ 
+ struct stripe_c {
+@@ -192,7 +192,7 @@ static int stripe_ctr(struct dm_target *
+ 			kfree(sc);
+ 			return r;
+ 		}
+-		atomic_set(&(sc->stripe[i].error_count), 0);
++		atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
+ 	}
+ 
+ 	ti->private = sc;
+@@ -314,7 +314,7 @@ static int stripe_status(struct dm_targe
+ 		DMEMIT("%d ", sc->stripes);
+ 		for (i = 0; i < sc->stripes; i++)  {
+ 			DMEMIT("%s ", sc->stripe[i].dev->name);
+-			buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
++			buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
+ 				'D' : 'A';
+ 		}
+ 		buffer[i] = '\0';
+@@ -361,8 +361,8 @@ static int stripe_end_io(struct dm_targe
+ 	 */
+ 	for (i = 0; i < sc->stripes; i++)
+ 		if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
+-			atomic_inc(&(sc->stripe[i].error_count));
+-			if (atomic_read(&(sc->stripe[i].error_count)) <
++			atomic_inc_unchecked(&(sc->stripe[i].error_count));
++			if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
+ 			    DM_IO_ERROR_THRESHOLD)
+ 				schedule_work(&sc->trigger_event);
+ 		}
+diff -urNp linux-2.6.38.7/drivers/md/dm-table.c linux-2.6.38.7/drivers/md/dm-table.c
+--- linux-2.6.38.7/drivers/md/dm-table.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/dm-table.c	2011-04-28 19:34:15.000000000 -0400
 @@ -372,7 +372,7 @@ static int device_area_is_invalid(struct
  	if (!dev_size)
  		return 0;
@@ -25471,36 +29788,87 @@ diff -urNp linux-2.6.38.2/drivers/md/dm-table.c linux-2.6.38.2/drivers/md/dm-tab
  		DMWARN("%s: %s too small for target: "
  		       "start=%llu, len=%llu, dev_size=%llu",
  		       dm_device_name(ti->table->md), bdevname(bdev, b),
-diff -urNp linux-2.6.38.2/drivers/md/md.c linux-2.6.38.2/drivers/md/md.c
---- linux-2.6.38.2/drivers/md/md.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/md/md.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1889,7 +1889,7 @@ static int bind_rdev_to_array(mdk_rdev_t
- 
- 	ko = &part_to_dev(rdev->bdev->bd_part)->kobj;
- 	if (sysfs_create_link(&rdev->kobj, ko, "block"))
--		/* failure here is OK */;
-+		/* failure here is OK */{}
- 	rdev->sysfs_state = sysfs_get_dirent_safe(rdev->kobj.sd, "state");
- 
- 	list_add_rcu(&rdev->same_set, &mddev->disks);
-@@ -2499,7 +2499,7 @@ slot_store(mdk_rdev_t *rdev, const char 
- 			sysfs_notify_dirent_safe(rdev->sysfs_state);
- 		sprintf(nm, "rd%d", rdev->raid_disk);
- 		if (sysfs_create_link(&rdev->mddev->kobj, &rdev->kobj, nm))
--			/* failure here is OK */;
-+			/* failure here is OK */{}
- 		/* don't wakeup anyone, leave that to userspace. */
- 	} else {
- 		if (slot >= rdev->mddev->raid_disks &&
-@@ -4594,7 +4594,7 @@ int md_run(mddev_t *mddev)
- 			char nm[20];
- 			sprintf(nm, "rd%d", rdev->raid_disk);
- 			if (sysfs_create_link(&mddev->kobj, &rdev->kobj, nm))
--				/* failure here is OK */;
-+				/* failure here is OK */{}
- 		}
- 	
- 	set_bit(MD_RECOVERY_NEEDED, &mddev->recovery);
+diff -urNp linux-2.6.38.7/drivers/md/md.c linux-2.6.38.7/drivers/md/md.c
+--- linux-2.6.38.7/drivers/md/md.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/md.c	2011-04-28 19:57:25.000000000 -0400
+@@ -226,10 +226,10 @@ EXPORT_SYMBOL_GPL(bio_clone_mddev);
+  *  start build, activate spare
+  */
+ static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
+-static atomic_t md_event_count;
++static atomic_unchecked_t md_event_count;
+ void md_new_event(mddev_t *mddev)
+ {
+-	atomic_inc(&md_event_count);
++	atomic_inc_unchecked(&md_event_count);
+ 	wake_up(&md_event_waiters);
+ }
+ EXPORT_SYMBOL_GPL(md_new_event);
+@@ -239,7 +239,7 @@ EXPORT_SYMBOL_GPL(md_new_event);
+  */
+ static void md_new_event_inintr(mddev_t *mddev)
+ {
+-	atomic_inc(&md_event_count);
++	atomic_inc_unchecked(&md_event_count);
+ 	wake_up(&md_event_waiters);
+ }
+ 
+@@ -1443,7 +1443,7 @@ static int super_1_load(mdk_rdev_t *rdev
+ 
+ 	rdev->preferred_minor = 0xffff;
+ 	rdev->data_offset = le64_to_cpu(sb->data_offset);
+-	atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
++	atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
+ 
+ 	rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
+ 	bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
+@@ -1621,7 +1621,7 @@ static void super_1_sync(mddev_t *mddev,
+ 	else
+ 		sb->resync_offset = cpu_to_le64(0);
+ 
+-	sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
++	sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
+ 
+ 	sb->raid_disks = cpu_to_le32(mddev->raid_disks);
+ 	sb->size = cpu_to_le64(mddev->dev_sectors);
+@@ -2403,7 +2403,7 @@ __ATTR(state, S_IRUGO|S_IWUSR, state_sho
+ static ssize_t
+ errors_show(mdk_rdev_t *rdev, char *page)
+ {
+-	return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
++	return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
+ }
+ 
+ static ssize_t
+@@ -2412,7 +2412,7 @@ errors_store(mdk_rdev_t *rdev, const cha
+ 	char *e;
+ 	unsigned long n = simple_strtoul(buf, &e, 10);
+ 	if (*buf && (*e == 0 || *e == '\n')) {
+-		atomic_set(&rdev->corrected_errors, n);
++		atomic_set_unchecked(&rdev->corrected_errors, n);
+ 		return len;
+ 	}
+ 	return -EINVAL;
+@@ -2768,8 +2768,8 @@ void md_rdev_init(mdk_rdev_t *rdev)
+ 	rdev->last_read_error.tv_sec  = 0;
+ 	rdev->last_read_error.tv_nsec = 0;
+ 	atomic_set(&rdev->nr_pending, 0);
+-	atomic_set(&rdev->read_errors, 0);
+-	atomic_set(&rdev->corrected_errors, 0);
++	atomic_set_unchecked(&rdev->read_errors, 0);
++	atomic_set_unchecked(&rdev->corrected_errors, 0);
+ 
+ 	INIT_LIST_HEAD(&rdev->same_set);
+ 	init_waitqueue_head(&rdev->blocked_wait);
+@@ -6373,7 +6373,7 @@ static int md_seq_show(struct seq_file *
+ 
+ 		spin_unlock(&pers_lock);
+ 		seq_printf(seq, "\n");
+-		mi->event = atomic_read(&md_event_count);
++		mi->event = atomic_read_unchecked(&md_event_count);
+ 		return 0;
+ 	}
+ 	if (v == (void*)2) {
 @@ -6462,7 +6462,7 @@ static int md_seq_show(struct seq_file *
  				chunk_kb ? "KB" : "B");
  			if (bitmap->file) {
@@ -25510,6 +29878,24 @@ diff -urNp linux-2.6.38.2/drivers/md/md.c linux-2.6.38.2/drivers/md/md.c
  			}
  
  			seq_printf(seq, "\n");
+@@ -6496,7 +6496,7 @@ static int md_seq_open(struct inode *ino
+ 	else {
+ 		struct seq_file *p = file->private_data;
+ 		p->private = mi;
+-		mi->event = atomic_read(&md_event_count);
++		mi->event = atomic_read_unchecked(&md_event_count);
+ 	}
+ 	return error;
+ }
+@@ -6512,7 +6512,7 @@ static unsigned int mdstat_poll(struct f
+ 	/* always allow read */
+ 	mask = POLLIN | POLLRDNORM;
+ 
+-	if (mi->event != atomic_read(&md_event_count))
++	if (mi->event != atomic_read_unchecked(&md_event_count))
+ 		mask |= POLLERR | POLLPRI;
+ 	return mask;
+ }
 @@ -6556,7 +6556,7 @@ static int is_mddev_idle(mddev_t *mddev,
  		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
  		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
@@ -25519,18 +29905,25 @@ diff -urNp linux-2.6.38.2/drivers/md/md.c linux-2.6.38.2/drivers/md/md.c
  		/* sync IO will cause sync_io to increase before the disk_stats
  		 * as sync_io is counted when a request starts, and
  		 * disk_stats is counted when it completes.
-@@ -7070,7 +7070,7 @@ static int remove_and_add_spares(mddev_t
- 					sprintf(nm, "rd%d", rdev->raid_disk);
- 					if (sysfs_create_link(&mddev->kobj,
- 							      &rdev->kobj, nm))
--						/* failure here is OK */;
-+						/* failure here is OK */{}
- 					spares++;
- 					md_new_event(mddev);
- 					set_bit(MD_CHANGE_DEVS, &mddev->flags);
-diff -urNp linux-2.6.38.2/drivers/md/md.h linux-2.6.38.2/drivers/md/md.h
---- linux-2.6.38.2/drivers/md/md.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/md/md.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/md/md.h linux-2.6.38.7/drivers/md/md.h
+--- linux-2.6.38.7/drivers/md/md.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/md.h	2011-04-28 19:57:25.000000000 -0400
+@@ -117,13 +117,13 @@ struct mdk_rdev_s
+ 					 * only maintained for arrays that
+ 					 * support hot removal
+ 					 */
+-	atomic_t	read_errors;	/* number of consecutive read errors that
++	atomic_unchecked_t	read_errors;	/* number of consecutive read errors that
+ 					 * we have tried to ignore.
+ 					 */
+ 	struct timespec last_read_error;	/* monotonic time since our
+ 						 * last read error
+ 						 */
+-	atomic_t	corrected_errors; /* number of corrected read errors,
++	atomic_unchecked_t	corrected_errors; /* number of corrected read errors,
+ 					   * for reporting to userspace and storing
+ 					   * in superblock.
+ 					   */
 @@ -360,7 +360,7 @@ static inline void rdev_dec_pending(mdk_
  
  static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
@@ -25540,9 +29933,164 @@ diff -urNp linux-2.6.38.2/drivers/md/md.h linux-2.6.38.2/drivers/md/md.h
  }
  
  struct mdk_personality
-diff -urNp linux-2.6.38.2/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.38.2/drivers/media/dvb/dvb-core/dvbdev.c
---- linux-2.6.38.2/drivers/media/dvb/dvb-core/dvbdev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/media/dvb/dvb-core/dvbdev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/md/raid10.c linux-2.6.38.7/drivers/md/raid10.c
+--- linux-2.6.38.7/drivers/md/raid10.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/raid10.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1258,7 +1258,7 @@ static void end_sync_read(struct bio *bi
+ 	if (test_bit(BIO_UPTODATE, &bio->bi_flags))
+ 		set_bit(R10BIO_Uptodate, &r10_bio->state);
+ 	else {
+-		atomic_add(r10_bio->sectors,
++		atomic_add_unchecked(r10_bio->sectors,
+ 			   &conf->mirrors[d].rdev->corrected_errors);
+ 		if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
+ 			md_error(r10_bio->mddev,
+@@ -1466,7 +1466,7 @@ static void check_decay_read_errors(mdde
+ {
+ 	struct timespec cur_time_mon;
+ 	unsigned long hours_since_last;
+-	unsigned int read_errors = atomic_read(&rdev->read_errors);
++	unsigned int read_errors = atomic_read_unchecked(&rdev->read_errors);
+ 
+ 	ktime_get_ts(&cur_time_mon);
+ 
+@@ -1488,9 +1488,9 @@ static void check_decay_read_errors(mdde
+ 	 * overflowing the shift of read_errors by hours_since_last.
+ 	 */
+ 	if (hours_since_last >= 8 * sizeof(read_errors))
+-		atomic_set(&rdev->read_errors, 0);
++		atomic_set_unchecked(&rdev->read_errors, 0);
+ 	else
+-		atomic_set(&rdev->read_errors, read_errors >> hours_since_last);
++		atomic_set_unchecked(&rdev->read_errors, read_errors >> hours_since_last);
+ }
+ 
+ /*
+@@ -1525,8 +1525,8 @@ static void fix_read_error(conf_t *conf,
+ 		}
+ 
+ 		check_decay_read_errors(mddev, rdev);
+-		atomic_inc(&rdev->read_errors);
+-		cur_read_error_count = atomic_read(&rdev->read_errors);
++		atomic_inc_unchecked(&rdev->read_errors);
++		cur_read_error_count = atomic_read_unchecked(&rdev->read_errors);
+ 		if (cur_read_error_count > max_read_errors) {
+ 			rcu_read_unlock();
+ 			printk(KERN_NOTICE
+@@ -1599,7 +1599,7 @@ static void fix_read_error(conf_t *conf,
+ 			    test_bit(In_sync, &rdev->flags)) {
+ 				atomic_inc(&rdev->nr_pending);
+ 				rcu_read_unlock();
+-				atomic_add(s, &rdev->corrected_errors);
++				atomic_add_unchecked(s, &rdev->corrected_errors);
+ 				if (sync_page_io(rdev,
+ 						 r10_bio->devs[sl].addr +
+ 						 sect,
+diff -urNp linux-2.6.38.7/drivers/md/raid1.c linux-2.6.38.7/drivers/md/raid1.c
+--- linux-2.6.38.7/drivers/md/raid1.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/raid1.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1392,7 +1392,7 @@ static void sync_request_write(mddev_t *
+ 					if (r1_bio->bios[d]->bi_end_io != end_sync_read)
+ 						continue;
+ 					rdev = conf->mirrors[d].rdev;
+-					atomic_add(s, &rdev->corrected_errors);
++					atomic_add_unchecked(s, &rdev->corrected_errors);
+ 					if (sync_page_io(rdev,
+ 							 sect,
+ 							 s<<9,
+@@ -1538,7 +1538,7 @@ static void fix_read_error(conf_t *conf,
+ 					/* Well, this device is dead */
+ 					md_error(mddev, rdev);
+ 				else {
+-					atomic_add(s, &rdev->corrected_errors);
++					atomic_add_unchecked(s, &rdev->corrected_errors);
+ 					printk(KERN_INFO
+ 					       "md/raid1:%s: read error corrected "
+ 					       "(%d sectors at %llu on %s)\n",
+diff -urNp linux-2.6.38.7/drivers/md/raid5.c linux-2.6.38.7/drivers/md/raid5.c
+--- linux-2.6.38.7/drivers/md/raid5.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/md/raid5.c	2011-05-16 21:47:08.000000000 -0400
+@@ -555,7 +555,7 @@ static void ops_run_io(struct stripe_hea
+ 			bi->bi_next = NULL;
+ 			if (rw == WRITE &&
+ 			    test_bit(R5_ReWrite, &sh->dev[i].flags))
+-				atomic_add(STRIPE_SECTORS,
++				atomic_add_unchecked(STRIPE_SECTORS,
+ 					&rdev->corrected_errors);
+ 			generic_make_request(bi);
+ 		} else {
+@@ -1602,15 +1602,15 @@ static void raid5_end_read_request(struc
+ 			clear_bit(R5_ReadError, &sh->dev[i].flags);
+ 			clear_bit(R5_ReWrite, &sh->dev[i].flags);
+ 		}
+-		if (atomic_read(&conf->disks[i].rdev->read_errors))
+-			atomic_set(&conf->disks[i].rdev->read_errors, 0);
++		if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
++			atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
+ 	} else {
+ 		const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
+ 		int retry = 0;
+ 		rdev = conf->disks[i].rdev;
+ 
+ 		clear_bit(R5_UPTODATE, &sh->dev[i].flags);
+-		atomic_inc(&rdev->read_errors);
++		atomic_inc_unchecked(&rdev->read_errors);
+ 		if (conf->mddev->degraded >= conf->max_degraded)
+ 			printk_rl(KERN_WARNING
+ 				  "md/raid:%s: read error not correctable "
+@@ -1628,7 +1628,7 @@ static void raid5_end_read_request(struc
+ 				  (unsigned long long)(sh->sector
+ 						       + rdev->data_offset),
+ 				  bdn);
+-		else if (atomic_read(&rdev->read_errors)
++		else if (atomic_read_unchecked(&rdev->read_errors)
+ 			 > conf->max_nr_stripes)
+ 			printk(KERN_WARNING
+ 			       "md/raid:%s: Too many read errors, failing device %s.\n",
+@@ -1953,6 +1953,7 @@ static sector_t compute_blocknr(struct s
+ 	sector_t r_sector;
+ 	struct stripe_head sh2;
+ 
++	pax_track_stack();
+ 
+ 	chunk_offset = sector_div(new_sector, sectors_per_chunk);
+ 	stripe = new_sector;
+diff -urNp linux-2.6.38.7/drivers/media/common/saa7146_hlp.c linux-2.6.38.7/drivers/media/common/saa7146_hlp.c
+--- linux-2.6.38.7/drivers/media/common/saa7146_hlp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/common/saa7146_hlp.c	2011-05-16 21:47:08.000000000 -0400
+@@ -353,6 +353,8 @@ static void calculate_clipping_registers
+ 
+ 	int x[32], y[32], w[32], h[32];
+ 
++	pax_track_stack();
++
+ 	/* clear out memory */
+ 	memset(&line_list[0],  0x00, sizeof(u32)*32);
+ 	memset(&pixel_list[0], 0x00, sizeof(u32)*32);
+diff -urNp linux-2.6.38.7/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.38.7/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+--- linux-2.6.38.7/drivers/media/dvb/dvb-core/dvb_ca_en50221.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/dvb-core/dvb_ca_en50221.c	2011-05-16 21:47:08.000000000 -0400
+@@ -590,6 +590,8 @@ static int dvb_ca_en50221_read_data(stru
+ 	u8 buf[HOST_LINK_BUF_SIZE];
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	dprintk("%s\n", __func__);
+ 
+ 	/* check if we have space for a link buf in the rx_buffer */
+@@ -1285,6 +1287,8 @@ static ssize_t dvb_ca_en50221_io_write(s
+ 	unsigned long timeout;
+ 	int written;
+ 
++	pax_track_stack();
++
+ 	dprintk("%s\n", __func__);
+ 
+ 	/* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
+diff -urNp linux-2.6.38.7/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.38.7/drivers/media/dvb/dvb-core/dvbdev.c
+--- linux-2.6.38.7/drivers/media/dvb/dvb-core/dvbdev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/dvb-core/dvbdev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -192,7 +192,7 @@ int dvb_register_device(struct dvb_adapt
  			const struct dvb_device *template, void *priv, int type)
  {
@@ -25552,9 +30100,65 @@ diff -urNp linux-2.6.38.2/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.38.2/dri
  	struct device *clsdev;
  	int minor;
  	int id;
-diff -urNp linux-2.6.38.2/drivers/media/radio/radio-cadet.c linux-2.6.38.2/drivers/media/radio/radio-cadet.c
---- linux-2.6.38.2/drivers/media/radio/radio-cadet.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/media/radio/radio-cadet.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.38.7/drivers/media/dvb/dvb-usb/dib0700_core.c
+--- linux-2.6.38.7/drivers/media/dvb/dvb-usb/dib0700_core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/dvb-usb/dib0700_core.c	2011-05-16 21:47:08.000000000 -0400
+@@ -366,6 +366,8 @@ int dib0700_download_firmware(struct usb
+ 
+ 	u8 buf[260];
+ 
++	pax_track_stack();
++
+ 	while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
+ 		deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",
+ 				hx.addr, hx.len, hx.chk);
+diff -urNp linux-2.6.38.7/drivers/media/dvb/dvb-usb/lmedm04.c linux-2.6.38.7/drivers/media/dvb/dvb-usb/lmedm04.c
+--- linux-2.6.38.7/drivers/media/dvb/dvb-usb/lmedm04.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/dvb-usb/lmedm04.c	2011-05-16 21:47:08.000000000 -0400
+@@ -611,6 +611,7 @@ static int lme2510_download_firmware(str
+ 	packet_size = 0x31;
+ 	len_in = 1;
+ 
++	pax_track_stack();
+ 
+ 	info("FRM Starting Firmware Download");
+ 
+@@ -666,6 +667,8 @@ static void lme_coldreset(struct usb_dev
+ 	int ret = 0, len_in;
+ 	u8 data[512] = {0};
+ 
++	pax_track_stack();
++
+ 	data[0] = 0x0a;
+ 	len_in = 1;
+ 	info("FRM Firmware Cold Reset");
+diff -urNp linux-2.6.38.7/drivers/media/dvb/frontends/mb86a16.c linux-2.6.38.7/drivers/media/dvb/frontends/mb86a16.c
+--- linux-2.6.38.7/drivers/media/dvb/frontends/mb86a16.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/frontends/mb86a16.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1060,6 +1060,8 @@ static int mb86a16_set_fe(struct mb86a16
+ 	int ret = -1;
+ 	int sync;
+ 
++	pax_track_stack();
++
+ 	dprintk(verbose, MB86A16_INFO, 1, "freq=%d Mhz, symbrt=%d Ksps", state->frequency, state->srate);
+ 
+ 	fcp = 3000;
+diff -urNp linux-2.6.38.7/drivers/media/dvb/frontends/or51211.c linux-2.6.38.7/drivers/media/dvb/frontends/or51211.c
+--- linux-2.6.38.7/drivers/media/dvb/frontends/or51211.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/dvb/frontends/or51211.c	2011-05-16 21:47:08.000000000 -0400
+@@ -113,6 +113,8 @@ static int or51211_load_firmware (struct
+ 	u8 tudata[585];
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	dprintk("Firmware is %zd bytes\n",fw->size);
+ 
+ 	/* Get eprom data */
+diff -urNp linux-2.6.38.7/drivers/media/radio/radio-cadet.c linux-2.6.38.7/drivers/media/radio/radio-cadet.c
+--- linux-2.6.38.7/drivers/media/radio/radio-cadet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/radio/radio-cadet.c	2011-04-28 19:34:15.000000000 -0400
 @@ -349,7 +349,7 @@ static ssize_t cadet_read(struct file *f
  		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
  	mutex_unlock(&dev->lock);
@@ -25564,9 +30168,9 @@ diff -urNp linux-2.6.38.2/drivers/media/radio/radio-cadet.c linux-2.6.38.2/drive
  		return -EFAULT;
  	return i;
  }
-diff -urNp linux-2.6.38.2/drivers/media/rc/ir-lirc-codec.c linux-2.6.38.2/drivers/media/rc/ir-lirc-codec.c
---- linux-2.6.38.2/drivers/media/rc/ir-lirc-codec.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/media/rc/ir-lirc-codec.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/media/rc/ir-lirc-codec.c linux-2.6.38.7/drivers/media/rc/ir-lirc-codec.c
+--- linux-2.6.38.7/drivers/media/rc/ir-lirc-codec.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/rc/ir-lirc-codec.c	2011-04-28 19:34:15.000000000 -0400
 @@ -277,7 +277,7 @@ static void ir_lirc_close(void *data)
  	return;
  }
@@ -25576,9 +30180,9 @@ diff -urNp linux-2.6.38.2/drivers/media/rc/ir-lirc-codec.c linux-2.6.38.2/driver
  	.owner		= THIS_MODULE,
  	.write		= ir_lirc_transmit_ir,
  	.unlocked_ioctl	= ir_lirc_ioctl,
-diff -urNp linux-2.6.38.2/drivers/media/rc/lirc_dev.c linux-2.6.38.2/drivers/media/rc/lirc_dev.c
---- linux-2.6.38.2/drivers/media/rc/lirc_dev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/media/rc/lirc_dev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/media/rc/lirc_dev.c linux-2.6.38.7/drivers/media/rc/lirc_dev.c
+--- linux-2.6.38.7/drivers/media/rc/lirc_dev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/rc/lirc_dev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -151,7 +151,7 @@ static int lirc_thread(void *irctl)
  }
  
@@ -25588,25 +30192,192 @@ diff -urNp linux-2.6.38.2/drivers/media/rc/lirc_dev.c linux-2.6.38.2/drivers/med
  	.owner		= THIS_MODULE,
  	.read		= lirc_dev_fop_read,
  	.write		= lirc_dev_fop_write,
-diff -urNp linux-2.6.38.2/drivers/media/video/sn9c102/sn9c102_core.c linux-2.6.38.2/drivers/media/video/sn9c102/sn9c102_core.c
---- linux-2.6.38.2/drivers/media/video/sn9c102/sn9c102_core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/media/video/sn9c102/sn9c102_core.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1430,9 +1430,9 @@ static DEVICE_ATTR(i2c_reg, S_IRUGO | S_
- 		   sn9c102_show_i2c_reg, sn9c102_store_i2c_reg);
- static DEVICE_ATTR(i2c_val, S_IRUGO | S_IWUSR,
- 		   sn9c102_show_i2c_val, sn9c102_store_i2c_val);
--static DEVICE_ATTR(green, S_IWUGO, NULL, sn9c102_store_green);
--static DEVICE_ATTR(blue, S_IWUGO, NULL, sn9c102_store_blue);
--static DEVICE_ATTR(red, S_IWUGO, NULL, sn9c102_store_red);
-+static DEVICE_ATTR(green, S_IWUSR, NULL, sn9c102_store_green);
-+static DEVICE_ATTR(blue, S_IWUSR, NULL, sn9c102_store_blue);
-+static DEVICE_ATTR(red, S_IWUSR, NULL, sn9c102_store_red);
- static DEVICE_ATTR(frame_header, S_IRUGO, sn9c102_show_frame_header, NULL);
- 
- 
-diff -urNp linux-2.6.38.2/drivers/message/fusion/mptbase.c linux-2.6.38.2/drivers/message/fusion/mptbase.c
---- linux-2.6.38.2/drivers/message/fusion/mptbase.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/message/fusion/mptbase.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/media/rc/rc-main.c linux-2.6.38.7/drivers/media/rc/rc-main.c
+--- linux-2.6.38.7/drivers/media/rc/rc-main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/rc/rc-main.c	2011-04-28 19:57:25.000000000 -0400
+@@ -994,7 +994,7 @@ EXPORT_SYMBOL_GPL(rc_free_device);
+ 
+ int rc_register_device(struct rc_dev *dev)
+ {
+-	static atomic_t devno = ATOMIC_INIT(0);
++	static atomic_unchecked_t devno = ATOMIC_INIT(0);
+ 	struct rc_map *rc_map;
+ 	const char *path;
+ 	int rc;
+@@ -1017,7 +1017,7 @@ int rc_register_device(struct rc_dev *de
+ 	if (dev->close)
+ 		dev->input_dev->close = ir_close;
+ 
+-	dev->devno = (unsigned long)(atomic_inc_return(&devno) - 1);
++	dev->devno = (unsigned long)(atomic_inc_return_unchecked(&devno) - 1);
+ 	dev_set_name(&dev->dev, "rc%ld", dev->devno);
+ 	dev_set_drvdata(&dev->dev, dev);
+ 	rc = device_add(&dev->dev);
+diff -urNp linux-2.6.38.7/drivers/media/video/cx18/cx18-driver.c linux-2.6.38.7/drivers/media/video/cx18/cx18-driver.c
+--- linux-2.6.38.7/drivers/media/video/cx18/cx18-driver.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/cx18/cx18-driver.c	2011-05-16 21:47:08.000000000 -0400
+@@ -60,7 +60,7 @@ static struct pci_device_id cx18_pci_tbl
+ 
+ MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
+ 
+-static atomic_t cx18_instance = ATOMIC_INIT(0);
++static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
+ 
+ /* Parameter declarations */
+ static int cardtype[CX18_MAX_CARDS];
+@@ -326,6 +326,8 @@ void cx18_read_eeprom(struct cx18 *cx, s
+ 	struct i2c_client c;
+ 	u8 eedata[256];
+ 
++	pax_track_stack();
++
+ 	memset(&c, 0, sizeof(c));
+ 	strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
+ 	c.adapter = &cx->i2c_adap[0];
+@@ -884,7 +886,7 @@ static int __devinit cx18_probe(struct p
+ 	struct cx18 *cx;
+ 
+ 	/* FIXME - module parameter arrays constrain max instances */
+-	i = atomic_inc_return(&cx18_instance) - 1;
++	i = atomic_inc_return_unchecked(&cx18_instance) - 1;
+ 	if (i >= CX18_MAX_CARDS) {
+ 		printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
+ 		       "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
+diff -urNp linux-2.6.38.7/drivers/media/video/cx23885/cx23885-input.c linux-2.6.38.7/drivers/media/video/cx23885/cx23885-input.c
+--- linux-2.6.38.7/drivers/media/video/cx23885/cx23885-input.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/cx23885/cx23885-input.c	2011-05-16 21:47:08.000000000 -0400
+@@ -53,6 +53,8 @@ static void cx23885_input_process_measur
+ 	bool handle = false;
+ 	struct ir_raw_event ir_core_event[64];
+ 
++	pax_track_stack();
++
+ 	do {
+ 		num = 0;
+ 		v4l2_subdev_call(dev->sd_ir, ir, rx_read, (u8 *) ir_core_event,
+diff -urNp linux-2.6.38.7/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.38.7/drivers/media/video/ivtv/ivtv-driver.c
+--- linux-2.6.38.7/drivers/media/video/ivtv/ivtv-driver.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/ivtv/ivtv-driver.c	2011-04-28 19:57:25.000000000 -0400
+@@ -80,7 +80,7 @@ static struct pci_device_id ivtv_pci_tbl
+ MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
+ 
+ /* ivtv instance counter */
+-static atomic_t ivtv_instance = ATOMIC_INIT(0);
++static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
+ 
+ /* Parameter declarations */
+ static int cardtype[IVTV_MAX_CARDS];
+diff -urNp linux-2.6.38.7/drivers/media/video/omap24xxcam.c linux-2.6.38.7/drivers/media/video/omap24xxcam.c
+--- linux-2.6.38.7/drivers/media/video/omap24xxcam.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/omap24xxcam.c	2011-04-28 19:57:25.000000000 -0400
+@@ -402,7 +402,7 @@ static void omap24xxcam_vbq_complete(str
+ 	spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
+ 
+ 	do_gettimeofday(&vb->ts);
+-	vb->field_count = atomic_add_return(2, &fh->field_count);
++	vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
+ 	if (csr & csr_error) {
+ 		vb->state = VIDEOBUF_ERROR;
+ 		if (!atomic_read(&fh->cam->in_reset)) {
+diff -urNp linux-2.6.38.7/drivers/media/video/omap24xxcam.h linux-2.6.38.7/drivers/media/video/omap24xxcam.h
+--- linux-2.6.38.7/drivers/media/video/omap24xxcam.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/omap24xxcam.h	2011-04-28 19:57:25.000000000 -0400
+@@ -533,7 +533,7 @@ struct omap24xxcam_fh {
+ 	spinlock_t vbq_lock; /* spinlock for the videobuf queue */
+ 	struct videobuf_queue vbq;
+ 	struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
+-	atomic_t field_count; /* field counter for videobuf_buffer */
++	atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
+ 	/* accessing cam here doesn't need serialisation: it's constant */
+ 	struct omap24xxcam_device *cam;
+ };
+diff -urNp linux-2.6.38.7/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.38.7/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
+--- linux-2.6.38.7/drivers/media/video/pvrusb2/pvrusb2-eeprom.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/pvrusb2/pvrusb2-eeprom.c	2011-05-16 21:47:08.000000000 -0400
+@@ -120,6 +120,8 @@ int pvr2_eeprom_analyze(struct pvr2_hdw 
+ 	u8 *eeprom;
+ 	struct tveeprom tvdata;
+ 
++	pax_track_stack();
++
+ 	memset(&tvdata,0,sizeof(tvdata));
+ 
+ 	eeprom = pvr2_eeprom_fetch(hdw);
+diff -urNp linux-2.6.38.7/drivers/media/video/saa7134/saa6752hs.c linux-2.6.38.7/drivers/media/video/saa7134/saa6752hs.c
+--- linux-2.6.38.7/drivers/media/video/saa7134/saa6752hs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/saa7134/saa6752hs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -682,6 +682,8 @@ static int saa6752hs_init(struct v4l2_su
+ 	unsigned char localPAT[256];
+ 	unsigned char localPMT[256];
+ 
++	pax_track_stack();
++
+ 	/* Set video format - must be done first as it resets other settings */
+ 	set_reg8(client, 0x41, h->video_format);
+ 
+diff -urNp linux-2.6.38.7/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.38.7/drivers/media/video/saa7164/saa7164-cmd.c
+--- linux-2.6.38.7/drivers/media/video/saa7164/saa7164-cmd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/saa7164/saa7164-cmd.c	2011-05-16 21:47:08.000000000 -0400
+@@ -88,6 +88,8 @@ int saa7164_irq_dequeue(struct saa7164_d
+ 	u8 tmp[512];
+ 	dprintk(DBGLVL_CMD, "%s()\n", __func__);
+ 
++	pax_track_stack();
++
+ 	/* While any outstand message on the bus exists... */
+ 	do {
+ 
+@@ -141,6 +143,8 @@ int saa7164_cmd_dequeue(struct saa7164_d
+ 	u8 tmp[512];
+ 	dprintk(DBGLVL_CMD, "%s()\n", __func__);
+ 
++	pax_track_stack();
++
+ 	while (loop) {
+ 
+ 		struct tmComResInfo tRsp = { 0, 0, 0, 0, 0, 0 };
+diff -urNp linux-2.6.38.7/drivers/media/video/usbvision/usbvision-core.c linux-2.6.38.7/drivers/media/video/usbvision/usbvision-core.c
+--- linux-2.6.38.7/drivers/media/video/usbvision/usbvision-core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/usbvision/usbvision-core.c	2011-05-16 21:47:08.000000000 -0400
+@@ -799,6 +799,8 @@ static enum parse_state usbvision_parse_
+ 	unsigned char rv, gv, bv;
+ 	static unsigned char *Y, *U, *V;
+ 
++	pax_track_stack();
++
+ 	frame = usbvision->cur_frame;
+ 	image_size = frame->frmwidth * frame->frmheight;
+ 	if ((frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
+diff -urNp linux-2.6.38.7/drivers/media/video/v4l2-device.c linux-2.6.38.7/drivers/media/video/v4l2-device.c
+--- linux-2.6.38.7/drivers/media/video/v4l2-device.c	2011-05-22 23:05:18.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/v4l2-device.c	2011-05-22 23:06:03.000000000 -0400
+@@ -55,9 +55,9 @@ int v4l2_device_register(struct device *
+ EXPORT_SYMBOL_GPL(v4l2_device_register);
+ 
+ int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
+-						atomic_t *instance)
++						atomic_unchecked_t *instance)
+ {
+-	int num = atomic_inc_return(instance) - 1;
++	int num = atomic_inc_return_unchecked(instance) - 1;
+ 	int len = strlen(basename);
+ 
+ 	if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
+diff -urNp linux-2.6.38.7/drivers/media/video/videobuf-dma-sg.c linux-2.6.38.7/drivers/media/video/videobuf-dma-sg.c
+--- linux-2.6.38.7/drivers/media/video/videobuf-dma-sg.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/media/video/videobuf-dma-sg.c	2011-05-16 21:47:08.000000000 -0400
+@@ -606,6 +606,8 @@ void *videobuf_sg_alloc(size_t size)
+ {
+ 	struct videobuf_queue q;
+ 
++	pax_track_stack();
++
+ 	/* Required to make generic handler to call __videobuf_alloc */
+ 	q.int_ops = &sg_ops;
+ 
+diff -urNp linux-2.6.38.7/drivers/message/fusion/mptbase.c linux-2.6.38.7/drivers/message/fusion/mptbase.c
+--- linux-2.6.38.7/drivers/message/fusion/mptbase.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/fusion/mptbase.c	2011-04-28 19:34:15.000000000 -0400
 @@ -6683,8 +6683,13 @@ static int mpt_iocinfo_proc_show(struct 
  	seq_printf(m, "  MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
  	seq_printf(m, "  MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
@@ -25621,21 +30392,9 @@ diff -urNp linux-2.6.38.2/drivers/message/fusion/mptbase.c linux-2.6.38.2/driver
  	/*
  	 *  Rounding UP to nearest 4-kB boundary here...
  	 */
-diff -urNp linux-2.6.38.2/drivers/message/fusion/mptdebug.h linux-2.6.38.2/drivers/message/fusion/mptdebug.h
---- linux-2.6.38.2/drivers/message/fusion/mptdebug.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/message/fusion/mptdebug.h	2011-03-21 18:31:35.000000000 -0400
-@@ -71,7 +71,7 @@
- 		CMD;						\
- }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif
- 
- 
-diff -urNp linux-2.6.38.2/drivers/message/fusion/mptsas.c linux-2.6.38.2/drivers/message/fusion/mptsas.c
---- linux-2.6.38.2/drivers/message/fusion/mptsas.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/message/fusion/mptsas.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/message/fusion/mptsas.c linux-2.6.38.7/drivers/message/fusion/mptsas.c
+--- linux-2.6.38.7/drivers/message/fusion/mptsas.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/fusion/mptsas.c	2011-04-28 19:34:15.000000000 -0400
 @@ -439,6 +439,23 @@ mptsas_is_end_device(struct mptsas_devin
  		return 0;
  }
@@ -25684,9 +30443,9 @@ diff -urNp linux-2.6.38.2/drivers/message/fusion/mptsas.c linux-2.6.38.2/drivers
  static inline struct sas_port *
  mptsas_get_port(struct mptsas_phyinfo *phy_info)
  {
-diff -urNp linux-2.6.38.2/drivers/message/fusion/mptscsih.c linux-2.6.38.2/drivers/message/fusion/mptscsih.c
---- linux-2.6.38.2/drivers/message/fusion/mptscsih.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/message/fusion/mptscsih.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/message/fusion/mptscsih.c linux-2.6.38.7/drivers/message/fusion/mptscsih.c
+--- linux-2.6.38.7/drivers/message/fusion/mptscsih.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/fusion/mptscsih.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1268,15 +1268,16 @@ mptscsih_info(struct Scsi_Host *SChost)
  
  	h = shost_priv(SChost);
@@ -25712,9 +30471,21 @@ diff -urNp linux-2.6.38.2/drivers/message/fusion/mptscsih.c linux-2.6.38.2/drive
  
  	return h->info_kbuf;
  }
-diff -urNp linux-2.6.38.2/drivers/message/i2o/i2o_proc.c linux-2.6.38.2/drivers/message/i2o/i2o_proc.c
---- linux-2.6.38.2/drivers/message/i2o/i2o_proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/message/i2o/i2o_proc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/message/i2o/i2o_config.c linux-2.6.38.7/drivers/message/i2o/i2o_config.c
+--- linux-2.6.38.7/drivers/message/i2o/i2o_config.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/i2o/i2o_config.c	2011-05-16 21:47:08.000000000 -0400
+@@ -781,6 +781,8 @@ static int i2o_cfg_passthru(unsigned lon
+ 	struct i2o_message *msg;
+ 	unsigned int iop;
+ 
++	pax_track_stack();
++
+ 	if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.38.7/drivers/message/i2o/i2o_proc.c linux-2.6.38.7/drivers/message/i2o/i2o_proc.c
+--- linux-2.6.38.7/drivers/message/i2o/i2o_proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/i2o/i2o_proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -255,13 +255,6 @@ static char *scsi_devices[] = {
  	"Array Controller Device"
  };
@@ -25801,79 +30572,35 @@ diff -urNp linux-2.6.38.2/drivers/message/i2o/i2o_proc.c linux-2.6.38.2/drivers/
  
  	return 0;
  }
-diff -urNp linux-2.6.38.2/drivers/mfd/ab3100-core.c linux-2.6.38.2/drivers/mfd/ab3100-core.c
---- linux-2.6.38.2/drivers/mfd/ab3100-core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mfd/ab3100-core.c	2011-03-21 18:31:35.000000000 -0400
-@@ -613,7 +613,7 @@ static void ab3100_setup_debugfs(struct 
- 	ab3100_get_priv.ab3100 = ab3100;
- 	ab3100_get_priv.mode = false;
- 	ab3100_get_reg_file = debugfs_create_file("get_reg",
--				S_IWUGO, ab3100_dir, &ab3100_get_priv,
-+				S_IWUSR, ab3100_dir, &ab3100_get_priv,
- 				&ab3100_get_set_reg_fops);
- 	if (!ab3100_get_reg_file) {
- 		err = -ENOMEM;
-@@ -623,7 +623,7 @@ static void ab3100_setup_debugfs(struct 
- 	ab3100_set_priv.ab3100 = ab3100;
- 	ab3100_set_priv.mode = true;
- 	ab3100_set_reg_file = debugfs_create_file("set_reg",
--				S_IWUGO, ab3100_dir, &ab3100_set_priv,
-+				S_IWUSR, ab3100_dir, &ab3100_set_priv,
- 				&ab3100_get_set_reg_fops);
- 	if (!ab3100_set_reg_file) {
- 		err = -ENOMEM;
-diff -urNp linux-2.6.38.2/drivers/mfd/ab3550-core.c linux-2.6.38.2/drivers/mfd/ab3550-core.c
---- linux-2.6.38.2/drivers/mfd/ab3550-core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mfd/ab3550-core.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1053,17 +1053,17 @@ static inline void ab3550_setup_debugfs(
- 		goto exit_destroy_dir;
- 
- 	ab3550_bank_file = debugfs_create_file("register-bank",
--		(S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_bank_fops);
-+		(S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_bank_fops);
- 	if (!ab3550_bank_file)
- 		goto exit_destroy_reg;
- 
- 	ab3550_address_file = debugfs_create_file("register-address",
--		(S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_address_fops);
-+		(S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_address_fops);
- 	if (!ab3550_address_file)
- 		goto exit_destroy_bank;
- 
- 	ab3550_val_file = debugfs_create_file("register-value",
--		(S_IRUGO | S_IWUGO), ab3550_dir, ab, &ab3550_val_fops);
-+		(S_IRUGO | S_IWUSR), ab3550_dir, ab, &ab3550_val_fops);
- 	if (!ab3550_val_file)
- 		goto exit_destroy_address;
- 
-diff -urNp linux-2.6.38.2/drivers/mfd/ab8500-debugfs.c linux-2.6.38.2/drivers/mfd/ab8500-debugfs.c
---- linux-2.6.38.2/drivers/mfd/ab8500-debugfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mfd/ab8500-debugfs.c	2011-03-21 18:31:35.000000000 -0400
-@@ -585,18 +585,18 @@ static int __devinit ab8500_debug_probe(
- 		goto exit_destroy_dir;
- 
- 	ab8500_bank_file = debugfs_create_file("register-bank",
--		(S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev, &ab8500_bank_fops);
-+		(S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev, &ab8500_bank_fops);
- 	if (!ab8500_bank_file)
- 		goto exit_destroy_reg;
- 
- 	ab8500_address_file = debugfs_create_file("register-address",
--		(S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev,
-+		(S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev,
- 		&ab8500_address_fops);
- 	if (!ab8500_address_file)
- 		goto exit_destroy_bank;
- 
- 	ab8500_val_file = debugfs_create_file("register-value",
--		(S_IRUGO | S_IWUGO), ab8500_dir, &plf->dev, &ab8500_val_fops);
-+		(S_IRUGO | S_IWUSR), ab8500_dir, &plf->dev, &ab8500_val_fops);
- 	if (!ab8500_val_file)
- 		goto exit_destroy_address;
- 
-diff -urNp linux-2.6.38.2/drivers/mfd/janz-cmodio.c linux-2.6.38.2/drivers/mfd/janz-cmodio.c
---- linux-2.6.38.2/drivers/mfd/janz-cmodio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mfd/janz-cmodio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/message/i2o/iop.c linux-2.6.38.7/drivers/message/i2o/iop.c
+--- linux-2.6.38.7/drivers/message/i2o/iop.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/message/i2o/iop.c	2011-04-28 19:57:25.000000000 -0400
+@@ -111,10 +111,10 @@ u32 i2o_cntxt_list_add(struct i2o_contro
+ 
+ 	spin_lock_irqsave(&c->context_list_lock, flags);
+ 
+-	if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
+-		atomic_inc(&c->context_list_counter);
++	if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
++		atomic_inc_unchecked(&c->context_list_counter);
+ 
+-	entry->context = atomic_read(&c->context_list_counter);
++	entry->context = atomic_read_unchecked(&c->context_list_counter);
+ 
+ 	list_add(&entry->list, &c->context_list);
+ 
+@@ -1077,7 +1077,7 @@ struct i2o_controller *i2o_iop_alloc(voi
+ 
+ #if BITS_PER_LONG == 64
+ 	spin_lock_init(&c->context_list_lock);
+-	atomic_set(&c->context_list_counter, 0);
++	atomic_set_unchecked(&c->context_list_counter, 0);
+ 	INIT_LIST_HEAD(&c->context_list);
+ #endif
+ 
+diff -urNp linux-2.6.38.7/drivers/mfd/janz-cmodio.c linux-2.6.38.7/drivers/mfd/janz-cmodio.c
+--- linux-2.6.38.7/drivers/mfd/janz-cmodio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mfd/janz-cmodio.c	2011-04-28 19:34:15.000000000 -0400
 @@ -13,6 +13,7 @@
  
  #include <linux/kernel.h>
@@ -25882,27 +30609,21 @@ diff -urNp linux-2.6.38.2/drivers/mfd/janz-cmodio.c linux-2.6.38.2/drivers/mfd/j
  #include <linux/init.h>
  #include <linux/pci.h>
  #include <linux/interrupt.h>
-diff -urNp linux-2.6.38.2/drivers/misc/ep93xx_pwm.c linux-2.6.38.2/drivers/misc/ep93xx_pwm.c
---- linux-2.6.38.2/drivers/misc/ep93xx_pwm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/misc/ep93xx_pwm.c	2011-03-21 18:31:35.000000000 -0400
-@@ -249,11 +249,11 @@ static ssize_t ep93xx_pwm_set_invert(str
- 
- static DEVICE_ATTR(min_freq, S_IRUGO, ep93xx_pwm_get_min_freq, NULL);
- static DEVICE_ATTR(max_freq, S_IRUGO, ep93xx_pwm_get_max_freq, NULL);
--static DEVICE_ATTR(freq, S_IWUGO | S_IRUGO,
-+static DEVICE_ATTR(freq, S_IWUSR | S_IRUGO,
- 		   ep93xx_pwm_get_freq, ep93xx_pwm_set_freq);
--static DEVICE_ATTR(duty_percent, S_IWUGO | S_IRUGO,
-+static DEVICE_ATTR(duty_percent, S_IWUSR | S_IRUGO,
- 		   ep93xx_pwm_get_duty_percent, ep93xx_pwm_set_duty_percent);
--static DEVICE_ATTR(invert, S_IWUGO | S_IRUGO,
-+static DEVICE_ATTR(invert, S_IWUSR | S_IRUGO,
- 		   ep93xx_pwm_get_invert, ep93xx_pwm_set_invert);
- 
- static struct attribute *ep93xx_pwm_attrs[] = {
-diff -urNp linux-2.6.38.2/drivers/misc/kgdbts.c linux-2.6.38.2/drivers/misc/kgdbts.c
---- linux-2.6.38.2/drivers/misc/kgdbts.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/misc/kgdbts.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/mfd/wm8350-i2c.c linux-2.6.38.7/drivers/mfd/wm8350-i2c.c
+--- linux-2.6.38.7/drivers/mfd/wm8350-i2c.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mfd/wm8350-i2c.c	2011-05-16 21:47:08.000000000 -0400
+@@ -44,6 +44,8 @@ static int wm8350_i2c_write_device(struc
+ 	u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
+ 		return -EINVAL;
+ 
+diff -urNp linux-2.6.38.7/drivers/misc/kgdbts.c linux-2.6.38.7/drivers/misc/kgdbts.c
+--- linux-2.6.38.7/drivers/misc/kgdbts.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/misc/kgdbts.c	2011-04-28 19:34:15.000000000 -0400
 @@ -118,7 +118,7 @@
  	} while (0)
  #define MAX_CONFIG_LEN		40
@@ -25921,9 +30642,9 @@ diff -urNp linux-2.6.38.2/drivers/misc/kgdbts.c linux-2.6.38.2/drivers/misc/kgdb
  	.name			= "kgdbts",
  	.read_char		= kgdbts_get_char,
  	.write_char		= kgdbts_put_char,
-diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/gruhandles.c linux-2.6.38.2/drivers/misc/sgi-gru/gruhandles.c
---- linux-2.6.38.2/drivers/misc/sgi-gru/gruhandles.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/misc/sgi-gru/gruhandles.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/misc/sgi-gru/gruhandles.c linux-2.6.38.7/drivers/misc/sgi-gru/gruhandles.c
+--- linux-2.6.38.7/drivers/misc/sgi-gru/gruhandles.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/misc/sgi-gru/gruhandles.c	2011-04-28 19:34:15.000000000 -0400
 @@ -44,8 +44,8 @@ static void update_mcs_stats(enum mcs_op
  	unsigned long nsec;
  
@@ -25935,9 +30656,9 @@ diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/gruhandles.c linux-2.6.38.2/drive
  	if (mcs_op_statistics[op].max < nsec)
  		mcs_op_statistics[op].max = nsec;
  }
-diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.38.2/drivers/misc/sgi-gru/gruprocfs.c
---- linux-2.6.38.2/drivers/misc/sgi-gru/gruprocfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/misc/sgi-gru/gruprocfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.38.7/drivers/misc/sgi-gru/gruprocfs.c
+--- linux-2.6.38.7/drivers/misc/sgi-gru/gruprocfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/misc/sgi-gru/gruprocfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -32,9 +32,9 @@
  
  #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
@@ -25961,9 +30682,9 @@ diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.38.2/driver
  		max = mcs_op_statistics[op].max;
  		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
  			   count ? total / count : 0, max);
-diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/grutables.h linux-2.6.38.2/drivers/misc/sgi-gru/grutables.h
---- linux-2.6.38.2/drivers/misc/sgi-gru/grutables.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/misc/sgi-gru/grutables.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/misc/sgi-gru/grutables.h linux-2.6.38.7/drivers/misc/sgi-gru/grutables.h
+--- linux-2.6.38.7/drivers/misc/sgi-gru/grutables.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/misc/sgi-gru/grutables.h	2011-04-28 19:34:15.000000000 -0400
 @@ -167,82 +167,82 @@ extern unsigned int gru_max_gids;
   * GRU statistics.
   */
@@ -26143,9 +30864,87 @@ diff -urNp linux-2.6.38.2/drivers/misc/sgi-gru/grutables.h linux-2.6.38.2/driver
  			} while (0)
  
  #ifdef CONFIG_SGI_GRU_DEBUG
-diff -urNp linux-2.6.38.2/drivers/mtd/devices/doc2000.c linux-2.6.38.2/drivers/mtd/devices/doc2000.c
---- linux-2.6.38.2/drivers/mtd/devices/doc2000.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mtd/devices/doc2000.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0001.c
+--- linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0001.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0001.c	2011-05-16 21:47:08.000000000 -0400
+@@ -757,6 +757,8 @@ static int chip_ready (struct map_info *
+ 	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
+ 	unsigned long timeo = jiffies + HZ;
+ 
++	pax_track_stack();
++
+ 	/* Prevent setting state FL_SYNCING for chip in suspended state. */
+ 	if (mode == FL_SYNCING && chip->oldstate != FL_READY)
+ 		goto sleep;
+@@ -1657,6 +1659,8 @@ static int __xipram do_write_buffer(stru
+ 	unsigned long initial_adr;
+ 	int initial_len = len;
+ 
++	pax_track_stack();
++
+ 	wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
+ 	adr += chip->start;
+ 	initial_adr = adr;
+@@ -1875,6 +1879,8 @@ static int __xipram do_erase_oneblock(st
+ 	int retries = 3;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	adr += chip->start;
+ 
+  retry:
+diff -urNp linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0020.c
+--- linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0020.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/chips/cfi_cmdset_0020.c	2011-05-16 21:47:08.000000000 -0400
+@@ -255,6 +255,8 @@ static inline int do_read_onechip(struct
+ 	unsigned long cmd_addr;
+ 	struct cfi_private *cfi = map->fldrv_priv;
+ 
++	pax_track_stack();
++
+ 	adr += chip->start;
+ 
+ 	/* Ensure cmd read/writes are aligned. */
+@@ -428,6 +430,8 @@ static inline int do_write_buffer(struct
+ 	DECLARE_WAITQUEUE(wait, current);
+ 	int wbufsize, z;
+ 
++	pax_track_stack();
++
+         /* M58LW064A requires bus alignment for buffer wriets -- saw */
+         if (adr & (map_bankwidth(map)-1))
+             return -EINVAL;
+@@ -742,6 +746,8 @@ static inline int do_erase_oneblock(stru
+ 	DECLARE_WAITQUEUE(wait, current);
+ 	int ret = 0;
+ 
++	pax_track_stack();
++
+ 	adr += chip->start;
+ 
+ 	/* Let's determine this according to the interleave only once */
+@@ -1047,6 +1053,8 @@ static inline int do_lock_oneblock(struc
+ 	unsigned long timeo = jiffies + HZ;
+ 	DECLARE_WAITQUEUE(wait, current);
+ 
++	pax_track_stack();
++
+ 	adr += chip->start;
+ 
+ 	/* Let's determine this according to the interleave only once */
+@@ -1196,6 +1204,8 @@ static inline int do_unlock_oneblock(str
+ 	unsigned long timeo = jiffies + HZ;
+ 	DECLARE_WAITQUEUE(wait, current);
+ 
++	pax_track_stack();
++
+ 	adr += chip->start;
+ 
+ 	/* Let's determine this according to the interleave only once */
+diff -urNp linux-2.6.38.7/drivers/mtd/devices/doc2000.c linux-2.6.38.7/drivers/mtd/devices/doc2000.c
+--- linux-2.6.38.7/drivers/mtd/devices/doc2000.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/devices/doc2000.c	2011-04-28 19:34:15.000000000 -0400
 @@ -776,7 +776,7 @@ static int doc_write(struct mtd_info *mt
  
  		/* The ECC will not be calculated correctly if less than 512 is written */
@@ -26155,9 +30954,9 @@ diff -urNp linux-2.6.38.2/drivers/mtd/devices/doc2000.c linux-2.6.38.2/drivers/m
  			printk(KERN_WARNING
  			       "ECC needs a full sector write (adr: %lx size %lx)\n",
  			       (long) to, (long) len);
-diff -urNp linux-2.6.38.2/drivers/mtd/devices/doc2001.c linux-2.6.38.2/drivers/mtd/devices/doc2001.c
---- linux-2.6.38.2/drivers/mtd/devices/doc2001.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mtd/devices/doc2001.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/mtd/devices/doc2001.c linux-2.6.38.7/drivers/mtd/devices/doc2001.c
+--- linux-2.6.38.7/drivers/mtd/devices/doc2001.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/devices/doc2001.c	2011-04-28 19:34:15.000000000 -0400
 @@ -393,7 +393,7 @@ static int doc_read (struct mtd_info *mt
  	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
  
@@ -26167,9 +30966,69 @@ diff -urNp linux-2.6.38.2/drivers/mtd/devices/doc2001.c linux-2.6.38.2/drivers/m
  		return -EINVAL;
  
  	/* Don't allow a single read to cross a 512-byte block boundary */
-diff -urNp linux-2.6.38.2/drivers/mtd/nand/denali.c linux-2.6.38.2/drivers/mtd/nand/denali.c
---- linux-2.6.38.2/drivers/mtd/nand/denali.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mtd/nand/denali.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/mtd/ftl.c linux-2.6.38.7/drivers/mtd/ftl.c
+--- linux-2.6.38.7/drivers/mtd/ftl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/ftl.c	2011-05-16 21:47:08.000000000 -0400
+@@ -474,6 +474,8 @@ static int copy_erase_unit(partition_t *
+     loff_t offset;
+     uint16_t srcunitswap = cpu_to_le16(srcunit);
+ 
++    pax_track_stack();
++
+     eun = &part->EUNInfo[srcunit];
+     xfer = &part->XferInfo[xferunit];
+     DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
+diff -urNp linux-2.6.38.7/drivers/mtd/inftlcore.c linux-2.6.38.7/drivers/mtd/inftlcore.c
+--- linux-2.6.38.7/drivers/mtd/inftlcore.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/inftlcore.c	2011-05-16 21:47:08.000000000 -0400
+@@ -259,6 +259,8 @@ static u16 INFTL_foldchain(struct INFTLr
+ 	struct inftl_oob oob;
+ 	size_t retlen;
+ 
++	pax_track_stack();
++
+ 	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
+ 		"pending=%d)\n", inftl, thisVUC, pendingblock);
+ 
+diff -urNp linux-2.6.38.7/drivers/mtd/inftlmount.c linux-2.6.38.7/drivers/mtd/inftlmount.c
+--- linux-2.6.38.7/drivers/mtd/inftlmount.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/inftlmount.c	2011-05-16 21:47:08.000000000 -0400
+@@ -53,6 +53,8 @@ static int find_boot_record(struct INFTL
+ 	struct INFTLPartition *ip;
+ 	size_t retlen;
+ 
++	pax_track_stack();
++
+ 	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
+ 
+         /*
+diff -urNp linux-2.6.38.7/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.38.7/drivers/mtd/lpddr/qinfo_probe.c
+--- linux-2.6.38.7/drivers/mtd/lpddr/qinfo_probe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/lpddr/qinfo_probe.c	2011-05-16 21:47:08.000000000 -0400
+@@ -106,6 +106,8 @@ static int lpddr_pfow_present(struct map
+ {
+ 	map_word pfow_val[4];
+ 
++	pax_track_stack();
++
+ 	/* Check identification string */
+ 	pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
+ 	pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
+diff -urNp linux-2.6.38.7/drivers/mtd/mtdchar.c linux-2.6.38.7/drivers/mtd/mtdchar.c
+--- linux-2.6.38.7/drivers/mtd/mtdchar.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/mtdchar.c	2011-05-16 21:47:08.000000000 -0400
+@@ -560,6 +560,8 @@ static int mtd_ioctl(struct file *file, 
+ 	u_long size;
+ 	struct mtd_info_user info;
+ 
++	pax_track_stack();
++
+ 	DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
+ 
+ 	size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
+diff -urNp linux-2.6.38.7/drivers/mtd/nand/denali.c linux-2.6.38.7/drivers/mtd/nand/denali.c
+--- linux-2.6.38.7/drivers/mtd/nand/denali.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/nand/denali.c	2011-04-28 19:34:15.000000000 -0400
 @@ -25,6 +25,7 @@
  #include <linux/pci.h>
  #include <linux/mtd/mtd.h>
@@ -26178,9 +31037,41 @@ diff -urNp linux-2.6.38.2/drivers/mtd/nand/denali.c linux-2.6.38.2/drivers/mtd/n
  
  #include "denali.h"
  
-diff -urNp linux-2.6.38.2/drivers/mtd/ubi/build.c linux-2.6.38.2/drivers/mtd/ubi/build.c
---- linux-2.6.38.2/drivers/mtd/ubi/build.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/mtd/ubi/build.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/mtd/nftlcore.c linux-2.6.38.7/drivers/mtd/nftlcore.c
+--- linux-2.6.38.7/drivers/mtd/nftlcore.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/nftlcore.c	2011-05-16 21:47:08.000000000 -0400
+@@ -264,6 +264,8 @@ static u16 NFTL_foldchain (struct NFTLre
+ 	int inplace = 1;
+ 	size_t retlen;
+ 
++	pax_track_stack();
++
+ 	memset(BlockMap, 0xff, sizeof(BlockMap));
+ 	memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
+ 
+diff -urNp linux-2.6.38.7/drivers/mtd/nftlmount.c linux-2.6.38.7/drivers/mtd/nftlmount.c
+--- linux-2.6.38.7/drivers/mtd/nftlmount.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/nftlmount.c	2011-05-18 20:23:44.000000000 -0400
+@@ -24,6 +24,7 @@
+ #include <asm/errno.h>
+ #include <linux/delay.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ #include <linux/mtd/mtd.h>
+ #include <linux/mtd/nand.h>
+ #include <linux/mtd/nftl.h>
+@@ -45,6 +46,8 @@ static int find_boot_record(struct NFTLr
+ 	struct mtd_info *mtd = nftl->mbd.mtd;
+ 	unsigned int i;
+ 
++	pax_track_stack();
++
+         /* Assume logical EraseSize == physical erasesize for starting the scan.
+ 	   We'll sort it out later if we find a MediaHeader which says otherwise */
+ 	/* Actually, we won't.  The new DiskOnChip driver has already scanned
+diff -urNp linux-2.6.38.7/drivers/mtd/ubi/build.c linux-2.6.38.7/drivers/mtd/ubi/build.c
+--- linux-2.6.38.7/drivers/mtd/ubi/build.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/mtd/ubi/build.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1285,7 +1285,7 @@ module_exit(ubi_exit);
  static int __init bytes_str_to_int(const char *str)
  {
@@ -26220,9 +31111,57 @@ diff -urNp linux-2.6.38.2/drivers/mtd/ubi/build.c linux-2.6.38.2/drivers/mtd/ubi
  }
  
  /**
-diff -urNp linux-2.6.38.2/drivers/net/e1000e/82571.c linux-2.6.38.2/drivers/net/e1000e/82571.c
---- linux-2.6.38.2/drivers/net/e1000e/82571.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/e1000e/82571.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/bnx2.c linux-2.6.38.7/drivers/net/bnx2.c
+--- linux-2.6.38.7/drivers/net/bnx2.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/bnx2.c	2011-05-16 21:47:08.000000000 -0400
+@@ -5826,6 +5826,8 @@ bnx2_test_nvram(struct bnx2 *bp)
+ 	int rc = 0;
+ 	u32 magic, csum;
+ 
++	pax_track_stack();
++
+ 	if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
+ 		goto test_nvram_done;
+ 
+diff -urNp linux-2.6.38.7/drivers/net/bnx2x/bnx2x_ethtool.c linux-2.6.38.7/drivers/net/bnx2x/bnx2x_ethtool.c
+--- linux-2.6.38.7/drivers/net/bnx2x/bnx2x_ethtool.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/bnx2x/bnx2x_ethtool.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1788,6 +1788,8 @@ static int bnx2x_test_nvram(struct bnx2x
+ 	int i, rc;
+ 	u32 magic, crc;
+ 
++	pax_track_stack();
++
+ 	if (BP_NOMCP(bp))
+ 		return 0;
+ 
+diff -urNp linux-2.6.38.7/drivers/net/cxgb4/cxgb4_main.c linux-2.6.38.7/drivers/net/cxgb4/cxgb4_main.c
+--- linux-2.6.38.7/drivers/net/cxgb4/cxgb4_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/cxgb4/cxgb4_main.c	2011-05-16 21:47:08.000000000 -0400
+@@ -3429,6 +3429,8 @@ static int __devinit enable_msix(struct 
+ 	unsigned int nchan = adap->params.nports;
+ 	struct msix_entry entries[MAX_INGQ + 1];
+ 
++	pax_track_stack();
++
+ 	for (i = 0; i < ARRAY_SIZE(entries); ++i)
+ 		entries[i].entry = i;
+ 
+diff -urNp linux-2.6.38.7/drivers/net/cxgb4/t4_hw.c linux-2.6.38.7/drivers/net/cxgb4/t4_hw.c
+--- linux-2.6.38.7/drivers/net/cxgb4/t4_hw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/cxgb4/t4_hw.c	2011-05-16 21:47:08.000000000 -0400
+@@ -362,6 +362,8 @@ static int get_vpd_params(struct adapter
+ 	u8 vpd[VPD_LEN], csum;
+ 	unsigned int vpdr_len, kw_offset, id_len;
+ 
++	pax_track_stack();
++
+ 	ret = pci_read_vpd(adapter->pdev, VPD_BASE, sizeof(vpd), vpd);
+ 	if (ret < 0)
+ 		return ret;
+diff -urNp linux-2.6.38.7/drivers/net/e1000e/82571.c linux-2.6.38.7/drivers/net/e1000e/82571.c
+--- linux-2.6.38.7/drivers/net/e1000e/82571.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/e1000e/82571.c	2011-04-28 19:34:15.000000000 -0400
 @@ -239,7 +239,7 @@ static s32 e1000_init_mac_params_82571(s
  {
  	struct e1000_hw *hw = &adapter->hw;
@@ -26277,9 +31216,9 @@ diff -urNp linux-2.6.38.2/drivers/net/e1000e/82571.c linux-2.6.38.2/drivers/net/
  	.acquire		= e1000_acquire_nvm_82571,
  	.read			= e1000e_read_nvm_eerd,
  	.release		= e1000_release_nvm_82571,
-diff -urNp linux-2.6.38.2/drivers/net/e1000e/e1000.h linux-2.6.38.2/drivers/net/e1000e/e1000.h
---- linux-2.6.38.2/drivers/net/e1000e/e1000.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/e1000e/e1000.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/e1000e/e1000.h linux-2.6.38.7/drivers/net/e1000e/e1000.h
+--- linux-2.6.38.7/drivers/net/e1000e/e1000.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/e1000e/e1000.h	2011-04-28 19:34:15.000000000 -0400
 @@ -408,9 +408,9 @@ struct e1000_info {
  	u32			pba;
  	u32			max_hw_frame_size;
@@ -26293,9 +31232,9 @@ diff -urNp linux-2.6.38.2/drivers/net/e1000e/e1000.h linux-2.6.38.2/drivers/net/
  };
  
  /* hardware capability, feature, and workaround flags */
-diff -urNp linux-2.6.38.2/drivers/net/e1000e/es2lan.c linux-2.6.38.2/drivers/net/e1000e/es2lan.c
---- linux-2.6.38.2/drivers/net/e1000e/es2lan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/e1000e/es2lan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/e1000e/es2lan.c linux-2.6.38.7/drivers/net/e1000e/es2lan.c
+--- linux-2.6.38.7/drivers/net/e1000e/es2lan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/e1000e/es2lan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -205,7 +205,7 @@ static s32 e1000_init_mac_params_80003es
  {
  	struct e1000_hw *hw = &adapter->hw;
@@ -26332,9 +31271,9 @@ diff -urNp linux-2.6.38.2/drivers/net/e1000e/es2lan.c linux-2.6.38.2/drivers/net
  	.acquire		= e1000_acquire_nvm_80003es2lan,
  	.read			= e1000e_read_nvm_eerd,
  	.release		= e1000_release_nvm_80003es2lan,
-diff -urNp linux-2.6.38.2/drivers/net/e1000e/hw.h linux-2.6.38.2/drivers/net/e1000e/hw.h
---- linux-2.6.38.2/drivers/net/e1000e/hw.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/e1000e/hw.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/e1000e/hw.h linux-2.6.38.7/drivers/net/e1000e/hw.h
+--- linux-2.6.38.7/drivers/net/e1000e/hw.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/e1000e/hw.h	2011-04-28 19:34:15.000000000 -0400
 @@ -801,16 +801,17 @@ struct e1000_phy_operations {
  
  /* Function pointers for the NVM. */
@@ -26376,9 +31315,9 @@ diff -urNp linux-2.6.38.2/drivers/net/e1000e/hw.h linux-2.6.38.2/drivers/net/e10
  	struct e1000_nvm_operations ops;
  
  	enum e1000_nvm_type type;
-diff -urNp linux-2.6.38.2/drivers/net/e1000e/ich8lan.c linux-2.6.38.2/drivers/net/e1000e/ich8lan.c
---- linux-2.6.38.2/drivers/net/e1000e/ich8lan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/e1000e/ich8lan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/e1000e/ich8lan.c linux-2.6.38.7/drivers/net/e1000e/ich8lan.c
+--- linux-2.6.38.7/drivers/net/e1000e/ich8lan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/e1000e/ich8lan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -3840,7 +3840,7 @@ static void e1000_clear_hw_cntrs_ich8lan
  	}
  }
@@ -26406,9 +31345,21 @@ diff -urNp linux-2.6.38.2/drivers/net/e1000e/ich8lan.c linux-2.6.38.2/drivers/ne
  	.acquire		= e1000_acquire_nvm_ich8lan,
  	.read		 	= e1000_read_nvm_ich8lan,
  	.release		= e1000_release_nvm_ich8lan,
-diff -urNp linux-2.6.38.2/drivers/net/igb/e1000_82575.c linux-2.6.38.2/drivers/net/igb/e1000_82575.c
---- linux-2.6.38.2/drivers/net/igb/e1000_82575.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/igb/e1000_82575.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/hamradio/6pack.c linux-2.6.38.7/drivers/net/hamradio/6pack.c
+--- linux-2.6.38.7/drivers/net/hamradio/6pack.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/hamradio/6pack.c	2011-05-16 21:47:08.000000000 -0400
+@@ -463,6 +463,8 @@ static void sixpack_receive_buf(struct t
+ 	unsigned char buf[512];
+ 	int count1;
+ 
++	pax_track_stack();
++
+ 	if (!count)
+ 		return;
+ 
+diff -urNp linux-2.6.38.7/drivers/net/igb/e1000_82575.c linux-2.6.38.7/drivers/net/igb/e1000_82575.c
+--- linux-2.6.38.7/drivers/net/igb/e1000_82575.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/igb/e1000_82575.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1747,7 +1747,7 @@ u16 igb_rxpbs_adjust_82580(u32 data)
  	return ret_val;
  }
@@ -26434,9 +31385,9 @@ diff -urNp linux-2.6.38.2/drivers/net/igb/e1000_82575.c linux-2.6.38.2/drivers/n
  	.acquire              = igb_acquire_nvm_82575,
  	.read                 = igb_read_nvm_eerd,
  	.release              = igb_release_nvm_82575,
-diff -urNp linux-2.6.38.2/drivers/net/igb/e1000_hw.h linux-2.6.38.2/drivers/net/igb/e1000_hw.h
---- linux-2.6.38.2/drivers/net/igb/e1000_hw.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/igb/e1000_hw.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/igb/e1000_hw.h linux-2.6.38.7/drivers/net/igb/e1000_hw.h
+--- linux-2.6.38.7/drivers/net/igb/e1000_hw.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/igb/e1000_hw.h	2011-04-28 19:34:15.000000000 -0400
 @@ -327,22 +327,23 @@ struct e1000_phy_operations {
  };
  
@@ -26484,9 +31435,9 @@ diff -urNp linux-2.6.38.2/drivers/net/igb/e1000_hw.h linux-2.6.38.2/drivers/net/
  	struct e1000_nvm_operations ops;
  
  	enum e1000_nvm_type type;
-diff -urNp linux-2.6.38.2/drivers/net/igbvf/vf.h linux-2.6.38.2/drivers/net/igbvf/vf.h
---- linux-2.6.38.2/drivers/net/igbvf/vf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/igbvf/vf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/igbvf/vf.h linux-2.6.38.7/drivers/net/igbvf/vf.h
+--- linux-2.6.38.7/drivers/net/igbvf/vf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/igbvf/vf.h	2011-04-28 19:34:15.000000000 -0400
 @@ -191,6 +191,7 @@ struct e1000_mac_operations {
  };
  
@@ -26495,28 +31446,78 @@ diff -urNp linux-2.6.38.2/drivers/net/igbvf/vf.h linux-2.6.38.2/drivers/net/igbv
  	struct e1000_mac_operations ops;
  	u8 addr[6];
  	u8 perm_addr[6];
-diff -urNp linux-2.6.38.2/drivers/net/irda/vlsi_ir.c linux-2.6.38.2/drivers/net/irda/vlsi_ir.c
---- linux-2.6.38.2/drivers/net/irda/vlsi_ir.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/irda/vlsi_ir.c	2011-03-21 18:31:35.000000000 -0400
-@@ -907,13 +907,12 @@ static netdev_tx_t vlsi_hard_start_xmit(
- 			/* no race - tx-ring already empty */
- 			vlsi_set_baud(idev, iobase);
- 			netif_wake_queue(ndev);
--		}
--		else
--			;
-+		} else {
- 			/* keep the speed change pending like it would
- 			 * for any len>0 packet. tx completion interrupt
- 			 * will apply it when the tx ring becomes empty.
- 			 */
-+		}
- 		spin_unlock_irqrestore(&idev->lock, flags);
- 		dev_kfree_skb_any(skb);
- 		return NETDEV_TX_OK;
-diff -urNp linux-2.6.38.2/drivers/net/pcnet32.c linux-2.6.38.2/drivers/net/pcnet32.c
---- linux-2.6.38.2/drivers/net/pcnet32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/pcnet32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/ixgb/ixgb_main.c linux-2.6.38.7/drivers/net/ixgb/ixgb_main.c
+--- linux-2.6.38.7/drivers/net/ixgb/ixgb_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/ixgb/ixgb_main.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1072,6 +1072,8 @@ ixgb_set_multi(struct net_device *netdev
+ 	u32 rctl;
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	/* Check for Promiscuous and All Multicast modes */
+ 
+ 	rctl = IXGB_READ_REG(hw, RCTL);
+diff -urNp linux-2.6.38.7/drivers/net/ixgb/ixgb_param.c linux-2.6.38.7/drivers/net/ixgb/ixgb_param.c
+--- linux-2.6.38.7/drivers/net/ixgb/ixgb_param.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/ixgb/ixgb_param.c	2011-05-16 21:47:08.000000000 -0400
+@@ -261,6 +261,9 @@ void __devinit
+ ixgb_check_options(struct ixgb_adapter *adapter)
+ {
+ 	int bd = adapter->bd_number;
++
++	pax_track_stack();
++
+ 	if (bd >= IXGB_MAX_NIC) {
+ 		pr_notice("Warning: no configuration for board #%i\n", bd);
+ 		pr_notice("Using defaults for all values\n");
+diff -urNp linux-2.6.38.7/drivers/net/ksz884x.c linux-2.6.38.7/drivers/net/ksz884x.c
+--- linux-2.6.38.7/drivers/net/ksz884x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/ksz884x.c	2011-05-16 21:47:08.000000000 -0400
+@@ -6536,6 +6536,8 @@ static void netdev_get_ethtool_stats(str
+ 	int rc;
+ 	u64 counter[TOTAL_PORT_COUNTER_NUM];
+ 
++	pax_track_stack();
++
+ 	mutex_lock(&hw_priv->lock);
+ 	n = SWITCH_PORT_NUM;
+ 	for (i = 0, p = port->first_port; i < port->mib_port_cnt; i++, p++) {
+diff -urNp linux-2.6.38.7/drivers/net/mlx4/main.c linux-2.6.38.7/drivers/net/mlx4/main.c
+--- linux-2.6.38.7/drivers/net/mlx4/main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/mlx4/main.c	2011-05-18 20:23:44.000000000 -0400
+@@ -39,6 +39,7 @@
+ #include <linux/pci.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ 
+ #include <linux/mlx4/device.h>
+ #include <linux/mlx4/doorbell.h>
+@@ -737,6 +738,8 @@ static int mlx4_init_hca(struct mlx4_dev
+ 	u64 icm_size;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	err = mlx4_QUERY_FW(dev);
+ 	if (err) {
+ 		if (err == -EACCES)
+diff -urNp linux-2.6.38.7/drivers/net/niu.c linux-2.6.38.7/drivers/net/niu.c
+--- linux-2.6.38.7/drivers/net/niu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/niu.c	2011-05-16 21:47:08.000000000 -0400
+@@ -9067,6 +9067,8 @@ static void __devinit niu_try_msix(struc
+ 	int i, num_irqs, err;
+ 	u8 first_ldg;
+ 
++	pax_track_stack();
++
+ 	first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
+ 	for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
+ 		ldg_num_map[i] = first_ldg + i;
+diff -urNp linux-2.6.38.7/drivers/net/pcnet32.c linux-2.6.38.7/drivers/net/pcnet32.c
+--- linux-2.6.38.7/drivers/net/pcnet32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/pcnet32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -82,7 +82,7 @@ static int cards_found;
  /*
   * VLB I/O addresses
@@ -26526,9 +31527,9 @@ diff -urNp linux-2.6.38.2/drivers/net/pcnet32.c linux-2.6.38.2/drivers/net/pcnet
      { 0x300, 0x320, 0x340, 0x360, 0 };
  
  static int pcnet32_debug;
-diff -urNp linux-2.6.38.2/drivers/net/ppp_generic.c linux-2.6.38.2/drivers/net/ppp_generic.c
---- linux-2.6.38.2/drivers/net/ppp_generic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/ppp_generic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/ppp_generic.c linux-2.6.38.7/drivers/net/ppp_generic.c
+--- linux-2.6.38.7/drivers/net/ppp_generic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/ppp_generic.c	2011-04-28 19:34:15.000000000 -0400
 @@ -986,7 +986,6 @@ ppp_net_ioctl(struct net_device *dev, st
  	void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
  	struct ppp_stats stats;
@@ -26547,9 +31548,21 @@ diff -urNp linux-2.6.38.2/drivers/net/ppp_generic.c linux-2.6.38.2/drivers/net/p
  			break;
  		err = 0;
  		break;
-diff -urNp linux-2.6.38.2/drivers/net/tg3.h linux-2.6.38.2/drivers/net/tg3.h
---- linux-2.6.38.2/drivers/net/tg3.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/tg3.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/tg3.c linux-2.6.38.7/drivers/net/tg3.c
+--- linux-2.6.38.7/drivers/net/tg3.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/tg3.c	2011-05-11 18:35:16.000000000 -0400
+@@ -13003,7 +13003,7 @@ done:
+ 
+ static struct pci_dev * __devinit tg3_find_peer(struct tg3 *);
+ 
+-static void inline vlan_features_add(struct net_device *dev, unsigned long flags)
++static inline void vlan_features_add(struct net_device *dev, unsigned long flags)
+ {
+ 	dev->vlan_features |= flags;
+ }
+diff -urNp linux-2.6.38.7/drivers/net/tg3.h linux-2.6.38.7/drivers/net/tg3.h
+--- linux-2.6.38.7/drivers/net/tg3.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/tg3.h	2011-04-28 19:34:15.000000000 -0400
 @@ -131,6 +131,7 @@
  #define  CHIPREV_ID_5750_A0		 0x4000
  #define  CHIPREV_ID_5750_A1		 0x4001
@@ -26558,9 +31571,21 @@ diff -urNp linux-2.6.38.2/drivers/net/tg3.h linux-2.6.38.2/drivers/net/tg3.h
  #define  CHIPREV_ID_5750_C2		 0x4202
  #define  CHIPREV_ID_5752_A0_HW		 0x5000
  #define  CHIPREV_ID_5752_A0		 0x6000
-diff -urNp linux-2.6.38.2/drivers/net/tulip/de4x5.c linux-2.6.38.2/drivers/net/tulip/de4x5.c
---- linux-2.6.38.2/drivers/net/tulip/de4x5.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/tulip/de4x5.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/tulip/de2104x.c linux-2.6.38.7/drivers/net/tulip/de2104x.c
+--- linux-2.6.38.7/drivers/net/tulip/de2104x.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/tulip/de2104x.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1817,6 +1817,8 @@ static void __devinit de21041_get_srom_i
+ 	struct de_srom_info_leaf *il;
+ 	void *bufp;
+ 
++	pax_track_stack();
++
+ 	/* download entire eeprom */
+ 	for (i = 0; i < DE_EEPROM_WORDS; i++)
+ 		((__le16 *)ee_data)[i] =
+diff -urNp linux-2.6.38.7/drivers/net/tulip/de4x5.c linux-2.6.38.7/drivers/net/tulip/de4x5.c
+--- linux-2.6.38.7/drivers/net/tulip/de4x5.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/tulip/de4x5.c	2011-04-28 19:34:15.000000000 -0400
 @@ -5401,7 +5401,7 @@ de4x5_ioctl(struct net_device *dev, stru
  	for (i=0; i<ETH_ALEN; i++) {
  	    tmp.addr[i] = dev->dev_addr[i];
@@ -26579,9 +31604,9 @@ diff -urNp linux-2.6.38.2/drivers/net/tulip/de4x5.c linux-2.6.38.2/drivers/net/t
  		return -EFAULT;
  	break;
      }
-diff -urNp linux-2.6.38.2/drivers/net/usb/hso.c linux-2.6.38.2/drivers/net/usb/hso.c
---- linux-2.6.38.2/drivers/net/usb/hso.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/usb/hso.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/usb/hso.c linux-2.6.38.7/drivers/net/usb/hso.c
+--- linux-2.6.38.7/drivers/net/usb/hso.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/usb/hso.c	2011-04-28 19:34:15.000000000 -0400
 @@ -71,7 +71,7 @@
  #include <asm/byteorder.h>
  #include <linux/serial_core.h>
@@ -26678,9 +31703,274 @@ diff -urNp linux-2.6.38.2/drivers/net/usb/hso.c linux-2.6.38.2/drivers/net/usb/h
  				result =
  				    hso_start_serial_device(serial_table[i], GFP_NOIO);
  				hso_kick_transmit(dev2ser(serial_table[i]));
-diff -urNp linux-2.6.38.2/drivers/net/wireless/b43/debugfs.c linux-2.6.38.2/drivers/net/wireless/b43/debugfs.c
---- linux-2.6.38.2/drivers/net/wireless/b43/debugfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/wireless/b43/debugfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/vmxnet3/vmxnet3_ethtool.c linux-2.6.38.7/drivers/net/vmxnet3/vmxnet3_ethtool.c
+--- linux-2.6.38.7/drivers/net/vmxnet3/vmxnet3_ethtool.c	2011-05-22 23:05:19.000000000 -0400
++++ linux-2.6.38.7/drivers/net/vmxnet3/vmxnet3_ethtool.c	2011-05-22 23:06:03.000000000 -0400
+@@ -631,8 +631,7 @@ vmxnet3_set_rss_indir(struct net_device 
+ 		 * Return with error code if any of the queue indices
+ 		 * is out of range
+ 		 */
+-		if (p->ring_index[i] < 0 ||
+-		    p->ring_index[i] >= adapter->num_rx_queues)
++		if (p->ring_index[i] >= adapter->num_rx_queues)
+ 			return -EINVAL;
+ 	}
+ 
+diff -urNp linux-2.6.38.7/drivers/net/vxge/vxge-main.c linux-2.6.38.7/drivers/net/vxge/vxge-main.c
+--- linux-2.6.38.7/drivers/net/vxge/vxge-main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/vxge/vxge-main.c	2011-05-16 21:47:08.000000000 -0400
+@@ -97,6 +97,8 @@ static inline void VXGE_COMPLETE_VPATH_T
+ 	struct sk_buff *completed[NR_SKB_COMPLETED];
+ 	int more;
+ 
++	pax_track_stack();
++
+ 	do {
+ 		more = 0;
+ 		skb_ptr = completed;
+@@ -1889,6 +1891,8 @@ static enum vxge_hw_status vxge_rth_conf
+ 	u8 mtable[256] = {0}; /* CPU to vpath mapping  */
+ 	int index;
+ 
++	pax_track_stack();
++
+ 	/*
+ 	 * Filling
+ 	 * 	- itable with bucket numbers
+diff -urNp linux-2.6.38.7/drivers/net/wan/cycx_x25.c linux-2.6.38.7/drivers/net/wan/cycx_x25.c
+--- linux-2.6.38.7/drivers/net/wan/cycx_x25.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wan/cycx_x25.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1018,6 +1018,8 @@ static void hex_dump(char *msg, unsigned
+ 	unsigned char hex[1024],
+ 	    	* phex = hex;
+ 
++	pax_track_stack();
++
+ 	if (len >= (sizeof(hex) / 2))
+ 		len = (sizeof(hex) / 2) - 1;
+ 
+diff -urNp linux-2.6.38.7/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.38.7/drivers/net/wimax/i2400m/usb-fw.c
+--- linux-2.6.38.7/drivers/net/wimax/i2400m/usb-fw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wimax/i2400m/usb-fw.c	2011-05-16 21:47:08.000000000 -0400
+@@ -287,6 +287,8 @@ ssize_t i2400mu_bus_bm_wait_for_ack(stru
+ 	int do_autopm = 1;
+ 	DECLARE_COMPLETION_ONSTACK(notif_completion);
+ 
++	pax_track_stack();
++
+ 	d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
+ 		  i2400m, ack, ack_size);
+ 	BUG_ON(_ack == i2400m->bm_ack_buf);
+diff -urNp linux-2.6.38.7/drivers/net/wireless/airo.c linux-2.6.38.7/drivers/net/wireless/airo.c
+--- linux-2.6.38.7/drivers/net/wireless/airo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/airo.c	2011-05-16 21:47:08.000000000 -0400
+@@ -3001,6 +3001,8 @@ static void airo_process_scan_results (s
+ 	BSSListElement * loop_net;
+ 	BSSListElement * tmp_net;
+ 
++	pax_track_stack();
++
+ 	/* Blow away current list of scan results */
+ 	list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
+ 		list_move_tail (&loop_net->list, &ai->network_free_list);
+@@ -3792,6 +3794,8 @@ static u16 setup_card(struct airo_info *
+ 	WepKeyRid wkr;
+ 	int rc;
+ 
++	pax_track_stack();
++
+ 	memset( &mySsid, 0, sizeof( mySsid ) );
+ 	kfree (ai->flash);
+ 	ai->flash = NULL;
+@@ -4760,6 +4764,8 @@ static int proc_stats_rid_open( struct i
+ 	__le32 *vals = stats.vals;
+ 	int len;
+ 
++	pax_track_stack();
++
+ 	if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+ 		return -ENOMEM;
+ 	data = file->private_data;
+@@ -5483,6 +5489,8 @@ static int proc_BSSList_open( struct ino
+ 	/* If doLoseSync is not 1, we won't do a Lose Sync */
+ 	int doLoseSync = -1;
+ 
++	pax_track_stack();
++
+ 	if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
+ 		return -ENOMEM;
+ 	data = file->private_data;
+@@ -7190,6 +7198,8 @@ static int airo_get_aplist(struct net_de
+ 	int i;
+ 	int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
+ 
++	pax_track_stack();
++
+ 	qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
+ 	if (!qual)
+ 		return -ENOMEM;
+@@ -7750,6 +7760,8 @@ static void airo_read_wireless_stats(str
+ 	CapabilityRid cap_rid;
+ 	__le32 *vals = stats_rid.vals;
+ 
++	pax_track_stack();
++
+ 	/* Get stats out of the card */
+ 	clear_bit(JOB_WSTATS, &local->jobs);
+ 	if (local->power.event) {
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.38.7/drivers/net/wireless/ath/ath5k/debug.c
+--- linux-2.6.38.7/drivers/net/wireless/ath/ath5k/debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ath/ath5k/debug.c	2011-05-16 21:47:08.000000000 -0400
+@@ -204,6 +204,8 @@ static ssize_t read_file_beacon(struct f
+ 	unsigned int v;
+ 	u64 tsf;
+ 
++	pax_track_stack();
++
+ 	v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
+ 	len += snprintf(buf+len, sizeof(buf)-len,
+ 		"%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
+@@ -325,6 +327,8 @@ static ssize_t read_file_debug(struct fi
+ 	unsigned int len = 0;
+ 	unsigned int i;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len,
+ 		"DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
+ 
+@@ -386,6 +390,8 @@ static ssize_t read_file_antenna(struct 
+ 	unsigned int i;
+ 	unsigned int v;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len, "antenna mode\t%d\n",
+ 		sc->ah->ah_ant_mode);
+ 	len += snprintf(buf+len, sizeof(buf)-len, "default antenna\t%d\n",
+@@ -496,6 +502,8 @@ static ssize_t read_file_misc(struct fil
+ 	unsigned int len = 0;
+ 	u32 filt = ath5k_hw_get_rx_filter(sc->ah);
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len, "bssid-mask: %pM\n",
+ 			sc->bssidmask);
+ 	len += snprintf(buf+len, sizeof(buf)-len, "filter-flags: 0x%x ",
+@@ -552,6 +560,8 @@ static ssize_t read_file_frameerrors(str
+ 	unsigned int len = 0;
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len,
+ 			"RX\n---------------------\n");
+ 	len += snprintf(buf+len, sizeof(buf)-len, "CRC\t%u\t(%u%%)\n",
+@@ -669,6 +679,8 @@ static ssize_t read_file_ani(struct file
+ 	char buf[700];
+ 	unsigned int len = 0;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len,
+ 			"HW has PHY error counters:\t%s\n",
+ 			sc->ah->ah_capabilities.cap_has_phyerr_counters ?
+@@ -829,6 +841,8 @@ static ssize_t read_file_queue(struct fi
+ 	struct ath5k_buf *bf, *bf0;
+ 	int i, n;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf+len, sizeof(buf)-len,
+ 			"available txbuffers: %d\n", sc->txbuf_len);
+ 
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_calib.c linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_calib.c
+--- linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_calib.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_calib.c	2011-05-16 21:47:08.000000000 -0400
+@@ -734,6 +734,8 @@ static void ar9003_hw_tx_iq_cal(struct a
+ 	s32 i, j, ip, im, nmeasurement;
+ 	u8 nchains = get_streams(common->tx_chainmask);
+ 
++	pax_track_stack();
++
+ 	for (ip = 0; ip < MPASS; ip++) {
+ 		REG_RMW_FIELD(ah, AR_PHY_TX_IQCAL_CONTROL_1,
+ 			      AR_PHY_TX_IQCAQL_CONTROL_1_IQCORR_I_Q_COFF_DELPT,
+@@ -856,6 +858,8 @@ static void ar9003_hw_tx_iq_cal_post_pro
+ 	int i, ip, im, j;
+ 	int nmeasurement;
+ 
++	pax_track_stack();
++
+ 	for (i = 0; i < AR9300_MAX_CHAINS; i++) {
+ 		if (ah->txchainmask & (1 << i))
+ 			num_chains++;
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_paprd.c linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_paprd.c
+--- linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_paprd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ath/ath9k/ar9003_paprd.c	2011-05-16 21:47:08.000000000 -0400
+@@ -356,6 +356,8 @@ static bool create_pa_curve(u32 *data_L,
+ 	int theta_low_bin = 0;
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	/* disregard any bin that contains <= 16 samples */
+ 	thresh_accum_cnt = 16;
+ 	scale_factor = 5;
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.38.7/drivers/net/wireless/ath/ath9k/debug.c
+--- linux-2.6.38.7/drivers/net/wireless/ath/ath9k/debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ath/ath9k/debug.c	2011-05-16 21:47:08.000000000 -0400
+@@ -321,6 +321,8 @@ static ssize_t read_file_interrupt(struc
+ 	char buf[512];
+ 	unsigned int len = 0;
+ 
++	pax_track_stack();
++
+ 	if (sc->sc_ah->caps.hw_caps & ATH9K_HW_CAP_EDMA) {
+ 		len += snprintf(buf + len, sizeof(buf) - len,
+ 			"%8s: %10u\n", "RXLP", sc->debug.stats.istats.rxlp);
+@@ -410,6 +412,8 @@ static ssize_t read_file_wiphy(struct fi
+ 	u8 addr[ETH_ALEN];
+ 	u32 tmp;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf + len, sizeof(buf) - len,
+ 			"primary: %s (%s chan=%d ht=%d)\n",
+ 			wiphy_name(sc->pri_wiphy->hw->wiphy),
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ath/ath9k/htc_drv_main.c linux-2.6.38.7/drivers/net/wireless/ath/ath9k/htc_drv_main.c
+--- linux-2.6.38.7/drivers/net/wireless/ath/ath9k/htc_drv_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ath/ath9k/htc_drv_main.c	2011-05-16 21:47:08.000000000 -0400
+@@ -620,6 +620,8 @@ static ssize_t read_file_tgt_stats(struc
+ 	unsigned int len = 0;
+ 	int ret = 0;
+ 
++	pax_track_stack();
++
+ 	memset(&cmd_rsp, 0, sizeof(cmd_rsp));
+ 
+ 	WMI_CMD(WMI_TGT_STATS_CMDID);
+@@ -665,6 +667,8 @@ static ssize_t read_file_xmit(struct fil
+ 	char buf[512];
+ 	unsigned int len = 0;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf + len, sizeof(buf) - len,
+ 			"%20s : %10u\n", "Buffers queued",
+ 			priv->debug.tx_stats.buf_queued);
+@@ -714,6 +718,8 @@ static ssize_t read_file_recv(struct fil
+ 	char buf[512];
+ 	unsigned int len = 0;
+ 
++	pax_track_stack();
++
+ 	len += snprintf(buf + len, sizeof(buf) - len,
+ 			"%20s : %10u\n", "SKBs allocated",
+ 			priv->debug.rx_stats.skb_allocated);
+diff -urNp linux-2.6.38.7/drivers/net/wireless/b43/debugfs.c linux-2.6.38.7/drivers/net/wireless/b43/debugfs.c
+--- linux-2.6.38.7/drivers/net/wireless/b43/debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/b43/debugfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -43,7 +43,7 @@ static struct dentry *rootdir;
  struct b43_debugfs_fops {
  	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
@@ -26690,9 +31980,9 @@ diff -urNp linux-2.6.38.2/drivers/net/wireless/b43/debugfs.c linux-2.6.38.2/driv
  	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
  	size_t file_struct_offset;
  };
-diff -urNp linux-2.6.38.2/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.38.2/drivers/net/wireless/b43legacy/debugfs.c
---- linux-2.6.38.2/drivers/net/wireless/b43legacy/debugfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/wireless/b43legacy/debugfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.38.7/drivers/net/wireless/b43legacy/debugfs.c
+--- linux-2.6.38.7/drivers/net/wireless/b43legacy/debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/b43legacy/debugfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -44,7 +44,7 @@ static struct dentry *rootdir;
  struct b43legacy_debugfs_fops {
  	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
@@ -26702,9 +31992,84 @@ diff -urNp linux-2.6.38.2/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.38.
  	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
  	size_t file_struct_offset;
  	/* Take wl->irq_lock before calling read/write? */
-diff -urNp linux-2.6.38.2/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.38.2/drivers/net/wireless/iwlwifi/iwl-debug.h
---- linux-2.6.38.2/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.38.7/drivers/net/wireless/ipw2x00/ipw2100.c
+--- linux-2.6.38.7/drivers/net/wireless/ipw2x00/ipw2100.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ipw2x00/ipw2100.c	2011-05-16 21:47:08.000000000 -0400
+@@ -2101,6 +2101,8 @@ static int ipw2100_set_essid(struct ipw2
+ 	int err;
+ 	DECLARE_SSID_BUF(ssid);
+ 
++	pax_track_stack();
++
+ 	IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
+ 
+ 	if (ssid_len)
+@@ -5455,6 +5457,8 @@ static int ipw2100_set_key(struct ipw210
+ 	struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
+ 		     idx, keylen, len);
+ 
+diff -urNp linux-2.6.38.7/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.38.7/drivers/net/wireless/ipw2x00/libipw_rx.c
+--- linux-2.6.38.7/drivers/net/wireless/ipw2x00/libipw_rx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/ipw2x00/libipw_rx.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1565,6 +1565,8 @@ static void libipw_process_probe_respons
+ 	unsigned long flags;
+ 	DECLARE_SSID_BUF(ssid);
+ 
++	pax_track_stack();
++
+ 	LIBIPW_DEBUG_SCAN("'%s' (%pM"
+ 		     "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
+ 		     print_ssid(ssid, info_element->data, info_element->len),
+diff -urNp linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
+--- linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -883,6 +883,8 @@ static void rs_tx_status(void *priv_r, s
+ 	struct iwl_station_priv *sta_priv = (void *)sta->drv_priv;
+ 	struct iwl_rxon_context *ctx = sta_priv->common.ctx;
+ 
++	pax_track_stack();
++
+ 	IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
+ 
+ 	/* Treat uninitialized rate scaling data same as non-existing. */
+@@ -2892,6 +2894,8 @@ static void rs_fill_link_cmd(struct iwl_
+ 	u8 valid_tx_ant = 0;
+ 	struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
+ 
++	pax_track_stack();
++
+ 	/* Override starting rate (index 0) if needed for debug purposes */
+ 	rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
+ 
+diff -urNp linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debugfs.c
+--- linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -518,6 +518,8 @@ static ssize_t iwl_dbgfs_status_read(str
+ 	int pos = 0;
+ 	const size_t bufsz = sizeof(buf);
+ 
++	pax_track_stack();
++
+ 	pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
+ 		test_bit(STATUS_HCMD_ACTIVE, &priv->status));
+ 	pos += scnprintf(buf + pos, bufsz - pos, "STATUS_INT_ENABLED:\t %d\n",
+@@ -650,6 +652,8 @@ static ssize_t iwl_dbgfs_qos_read(struct
+ 	char buf[256 * NUM_IWL_RXON_CTX];
+ 	const size_t bufsz = sizeof(buf);
+ 
++	pax_track_stack();
++
+ 	for_each_context(priv, ctx) {
+ 		pos += scnprintf(buf + pos, bufsz - pos, "context %d:\n",
+ 				 ctx->ctxid);
+diff -urNp linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debug.h
+--- linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-04-28 19:34:15.000000000 -0400
 @@ -68,8 +68,8 @@ do {                                    
  } while (0)
  
@@ -26716,9 +32081,21 @@ diff -urNp linux-2.6.38.2/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.38.
  static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
  				      const void *p, u32 len)
  {}
-diff -urNp linux-2.6.38.2/drivers/net/wireless/libertas/debugfs.c linux-2.6.38.2/drivers/net/wireless/libertas/debugfs.c
---- linux-2.6.38.2/drivers/net/wireless/libertas/debugfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/wireless/libertas/debugfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.38.7/drivers/net/wireless/iwmc3200wifi/debugfs.c
+--- linux-2.6.38.7/drivers/net/wireless/iwmc3200wifi/debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/iwmc3200wifi/debugfs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -327,6 +327,8 @@ static ssize_t iwm_debugfs_fw_err_read(s
+ 	int buf_len = 512;
+ 	size_t len = 0;
+ 
++	pax_track_stack();
++
+ 	if (*ppos != 0)
+ 		return 0;
+ 	if (count < sizeof(buf))
+diff -urNp linux-2.6.38.7/drivers/net/wireless/libertas/debugfs.c linux-2.6.38.7/drivers/net/wireless/libertas/debugfs.c
+--- linux-2.6.38.7/drivers/net/wireless/libertas/debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/libertas/debugfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -702,7 +702,7 @@ out_unlock:
  struct lbs_debugfs_files {
  	const char *name;
@@ -26728,9 +32105,9 @@ diff -urNp linux-2.6.38.2/drivers/net/wireless/libertas/debugfs.c linux-2.6.38.2
  };
  
  static const struct lbs_debugfs_files debugfs_files[] = {
-diff -urNp linux-2.6.38.2/drivers/net/wireless/rndis_wlan.c linux-2.6.38.2/drivers/net/wireless/rndis_wlan.c
---- linux-2.6.38.2/drivers/net/wireless/rndis_wlan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/net/wireless/rndis_wlan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/wireless/rndis_wlan.c linux-2.6.38.7/drivers/net/wireless/rndis_wlan.c
+--- linux-2.6.38.7/drivers/net/wireless/rndis_wlan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/rndis_wlan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1277,7 +1277,7 @@ static int set_rts_threshold(struct usbn
  
  	netdev_dbg(usbdev->net, "%s(): %i\n", __func__, rts_threshold);
@@ -26740,9 +32117,33 @@ diff -urNp linux-2.6.38.2/drivers/net/wireless/rndis_wlan.c linux-2.6.38.2/drive
  		rts_threshold = 2347;
  
  	tmp = cpu_to_le32(rts_threshold);
-diff -urNp linux-2.6.38.2/drivers/oprofile/buffer_sync.c linux-2.6.38.2/drivers/oprofile/buffer_sync.c
---- linux-2.6.38.2/drivers/oprofile/buffer_sync.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/buffer_sync.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c linux-2.6.38.7/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c
+--- linux-2.6.38.7/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/rtlwifi/rtl8192ce/phy.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1277,6 +1277,8 @@ static bool _rtl92c_phy_sw_chnl_step_by_
+ 	u8 rfpath;
+ 	u8 num_total_rfpath = rtlphy->num_total_rfpath;
+ 
++	pax_track_stack();
++
+ 	precommoncmdcnt = 0;
+ 	_rtl92c_phy_set_sw_chnl_cmdarray(precommoncmd, precommoncmdcnt++,
+ 					 MAX_PRECMD_CNT,
+diff -urNp linux-2.6.38.7/drivers/net/wireless/wl12xx/spi.c linux-2.6.38.7/drivers/net/wireless/wl12xx/spi.c
+--- linux-2.6.38.7/drivers/net/wireless/wl12xx/spi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/net/wireless/wl12xx/spi.c	2011-05-16 21:47:08.000000000 -0400
+@@ -279,6 +279,8 @@ static void wl1271_spi_raw_write(struct 
+ 	u32 chunk_len;
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	WARN_ON(len > WL1271_AGGR_BUFFER_SIZE);
+ 
+ 	spi_message_init(&m);
+diff -urNp linux-2.6.38.7/drivers/oprofile/buffer_sync.c linux-2.6.38.7/drivers/oprofile/buffer_sync.c
+--- linux-2.6.38.7/drivers/oprofile/buffer_sync.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/buffer_sync.c	2011-04-28 19:34:15.000000000 -0400
 @@ -342,7 +342,7 @@ static void add_data(struct op_entry *en
  		if (cookie == NO_COOKIE)
  			offset = pc;
@@ -26778,9 +32179,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/buffer_sync.c linux-2.6.38.2/drivers/
  		}
  	}
  	release_mm(mm);
-diff -urNp linux-2.6.38.2/drivers/oprofile/event_buffer.c linux-2.6.38.2/drivers/oprofile/event_buffer.c
---- linux-2.6.38.2/drivers/oprofile/event_buffer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/event_buffer.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/oprofile/event_buffer.c linux-2.6.38.7/drivers/oprofile/event_buffer.c
+--- linux-2.6.38.7/drivers/oprofile/event_buffer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/event_buffer.c	2011-04-28 19:34:15.000000000 -0400
 @@ -53,7 +53,7 @@ void add_event_entry(unsigned long value
  	}
  
@@ -26790,9 +32191,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/event_buffer.c linux-2.6.38.2/drivers
  		return;
  	}
  
-diff -urNp linux-2.6.38.2/drivers/oprofile/oprof.c linux-2.6.38.2/drivers/oprofile/oprof.c
---- linux-2.6.38.2/drivers/oprofile/oprof.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/oprof.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/oprofile/oprof.c linux-2.6.38.7/drivers/oprofile/oprof.c
+--- linux-2.6.38.7/drivers/oprofile/oprof.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/oprof.c	2011-04-28 19:34:15.000000000 -0400
 @@ -110,7 +110,7 @@ static void switch_worker(struct work_st
  	if (oprofile_ops.switch_events())
  		return;
@@ -26802,9 +32203,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/oprof.c linux-2.6.38.2/drivers/oprofi
  	start_switch_worker();
  }
  
-diff -urNp linux-2.6.38.2/drivers/oprofile/oprofilefs.c linux-2.6.38.2/drivers/oprofile/oprofilefs.c
---- linux-2.6.38.2/drivers/oprofile/oprofilefs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/oprofilefs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/oprofile/oprofilefs.c linux-2.6.38.7/drivers/oprofile/oprofilefs.c
+--- linux-2.6.38.7/drivers/oprofile/oprofilefs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/oprofilefs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -186,7 +186,7 @@ static const struct file_operations atom
  
  
@@ -26814,9 +32215,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/oprofilefs.c linux-2.6.38.2/drivers/o
  {
  	return __oprofilefs_create_file(sb, root, name,
  					&atomic_ro_fops, 0444, val);
-diff -urNp linux-2.6.38.2/drivers/oprofile/oprofile_stats.c linux-2.6.38.2/drivers/oprofile/oprofile_stats.c
---- linux-2.6.38.2/drivers/oprofile/oprofile_stats.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/oprofile_stats.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/oprofile/oprofile_stats.c linux-2.6.38.7/drivers/oprofile/oprofile_stats.c
+--- linux-2.6.38.7/drivers/oprofile/oprofile_stats.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/oprofile_stats.c	2011-04-28 19:34:15.000000000 -0400
 @@ -30,11 +30,11 @@ void oprofile_reset_stats(void)
  		cpu_buf->sample_invalid_eip = 0;
  	}
@@ -26834,9 +32235,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/oprofile_stats.c linux-2.6.38.2/drive
  }
  
  
-diff -urNp linux-2.6.38.2/drivers/oprofile/oprofile_stats.h linux-2.6.38.2/drivers/oprofile/oprofile_stats.h
---- linux-2.6.38.2/drivers/oprofile/oprofile_stats.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/oprofile/oprofile_stats.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/oprofile/oprofile_stats.h linux-2.6.38.7/drivers/oprofile/oprofile_stats.h
+--- linux-2.6.38.7/drivers/oprofile/oprofile_stats.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/oprofile/oprofile_stats.h	2011-04-28 19:34:15.000000000 -0400
 @@ -13,11 +13,11 @@
  #include <asm/atomic.h>
  
@@ -26854,9 +32255,9 @@ diff -urNp linux-2.6.38.2/drivers/oprofile/oprofile_stats.h linux-2.6.38.2/drive
  };
  
  extern struct oprofile_stat_struct oprofile_stats;
-diff -urNp linux-2.6.38.2/drivers/parport/procfs.c linux-2.6.38.2/drivers/parport/procfs.c
---- linux-2.6.38.2/drivers/parport/procfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/parport/procfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/parport/procfs.c linux-2.6.38.7/drivers/parport/procfs.c
+--- linux-2.6.38.7/drivers/parport/procfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/parport/procfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -64,7 +64,7 @@ static int do_active_device(ctl_table *t
  
  	*ppos += len;
@@ -26875,9 +32276,9 @@ diff -urNp linux-2.6.38.2/drivers/parport/procfs.c linux-2.6.38.2/drivers/parpor
  }
  #endif /* IEEE1284.3 support. */
  
-diff -urNp linux-2.6.38.2/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.38.2/drivers/pci/hotplug/acpiphp_glue.c
---- linux-2.6.38.2/drivers/pci/hotplug/acpiphp_glue.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/hotplug/acpiphp_glue.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.38.7/drivers/pci/hotplug/acpiphp_glue.c
+--- linux-2.6.38.7/drivers/pci/hotplug/acpiphp_glue.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/hotplug/acpiphp_glue.c	2011-04-28 19:34:15.000000000 -0400
 @@ -110,7 +110,7 @@ static int post_dock_fixups(struct notif
  }
  
@@ -26887,9 +32288,9 @@ diff -urNp linux-2.6.38.2/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.38.2/driv
  	.handler = handle_hotplug_event_func,
  };
  
-diff -urNp linux-2.6.38.2/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.38.2/drivers/pci/hotplug/cpqphp_nvram.c
---- linux-2.6.38.2/drivers/pci/hotplug/cpqphp_nvram.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/hotplug/cpqphp_nvram.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.38.7/drivers/pci/hotplug/cpqphp_nvram.c
+--- linux-2.6.38.7/drivers/pci/hotplug/cpqphp_nvram.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/hotplug/cpqphp_nvram.c	2011-04-28 19:34:15.000000000 -0400
 @@ -428,9 +428,13 @@ static u32 store_HRT (void __iomem *rom_
  
  void compaq_nvram_init (void __iomem *rom_start)
@@ -26904,9 +32305,9 @@ diff -urNp linux-2.6.38.2/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.38.2/driv
  	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
  
  	/* initialize our int15 lock */
-diff -urNp linux-2.6.38.2/drivers/pci/intel-iommu.c linux-2.6.38.2/drivers/pci/intel-iommu.c
---- linux-2.6.38.2/drivers/pci/intel-iommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/intel-iommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/intel-iommu.c linux-2.6.38.7/drivers/pci/intel-iommu.c
+--- linux-2.6.38.7/drivers/pci/intel-iommu.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/intel-iommu.c	2011-05-10 22:06:56.000000000 -0400
 @@ -2934,7 +2934,7 @@ static int intel_mapping_error(struct de
  	return !dma_addr;
  }
@@ -26916,9 +32317,9 @@ diff -urNp linux-2.6.38.2/drivers/pci/intel-iommu.c linux-2.6.38.2/drivers/pci/i
  	.alloc_coherent = intel_alloc_coherent,
  	.free_coherent = intel_free_coherent,
  	.map_sg = intel_map_sg,
-diff -urNp linux-2.6.38.2/drivers/pci/pcie/aspm.c linux-2.6.38.2/drivers/pci/pcie/aspm.c
---- linux-2.6.38.2/drivers/pci/pcie/aspm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/pcie/aspm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/pcie/aspm.c linux-2.6.38.7/drivers/pci/pcie/aspm.c
+--- linux-2.6.38.7/drivers/pci/pcie/aspm.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/pcie/aspm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -27,9 +27,9 @@
  #define MODULE_PARAM_PREFIX "pcie_aspm."
  
@@ -26932,21 +32333,9 @@ diff -urNp linux-2.6.38.2/drivers/pci/pcie/aspm.c linux-2.6.38.2/drivers/pci/pci
  #define ASPM_STATE_L0S		(ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
  #define ASPM_STATE_ALL		(ASPM_STATE_L0S | ASPM_STATE_L1)
  
-diff -urNp linux-2.6.38.2/drivers/pci/pcie/portdrv_pci.c linux-2.6.38.2/drivers/pci/pcie/portdrv_pci.c
---- linux-2.6.38.2/drivers/pci/pcie/portdrv_pci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/pcie/portdrv_pci.c	2011-03-21 18:31:35.000000000 -0400
-@@ -307,7 +307,7 @@ static void pcie_portdrv_err_resume(stru
- static const struct pci_device_id port_pci_ids[] = { {
- 	/* handle any PCI-Express port */
- 	PCI_DEVICE_CLASS(((PCI_CLASS_BRIDGE_PCI << 8) | 0x00), ~0),
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, port_pci_ids);
- 
-diff -urNp linux-2.6.38.2/drivers/pci/probe.c linux-2.6.38.2/drivers/pci/probe.c
---- linux-2.6.38.2/drivers/pci/probe.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/probe.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/probe.c linux-2.6.38.7/drivers/pci/probe.c
+--- linux-2.6.38.7/drivers/pci/probe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/probe.c	2011-04-28 19:34:15.000000000 -0400
 @@ -62,14 +62,14 @@ static ssize_t pci_bus_show_cpuaffinity(
  	return ret;
  }
@@ -26973,9 +32362,9 @@ diff -urNp linux-2.6.38.2/drivers/pci/probe.c linux-2.6.38.2/drivers/pci/probe.c
  
  	if (!dev->mmio_always_on) {
  		pci_read_config_word(dev, PCI_COMMAND, &orig_cmd);
-diff -urNp linux-2.6.38.2/drivers/pci/proc.c linux-2.6.38.2/drivers/pci/proc.c
---- linux-2.6.38.2/drivers/pci/proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pci/proc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/proc.c linux-2.6.38.7/drivers/pci/proc.c
+--- linux-2.6.38.7/drivers/pci/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -476,7 +476,16 @@ static const struct file_operations proc
  static int __init pci_proc_init(void)
  {
@@ -26993,33 +32382,57 @@ diff -urNp linux-2.6.38.2/drivers/pci/proc.c linux-2.6.38.2/drivers/pci/proc.c
  	proc_create("devices", 0, proc_bus_pci_dir,
  		    &proc_bus_pci_dev_operations);
  	proc_initialized = 1;
-diff -urNp linux-2.6.38.2/drivers/pcmcia/ti113x.h linux-2.6.38.2/drivers/pcmcia/ti113x.h
---- linux-2.6.38.2/drivers/pcmcia/ti113x.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pcmcia/ti113x.h	2011-03-21 18:31:35.000000000 -0400
-@@ -936,7 +936,7 @@ static struct pci_device_id ene_tune_tbl
- 	DEVID(PCI_VENDOR_ID_MOTOROLA, 0x3410, 0xECC0, PCI_ANY_ID,
- 		ENE_TEST_C9_TLTENABLE | ENE_TEST_C9_PFENABLE, ENE_TEST_C9_TLTENABLE),
- 
--	{}
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static void ene_tune_bridge(struct pcmcia_socket *sock, struct pci_bus *bus)
-diff -urNp linux-2.6.38.2/drivers/pcmcia/yenta_socket.c linux-2.6.38.2/drivers/pcmcia/yenta_socket.c
---- linux-2.6.38.2/drivers/pcmcia/yenta_socket.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pcmcia/yenta_socket.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1426,7 +1426,7 @@ static struct pci_device_id yenta_table[
- 
- 	/* match any cardbus bridge */
- 	CB_ID(PCI_ANY_ID, PCI_ANY_ID, DEFAULT),
--	{ /* all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, yenta_table);
- 
-diff -urNp linux-2.6.38.2/drivers/platform/x86/asus-laptop.c linux-2.6.38.2/drivers/platform/x86/asus-laptop.c
---- linux-2.6.38.2/drivers/platform/x86/asus-laptop.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/platform/x86/asus-laptop.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pci/xen-pcifront.c linux-2.6.38.7/drivers/pci/xen-pcifront.c
+--- linux-2.6.38.7/drivers/pci/xen-pcifront.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pci/xen-pcifront.c	2011-05-16 21:47:08.000000000 -0400
+@@ -187,6 +187,8 @@ static int pcifront_bus_read(struct pci_
+ 	struct pcifront_sd *sd = bus->sysdata;
+ 	struct pcifront_device *pdev = pcifront_get_pdev(sd);
+ 
++	pax_track_stack();
++
+ 	if (verbose_request)
+ 		dev_info(&pdev->xdev->dev,
+ 			 "read dev=%04x:%02x:%02x.%01x - offset %x size %d\n",
+@@ -226,6 +228,8 @@ static int pcifront_bus_write(struct pci
+ 	struct pcifront_sd *sd = bus->sysdata;
+ 	struct pcifront_device *pdev = pcifront_get_pdev(sd);
+ 
++	pax_track_stack();
++
+ 	if (verbose_request)
+ 		dev_info(&pdev->xdev->dev,
+ 			 "write dev=%04x:%02x:%02x.%01x - "
+@@ -258,6 +262,8 @@ static int pci_frontend_enable_msix(stru
+ 	struct pcifront_device *pdev = pcifront_get_pdev(sd);
+ 	struct msi_desc *entry;
+ 
++	pax_track_stack();
++
+ 	if (nvec > SH_INFO_MAX_VEC) {
+ 		dev_err(&dev->dev, "too much vector for pci frontend: %x."
+ 				   " Increase SH_INFO_MAX_VEC.\n", nvec);
+@@ -303,6 +309,8 @@ static void pci_frontend_disable_msix(st
+ 	struct pcifront_sd *sd = dev->bus->sysdata;
+ 	struct pcifront_device *pdev = pcifront_get_pdev(sd);
+ 
++	pax_track_stack();
++
+ 	err = do_pci_op(pdev, &op);
+ 
+ 	/* What should do for error ? */
+@@ -322,6 +330,8 @@ static int pci_frontend_enable_msi(struc
+ 	struct pcifront_sd *sd = dev->bus->sysdata;
+ 	struct pcifront_device *pdev = pcifront_get_pdev(sd);
+ 
++	pax_track_stack();
++
+ 	err = do_pci_op(pdev, &op);
+ 	if (likely(!err)) {
+ 		*(*vector) = op.value;
+diff -urNp linux-2.6.38.7/drivers/platform/x86/asus-laptop.c linux-2.6.38.7/drivers/platform/x86/asus-laptop.c
+--- linux-2.6.38.7/drivers/platform/x86/asus-laptop.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/platform/x86/asus-laptop.c	2011-04-28 19:34:15.000000000 -0400
 @@ -243,7 +243,6 @@ struct asus_laptop {
  	struct asus_led gled;
  	struct asus_led kled;
@@ -27028,9 +32441,9 @@ diff -urNp linux-2.6.38.2/drivers/platform/x86/asus-laptop.c linux-2.6.38.2/driv
  	int wireless_status;
  	bool have_rsts;
  	int lcd_state;
-diff -urNp linux-2.6.38.2/drivers/pnp/pnpbios/bioscalls.c linux-2.6.38.2/drivers/pnp/pnpbios/bioscalls.c
---- linux-2.6.38.2/drivers/pnp/pnpbios/bioscalls.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pnp/pnpbios/bioscalls.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pnp/pnpbios/bioscalls.c linux-2.6.38.7/drivers/pnp/pnpbios/bioscalls.c
+--- linux-2.6.38.7/drivers/pnp/pnpbios/bioscalls.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pnp/pnpbios/bioscalls.c	2011-04-28 19:34:15.000000000 -0400
 @@ -59,7 +59,7 @@ do { \
  	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
  } while(0)
@@ -27087,21 +32500,9 @@ diff -urNp linux-2.6.38.2/drivers/pnp/pnpbios/bioscalls.c linux-2.6.38.2/drivers
 +
 +	pax_close_kernel();
  }
-diff -urNp linux-2.6.38.2/drivers/pnp/quirks.c linux-2.6.38.2/drivers/pnp/quirks.c
---- linux-2.6.38.2/drivers/pnp/quirks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pnp/quirks.c	2011-03-21 18:31:35.000000000 -0400
-@@ -322,7 +322,7 @@ static struct pnp_fixup pnp_fixups[] = {
- 	/* PnP resources that might overlap PCI BARs */
- 	{"PNP0c01", quirk_system_pci_resources},
- 	{"PNP0c02", quirk_system_pci_resources},
--	{""}
-+	{"", NULL}
- };
- 
- void pnp_fixup_device(struct pnp_dev *dev)
-diff -urNp linux-2.6.38.2/drivers/pnp/resource.c linux-2.6.38.2/drivers/pnp/resource.c
---- linux-2.6.38.2/drivers/pnp/resource.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/pnp/resource.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/pnp/resource.c linux-2.6.38.7/drivers/pnp/resource.c
+--- linux-2.6.38.7/drivers/pnp/resource.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/pnp/resource.c	2011-04-28 19:34:15.000000000 -0400
 @@ -360,7 +360,7 @@ int pnp_check_irq(struct pnp_dev *dev, s
  		return 1;
  
@@ -27120,9 +32521,9 @@ diff -urNp linux-2.6.38.2/drivers/pnp/resource.c linux-2.6.38.2/drivers/pnp/reso
  		return 0;
  
  	/* check if the resource is reserved */
-diff -urNp linux-2.6.38.2/drivers/rtc/rtc-dev.c linux-2.6.38.2/drivers/rtc/rtc-dev.c
---- linux-2.6.38.2/drivers/rtc/rtc-dev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/rtc/rtc-dev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/rtc/rtc-dev.c linux-2.6.38.7/drivers/rtc/rtc-dev.c
+--- linux-2.6.38.7/drivers/rtc/rtc-dev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/rtc/rtc-dev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -14,6 +14,7 @@
  #include <linux/module.h>
  #include <linux/rtc.h>
@@ -27140,21 +32541,9 @@ diff -urNp linux-2.6.38.2/drivers/rtc/rtc-dev.c linux-2.6.38.2/drivers/rtc/rtc-d
  		return rtc_set_time(rtc, &tm);
  
  	case RTC_PIE_ON:
-diff -urNp linux-2.6.38.2/drivers/rtc/rtc-ds1511.c linux-2.6.38.2/drivers/rtc/rtc-ds1511.c
---- linux-2.6.38.2/drivers/rtc/rtc-ds1511.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/rtc/rtc-ds1511.c	2011-03-21 18:31:35.000000000 -0400
-@@ -485,7 +485,7 @@ ds1511_nvram_write(struct file *filp, st
- static struct bin_attribute ds1511_nvram_attr = {
- 	.attr = {
- 		.name = "nvram",
--		.mode = S_IRUGO | S_IWUGO,
-+		.mode = S_IRUGO | S_IWUSR,
- 	},
- 	.size = DS1511_RAM_MAX,
- 	.read = ds1511_nvram_read,
-diff -urNp linux-2.6.38.2/drivers/s390/cio/qdio_debug.c linux-2.6.38.2/drivers/s390/cio/qdio_debug.c
---- linux-2.6.38.2/drivers/s390/cio/qdio_debug.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/s390/cio/qdio_debug.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/s390/cio/qdio_debug.c linux-2.6.38.7/drivers/s390/cio/qdio_debug.c
+--- linux-2.6.38.7/drivers/s390/cio/qdio_debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/s390/cio/qdio_debug.c	2011-04-28 19:34:15.000000000 -0400
 @@ -225,7 +225,7 @@ static int qperf_seq_open(struct inode *
  			   filp->f_path.dentry->d_inode->i_private);
  }
@@ -27164,9 +32553,20 @@ diff -urNp linux-2.6.38.2/drivers/s390/cio/qdio_debug.c linux-2.6.38.2/drivers/s
  	.owner	 = THIS_MODULE,
  	.open	 = qperf_seq_open,
  	.read	 = seq_read,
-diff -urNp linux-2.6.38.2/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.38.2/drivers/scsi/aic94xx/aic94xx_init.c
---- linux-2.6.38.2/drivers/scsi/aic94xx/aic94xx_init.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/aic94xx/aic94xx_init.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/scsi/aacraid/commctrl.c linux-2.6.38.7/drivers/scsi/aacraid/commctrl.c
+--- linux-2.6.38.7/drivers/scsi/aacraid/commctrl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/aacraid/commctrl.c	2011-05-16 21:47:08.000000000 -0400
+@@ -481,6 +481,7 @@ static int aac_send_raw_srb(struct aac_d
+ 	u32 actual_fibsize64, actual_fibsize = 0;
+ 	int i;
+ 
++	pax_track_stack();
+ 
+ 	if (dev->in_reset) {
+ 		dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
+diff -urNp linux-2.6.38.7/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.38.7/drivers/scsi/aic94xx/aic94xx_init.c
+--- linux-2.6.38.7/drivers/scsi/aic94xx/aic94xx_init.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/aic94xx/aic94xx_init.c	2011-04-28 19:34:15.000000000 -0400
 @@ -486,7 +486,7 @@ static ssize_t asd_show_update_bios(stru
  			flash_error_table[i].reason);
  }
@@ -27176,9 +32576,194 @@ diff -urNp linux-2.6.38.2/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.38.2/dri
  	asd_show_update_bios, asd_store_update_bios);
  
  static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
-diff -urNp linux-2.6.38.2/drivers/scsi/hpsa.c linux-2.6.38.2/drivers/scsi/hpsa.c
---- linux-2.6.38.2/drivers/scsi/hpsa.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/hpsa.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/scsi/bfa/bfad.c linux-2.6.38.7/drivers/scsi/bfa/bfad.c
+--- linux-2.6.38.7/drivers/scsi/bfa/bfad.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/bfa/bfad.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1027,6 +1027,8 @@ bfad_start_ops(struct bfad_s *bfad) {
+ 	struct bfad_vport_s *vport, *vport_new;
+ 	struct bfa_fcs_driver_info_s driver_info;
+ 
++	pax_track_stack();
++
+ 	/* Fill the driver_info info to fcs*/
+ 	memset(&driver_info, 0, sizeof(driver_info));
+ 	strncpy(driver_info.version, BFAD_DRIVER_VERSION,
+diff -urNp linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_lport.c linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_lport.c
+--- linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_lport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_lport.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1559,6 +1559,8 @@ bfa_fcs_lport_fdmi_build_rhba_pyld(struc
+ 	u16        len, count;
+ 	u16	templen;
+ 
++	pax_track_stack();
++
+ 	/*
+ 	 * get hba attributes
+ 	 */
+@@ -1836,6 +1838,8 @@ bfa_fcs_lport_fdmi_build_portattr_block(
+ 	u8	count = 0;
+ 	u16	templen;
+ 
++	pax_track_stack();
++
+ 	/*
+ 	 * get port attributes
+ 	 */
+diff -urNp linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_rport.c linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_rport.c
+--- linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_rport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/bfa/bfa_fcs_rport.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1844,6 +1844,8 @@ bfa_fcs_rport_process_rpsc(struct bfa_fc
+ 	struct fc_rpsc_speed_info_s speeds;
+ 	struct bfa_port_attr_s pport_attr;
+ 
++	pax_track_stack();
++
+ 	bfa_trc(port->fcs, rx_fchs->s_id);
+ 	bfa_trc(port->fcs, rx_fchs->d_id);
+ 
+diff -urNp linux-2.6.38.7/drivers/scsi/BusLogic.c linux-2.6.38.7/drivers/scsi/BusLogic.c
+--- linux-2.6.38.7/drivers/scsi/BusLogic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/BusLogic.c	2011-05-16 21:47:08.000000000 -0400
+@@ -962,6 +962,8 @@ static int __init BusLogic_InitializeFla
+ static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
+ 						    *PrototypeHostAdapter)
+ {
++	pax_track_stack();
++
+ 	/*
+ 	   If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
+ 	   Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
+diff -urNp linux-2.6.38.7/drivers/scsi/dpt_i2o.c linux-2.6.38.7/drivers/scsi/dpt_i2o.c
+--- linux-2.6.38.7/drivers/scsi/dpt_i2o.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/dpt_i2o.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1811,6 +1811,8 @@ static int adpt_i2o_passthru(adpt_hba* p
+ 	dma_addr_t addr;
+ 	ulong flags = 0;
+ 
++	pax_track_stack();
++
+ 	memset(&msg, 0, MAX_MESSAGE_SIZE*4);
+ 	// get user msg size in u32s 
+ 	if(get_user(size, &user_msg[0])){
+@@ -2317,6 +2319,8 @@ static s32 adpt_scsi_to_i2o(adpt_hba* pH
+ 	s32 rcode;
+ 	dma_addr_t addr;
+ 
++	pax_track_stack();
++
+ 	memset(msg, 0 , sizeof(msg));
+ 	len = scsi_bufflen(cmd);
+ 	direction = 0x00000000;	
+diff -urNp linux-2.6.38.7/drivers/scsi/eata.c linux-2.6.38.7/drivers/scsi/eata.c
+--- linux-2.6.38.7/drivers/scsi/eata.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/eata.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1087,6 +1087,8 @@ static int port_detect(unsigned long por
+ 	struct hostdata *ha;
+ 	char name[16];
+ 
++	pax_track_stack();
++
+ 	sprintf(name, "%s%d", driver_name, j);
+ 
+ 	if (!request_region(port_base, REGION_SIZE, driver_name)) {
+diff -urNp linux-2.6.38.7/drivers/scsi/fcoe/libfcoe.c linux-2.6.38.7/drivers/scsi/fcoe/libfcoe.c
+--- linux-2.6.38.7/drivers/scsi/fcoe/libfcoe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/fcoe/libfcoe.c	2011-05-16 21:47:08.000000000 -0400
+@@ -2484,6 +2484,8 @@ static int fcoe_ctlr_vn_recv(struct fcoe
+ 	} buf;
+ 	int rc;
+ 
++	pax_track_stack();
++
+ 	fiph = (struct fip_header *)skb->data;
+ 	sub = fiph->fip_subcode;
+ 
+diff -urNp linux-2.6.38.7/drivers/scsi/gdth.c linux-2.6.38.7/drivers/scsi/gdth.c
+--- linux-2.6.38.7/drivers/scsi/gdth.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/gdth.c	2011-05-16 21:47:08.000000000 -0400
+@@ -4107,6 +4107,8 @@ static int ioc_lockdrv(void __user *arg)
+     unsigned long flags;
+     gdth_ha_str *ha;
+ 
++    pax_track_stack();
++
+     if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
+         return -EFAULT;
+     ha = gdth_find_ha(ldrv.ionode);
+@@ -4139,6 +4141,8 @@ static int ioc_resetdrv(void __user *arg
+     gdth_ha_str *ha;
+     int rval;
+ 
++    pax_track_stack();
++
+     if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
+         res.number >= MAX_HDRIVES)
+         return -EFAULT;
+@@ -4174,6 +4178,8 @@ static int ioc_general(void __user *arg,
+     gdth_ha_str *ha;
+     int rval;
+ 
++    pax_track_stack();
++
+     if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
+         return -EFAULT;
+     ha = gdth_find_ha(gen.ionode);
+@@ -4642,6 +4648,9 @@ static void gdth_flush(gdth_ha_str *ha)
+     int             i;
+     gdth_cmd_str    gdtcmd;
+     char            cmnd[MAX_COMMAND_SIZE];   
++
++    pax_track_stack();
++
+     memset(cmnd, 0xff, MAX_COMMAND_SIZE);
+ 
+     TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
+diff -urNp linux-2.6.38.7/drivers/scsi/gdth_proc.c linux-2.6.38.7/drivers/scsi/gdth_proc.c
+--- linux-2.6.38.7/drivers/scsi/gdth_proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/gdth_proc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -47,6 +47,9 @@ static int gdth_set_asc_info(struct Scsi
+     u64         paddr;
+ 
+     char            cmnd[MAX_COMMAND_SIZE];
++
++    pax_track_stack();
++
+     memset(cmnd, 0xff, 12);
+     memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
+ 
+@@ -175,6 +178,8 @@ static int gdth_get_info(char *buffer,ch
+     gdth_hget_str *phg;
+     char cmnd[MAX_COMMAND_SIZE];
+ 
++    pax_track_stack();
++
+     gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
+     estr = kmalloc(sizeof(*estr), GFP_KERNEL);
+     if (!gdtcmd || !estr)
+diff -urNp linux-2.6.38.7/drivers/scsi/hosts.c linux-2.6.38.7/drivers/scsi/hosts.c
+--- linux-2.6.38.7/drivers/scsi/hosts.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/hosts.c	2011-04-28 19:57:25.000000000 -0400
+@@ -42,7 +42,7 @@
+ #include "scsi_logging.h"
+ 
+ 
+-static atomic_t scsi_host_next_hn;	/* host_no for next new host */
++static atomic_unchecked_t scsi_host_next_hn;	/* host_no for next new host */
+ 
+ 
+ static void scsi_host_cls_release(struct device *dev)
+@@ -354,7 +354,7 @@ struct Scsi_Host *scsi_host_alloc(struct
+ 	 * subtract one because we increment first then return, but we need to
+ 	 * know what the next host number was before increment
+ 	 */
+-	shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
++	shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
+ 	shost->dma_channel = 0xff;
+ 
+ 	/* These three are default values which can be overridden */
+diff -urNp linux-2.6.38.7/drivers/scsi/hpsa.c linux-2.6.38.7/drivers/scsi/hpsa.c
+--- linux-2.6.38.7/drivers/scsi/hpsa.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/hpsa.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2281,6 +2281,8 @@ static int hpsa_ioctl32_passthru(struct 
  	int err;
  	u32 cp;
@@ -27188,9 +32773,9 @@ diff -urNp linux-2.6.38.2/drivers/scsi/hpsa.c linux-2.6.38.2/drivers/scsi/hpsa.c
  	err = 0;
  	err |= copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
  			   sizeof(arg64.LUN_info));
-diff -urNp linux-2.6.38.2/drivers/scsi/ipr.c linux-2.6.38.2/drivers/scsi/ipr.c
---- linux-2.6.38.2/drivers/scsi/ipr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/ipr.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/scsi/ipr.c linux-2.6.38.7/drivers/scsi/ipr.c
+--- linux-2.6.38.7/drivers/scsi/ipr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/ipr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -6207,7 +6207,7 @@ static bool ipr_qc_fill_rtf(struct ata_q
  	return true;
  }
@@ -27200,9 +32785,9 @@ diff -urNp linux-2.6.38.2/drivers/scsi/ipr.c linux-2.6.38.2/drivers/scsi/ipr.c
  	.phy_reset = ipr_ata_phy_reset,
  	.hardreset = ipr_sata_reset,
  	.post_internal_cmd = ipr_ata_post_internal,
-diff -urNp linux-2.6.38.2/drivers/scsi/libfc/fc_exch.c linux-2.6.38.2/drivers/scsi/libfc/fc_exch.c
---- linux-2.6.38.2/drivers/scsi/libfc/fc_exch.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/libfc/fc_exch.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/scsi/libfc/fc_exch.c linux-2.6.38.7/drivers/scsi/libfc/fc_exch.c
+--- linux-2.6.38.7/drivers/scsi/libfc/fc_exch.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/libfc/fc_exch.c	2011-04-28 19:34:15.000000000 -0400
 @@ -105,12 +105,12 @@ struct fc_exch_mgr {
  	 * all together if not used XXX
  	 */
@@ -27324,10 +32909,10 @@ diff -urNp linux-2.6.38.2/drivers/scsi/libfc/fc_exch.c linux-2.6.38.2/drivers/sc
  
  	fc_frame_free(fp);
  }
-diff -urNp linux-2.6.38.2/drivers/scsi/libsas/sas_ata.c linux-2.6.38.2/drivers/scsi/libsas/sas_ata.c
---- linux-2.6.38.2/drivers/scsi/libsas/sas_ata.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/libsas/sas_ata.c	2011-03-21 18:31:35.000000000 -0400
-@@ -348,10 +348,10 @@ static int sas_ata_scr_read(struct ata_l
+diff -urNp linux-2.6.38.7/drivers/scsi/libsas/sas_ata.c linux-2.6.38.7/drivers/scsi/libsas/sas_ata.c
+--- linux-2.6.38.7/drivers/scsi/libsas/sas_ata.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/libsas/sas_ata.c	2011-04-28 19:34:15.000000000 -0400
+@@ -348,7 +348,7 @@ static int sas_ata_scr_read(struct ata_l
  	}
  }
  
@@ -27335,26 +32920,316 @@ diff -urNp linux-2.6.38.2/drivers/scsi/libsas/sas_ata.c linux-2.6.38.2/drivers/s
 +static const struct ata_port_operations sas_sata_ops = {
  	.phy_reset		= sas_ata_phy_reset,
  	.post_internal_cmd	= sas_ata_post_internal,
--	.qc_defer               = ata_std_qc_defer,
-+	.qc_defer		= ata_std_qc_defer,
- 	.qc_prep		= ata_noop_qc_prep,
- 	.qc_issue		= sas_ata_qc_issue,
- 	.qc_fill_rtf		= sas_ata_qc_fill_rtf,
-diff -urNp linux-2.6.38.2/drivers/scsi/mpt2sas/mpt2sas_debug.h linux-2.6.38.2/drivers/scsi/mpt2sas/mpt2sas_debug.h
---- linux-2.6.38.2/drivers/scsi/mpt2sas/mpt2sas_debug.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/mpt2sas/mpt2sas_debug.h	2011-03-21 18:31:35.000000000 -0400
-@@ -79,7 +79,7 @@
- 		CMD;						\
+ 	.qc_defer               = ata_std_qc_defer,
+diff -urNp linux-2.6.38.7/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.38.7/drivers/scsi/lpfc/lpfc_debugfs.c
+--- linux-2.6.38.7/drivers/scsi/lpfc/lpfc_debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/lpfc/lpfc_debugfs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -125,7 +125,7 @@ struct lpfc_debug {
+ 	int  len;
+ };
+ 
+-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
++static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
+ static unsigned long lpfc_debugfs_start_time = 0L;
+ 
+ /**
+@@ -159,7 +159,7 @@ lpfc_debugfs_disc_trc_data(struct lpfc_v
+ 	lpfc_debugfs_enable = 0;
+ 
+ 	len = 0;
+-	index = (atomic_read(&vport->disc_trc_cnt) + 1) &
++	index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
+ 		(lpfc_debugfs_max_disc_trc - 1);
+ 	for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
+ 		dtp = vport->disc_trc + i;
+@@ -220,7 +220,7 @@ lpfc_debugfs_slow_ring_trc_data(struct l
+ 	lpfc_debugfs_enable = 0;
+ 
+ 	len = 0;
+-	index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
++	index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
+ 		(lpfc_debugfs_max_slow_ring_trc - 1);
+ 	for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
+ 		dtp = phba->slow_ring_trc + i;
+@@ -398,6 +398,8 @@ lpfc_debugfs_dumpHBASlim_data(struct lpf
+ 	uint32_t *ptr;
+ 	char buffer[1024];
+ 
++	pax_track_stack();
++
+ 	off = 0;
+ 	spin_lock_irq(&phba->hbalock);
+ 
+@@ -635,14 +637,14 @@ lpfc_debugfs_disc_trc(struct lpfc_vport 
+ 		!vport || !vport->disc_trc)
+ 		return;
+ 
+-	index = atomic_inc_return(&vport->disc_trc_cnt) &
++	index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
+ 		(lpfc_debugfs_max_disc_trc - 1);
+ 	dtp = vport->disc_trc + index;
+ 	dtp->fmt = fmt;
+ 	dtp->data1 = data1;
+ 	dtp->data2 = data2;
+ 	dtp->data3 = data3;
+-	dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
++	dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
+ 	dtp->jif = jiffies;
+ #endif
+ 	return;
+@@ -673,14 +675,14 @@ lpfc_debugfs_slow_ring_trc(struct lpfc_h
+ 		!phba || !phba->slow_ring_trc)
+ 		return;
+ 
+-	index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
++	index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
+ 		(lpfc_debugfs_max_slow_ring_trc - 1);
+ 	dtp = phba->slow_ring_trc + index;
+ 	dtp->fmt = fmt;
+ 	dtp->data1 = data1;
+ 	dtp->data2 = data2;
+ 	dtp->data3 = data3;
+-	dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
++	dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
+ 	dtp->jif = jiffies;
+ #endif
+ 	return;
+@@ -1365,7 +1367,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
+ 						 "slow_ring buffer\n");
+ 				goto debug_failed;
+ 			}
+-			atomic_set(&phba->slow_ring_trc_cnt, 0);
++			atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
+ 			memset(phba->slow_ring_trc, 0,
+ 				(sizeof(struct lpfc_debugfs_trc) *
+ 				lpfc_debugfs_max_slow_ring_trc));
+@@ -1411,7 +1413,7 @@ lpfc_debugfs_initialize(struct lpfc_vpor
+ 				 "buffer\n");
+ 		goto debug_failed;
+ 	}
+-	atomic_set(&vport->disc_trc_cnt, 0);
++	atomic_set_unchecked(&vport->disc_trc_cnt, 0);
+ 
+ 	snprintf(name, sizeof(name), "discovery_trace");
+ 	vport->debug_disc_trc =
+diff -urNp linux-2.6.38.7/drivers/scsi/lpfc/lpfc.h linux-2.6.38.7/drivers/scsi/lpfc/lpfc.h
+--- linux-2.6.38.7/drivers/scsi/lpfc/lpfc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/lpfc/lpfc.h	2011-04-28 19:57:25.000000000 -0400
+@@ -414,7 +414,7 @@ struct lpfc_vport {
+ 	struct dentry *debug_nodelist;
+ 	struct dentry *vport_debugfs_root;
+ 	struct lpfc_debugfs_trc *disc_trc;
+-	atomic_t disc_trc_cnt;
++	atomic_unchecked_t disc_trc_cnt;
+ #endif
+ 	uint8_t stat_data_enabled;
+ 	uint8_t stat_data_blocked;
+@@ -776,8 +776,8 @@ struct lpfc_hba {
+ 	struct timer_list fabric_block_timer;
+ 	unsigned long bit_flags;
+ #define	FABRIC_COMANDS_BLOCKED	0
+-	atomic_t num_rsrc_err;
+-	atomic_t num_cmd_success;
++	atomic_unchecked_t num_rsrc_err;
++	atomic_unchecked_t num_cmd_success;
+ 	unsigned long last_rsrc_error_time;
+ 	unsigned long last_ramp_down_time;
+ 	unsigned long last_ramp_up_time;
+@@ -791,7 +791,7 @@ struct lpfc_hba {
+ 	struct dentry *debug_dumpDif;    /* BlockGuard BPL*/
+ 	struct dentry *debug_slow_ring_trc;
+ 	struct lpfc_debugfs_trc *slow_ring_trc;
+-	atomic_t slow_ring_trc_cnt;
++	atomic_unchecked_t slow_ring_trc_cnt;
+ #endif
+ 
+ 	/* Used for deferred freeing of ELS data buffers */
+diff -urNp linux-2.6.38.7/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.38.7/drivers/scsi/lpfc/lpfc_scsi.c
+--- linux-2.6.38.7/drivers/scsi/lpfc/lpfc_scsi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/lpfc/lpfc_scsi.c	2011-04-28 19:57:25.000000000 -0400
+@@ -297,7 +297,7 @@ lpfc_rampdown_queue_depth(struct lpfc_hb
+ 	uint32_t evt_posted;
+ 
+ 	spin_lock_irqsave(&phba->hbalock, flags);
+-	atomic_inc(&phba->num_rsrc_err);
++	atomic_inc_unchecked(&phba->num_rsrc_err);
+ 	phba->last_rsrc_error_time = jiffies;
+ 
+ 	if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
+@@ -338,7 +338,7 @@ lpfc_rampup_queue_depth(struct lpfc_vpor
+ 	unsigned long flags;
+ 	struct lpfc_hba *phba = vport->phba;
+ 	uint32_t evt_posted;
+-	atomic_inc(&phba->num_cmd_success);
++	atomic_inc_unchecked(&phba->num_cmd_success);
+ 
+ 	if (vport->cfg_lun_queue_depth <= queue_depth)
+ 		return;
+@@ -382,8 +382,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
+ 	unsigned long num_rsrc_err, num_cmd_success;
+ 	int i;
+ 
+-	num_rsrc_err = atomic_read(&phba->num_rsrc_err);
+-	num_cmd_success = atomic_read(&phba->num_cmd_success);
++	num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
++	num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
+ 
+ 	vports = lpfc_create_vport_work_array(phba);
+ 	if (vports != NULL)
+@@ -403,8 +403,8 @@ lpfc_ramp_down_queue_handler(struct lpfc
+ 			}
+ 		}
+ 	lpfc_destroy_vport_work_array(phba, vports);
+-	atomic_set(&phba->num_rsrc_err, 0);
+-	atomic_set(&phba->num_cmd_success, 0);
++	atomic_set_unchecked(&phba->num_rsrc_err, 0);
++	atomic_set_unchecked(&phba->num_cmd_success, 0);
  }
- #else
--#define MPT_CHECK_LOGGING(IOC, CMD, BITS)
-+#define MPT_CHECK_LOGGING(IOC, CMD, BITS) do {} while (0)
- #endif /* CONFIG_SCSI_MPT2SAS_LOGGING */
  
+ /**
+@@ -438,8 +438,8 @@ lpfc_ramp_up_queue_handler(struct lpfc_h
+ 			}
+ 		}
+ 	lpfc_destroy_vport_work_array(phba, vports);
+-	atomic_set(&phba->num_rsrc_err, 0);
+-	atomic_set(&phba->num_cmd_success, 0);
++	atomic_set_unchecked(&phba->num_rsrc_err, 0);
++	atomic_set_unchecked(&phba->num_cmd_success, 0);
+ }
  
-diff -urNp linux-2.6.38.2/drivers/scsi/qla2xxx/qla_os.c linux-2.6.38.2/drivers/scsi/qla2xxx/qla_os.c
---- linux-2.6.38.2/drivers/scsi/qla2xxx/qla_os.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/qla2xxx/qla_os.c	2011-03-21 18:31:35.000000000 -0400
+ /**
+diff -urNp linux-2.6.38.7/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.38.7/drivers/scsi/megaraid/megaraid_mbox.c
+--- linux-2.6.38.7/drivers/scsi/megaraid/megaraid_mbox.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/megaraid/megaraid_mbox.c	2011-05-16 21:47:08.000000000 -0400
+@@ -3510,6 +3510,8 @@ megaraid_cmm_register(adapter_t *adapter
+ 	int		rval;
+ 	int		i;
+ 
++	pax_track_stack();
++
+ 	// Allocate memory for the base list of scb for management module.
+ 	adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
+ 
+diff -urNp linux-2.6.38.7/drivers/scsi/osd/osd_initiator.c linux-2.6.38.7/drivers/scsi/osd/osd_initiator.c
+--- linux-2.6.38.7/drivers/scsi/osd/osd_initiator.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/osd/osd_initiator.c	2011-05-16 21:47:08.000000000 -0400
+@@ -97,6 +97,8 @@ static int _osd_get_print_system_info(st
+ 	int nelem = ARRAY_SIZE(get_attrs), a = 0;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	or = osd_start_request(od, GFP_KERNEL);
+ 	if (!or)
+ 		return -ENOMEM;
+diff -urNp linux-2.6.38.7/drivers/scsi/pmcraid.c linux-2.6.38.7/drivers/scsi/pmcraid.c
+--- linux-2.6.38.7/drivers/scsi/pmcraid.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/pmcraid.c	2011-05-10 22:08:57.000000000 -0400
+@@ -201,8 +201,8 @@ static int pmcraid_slave_alloc(struct sc
+ 		res->scsi_dev = scsi_dev;
+ 		scsi_dev->hostdata = res;
+ 		res->change_detected = 0;
+-		atomic_set(&res->read_failures, 0);
+-		atomic_set(&res->write_failures, 0);
++		atomic_set_unchecked(&res->read_failures, 0);
++		atomic_set_unchecked(&res->write_failures, 0);
+ 		rc = 0;
+ 	}
+ 	spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
+@@ -2677,9 +2677,9 @@ static int pmcraid_error_handler(struct 
+ 
+ 	/* If this was a SCSI read/write command keep count of errors */
+ 	if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
+-		atomic_inc(&res->read_failures);
++		atomic_inc_unchecked(&res->read_failures);
+ 	else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
+-		atomic_inc(&res->write_failures);
++		atomic_inc_unchecked(&res->write_failures);
+ 
+ 	if (!RES_IS_GSCSI(res->cfg_entry) &&
+ 		masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
+@@ -3535,7 +3535,7 @@ static int pmcraid_queuecommand_lck(
+ 	 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
+ 	 * hrrq_id assigned here in queuecommand
+ 	 */
+-	ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
++	ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
+ 			  pinstance->num_hrrq;
+ 	cmd->cmd_done = pmcraid_io_done;
+ 
+@@ -3860,7 +3860,7 @@ static long pmcraid_ioctl_passthrough(
+ 	 * block of scsi_cmd which is re-used (e.g. cancel/abort), which uses
+ 	 * hrrq_id assigned here in queuecommand
+ 	 */
+-	ioarcb->hrrq_id = atomic_add_return(1, &(pinstance->last_message_id)) %
++	ioarcb->hrrq_id = atomic_add_return_unchecked(1, &(pinstance->last_message_id)) %
+ 			  pinstance->num_hrrq;
+ 
+ 	if (request_size) {
+@@ -4495,7 +4495,7 @@ static void pmcraid_worker_function(stru
+ 
+ 	pinstance = container_of(workp, struct pmcraid_instance, worker_q);
+ 	/* add resources only after host is added into system */
+-	if (!atomic_read(&pinstance->expose_resources))
++	if (!atomic_read_unchecked(&pinstance->expose_resources))
+ 		return;
+ 
+ 	fw_version = be16_to_cpu(pinstance->inq_data->fw_version);
+@@ -5329,8 +5329,8 @@ static int __devinit pmcraid_init_instan
+ 	init_waitqueue_head(&pinstance->reset_wait_q);
+ 
+ 	atomic_set(&pinstance->outstanding_cmds, 0);
+-	atomic_set(&pinstance->last_message_id, 0);
+-	atomic_set(&pinstance->expose_resources, 0);
++	atomic_set_unchecked(&pinstance->last_message_id, 0);
++	atomic_set_unchecked(&pinstance->expose_resources, 0);
+ 
+ 	INIT_LIST_HEAD(&pinstance->free_res_q);
+ 	INIT_LIST_HEAD(&pinstance->used_res_q);
+@@ -6045,7 +6045,7 @@ static int __devinit pmcraid_probe(
+ 	/* Schedule worker thread to handle CCN and take care of adding and
+ 	 * removing devices to OS
+ 	 */
+-	atomic_set(&pinstance->expose_resources, 1);
++	atomic_set_unchecked(&pinstance->expose_resources, 1);
+ 	schedule_work(&pinstance->worker_q);
+ 	return rc;
+ 
+diff -urNp linux-2.6.38.7/drivers/scsi/pmcraid.h linux-2.6.38.7/drivers/scsi/pmcraid.h
+--- linux-2.6.38.7/drivers/scsi/pmcraid.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/pmcraid.h	2011-04-28 19:57:25.000000000 -0400
+@@ -750,7 +750,7 @@ struct pmcraid_instance {
+ 	struct pmcraid_isr_param hrrq_vector[PMCRAID_NUM_MSIX_VECTORS];
+ 
+ 	/* Message id as filled in last fired IOARCB, used to identify HRRQ */
+-	atomic_t last_message_id;
++	atomic_unchecked_t last_message_id;
+ 
+ 	/* configuration table */
+ 	struct pmcraid_config_table *cfg_table;
+@@ -779,7 +779,7 @@ struct pmcraid_instance {
+ 	atomic_t outstanding_cmds;
+ 
+ 	/* should add/delete resources to mid-layer now ?*/
+-	atomic_t expose_resources;
++	atomic_unchecked_t expose_resources;
+ 
+ 
+ 
+@@ -815,8 +815,8 @@ struct pmcraid_resource_entry {
+ 		struct pmcraid_config_table_entry_ext cfg_entry_ext;
+ 	};
+ 	struct scsi_device *scsi_dev;	/* Link scsi_device structure */
+-	atomic_t read_failures;		/* count of failed READ commands */
+-	atomic_t write_failures;	/* count of failed WRITE commands */
++	atomic_unchecked_t read_failures;	/* count of failed READ commands */
++	atomic_unchecked_t write_failures;	/* count of failed WRITE commands */
+ 
+ 	/* To indicate add/delete/modify during CCN */
+ 	u8 change_detected;
+diff -urNp linux-2.6.38.7/drivers/scsi/qla2xxx/qla_os.c linux-2.6.38.7/drivers/scsi/qla2xxx/qla_os.c
+--- linux-2.6.38.7/drivers/scsi/qla2xxx/qla_os.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/qla2xxx/qla_os.c	2011-04-28 19:34:15.000000000 -0400
 @@ -4096,7 +4096,7 @@ static struct pci_driver qla2xxx_pci_dri
  	.err_handler	= &qla2xxx_err_handler,
  };
@@ -27364,33 +33239,229 @@ diff -urNp linux-2.6.38.2/drivers/scsi/qla2xxx/qla_os.c linux-2.6.38.2/drivers/s
  	.owner = THIS_MODULE,
  	.llseek = noop_llseek,
  };
-diff -urNp linux-2.6.38.2/drivers/scsi/scsi_logging.h linux-2.6.38.2/drivers/scsi/scsi_logging.h
---- linux-2.6.38.2/drivers/scsi/scsi_logging.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/scsi_logging.h	2011-03-21 18:31:35.000000000 -0400
-@@ -51,7 +51,7 @@ do {								\
- 		} while (0);					\
- } while (0)
- #else
--#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD)
-+#define SCSI_CHECK_LOGGING(SHIFT, BITS, LEVEL, CMD) do {} while (0)
- #endif /* CONFIG_SCSI_LOGGING */
+diff -urNp linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_def.h
+--- linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_def.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_def.h	2011-04-28 19:57:25.000000000 -0400
+@@ -256,7 +256,7 @@ struct ddb_entry {
+ 	atomic_t retry_relogin_timer; /* Min Time between relogins
+ 				       * (4000 only) */
+ 	atomic_t relogin_timer;	/* Max Time to wait for relogin to complete */
+-	atomic_t relogin_retry_count; /* Num of times relogin has been
++	atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
+ 				       * retried */
+ 
+ 	uint16_t port;
+diff -urNp linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_init.c
+--- linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_init.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_init.c	2011-04-28 19:57:25.000000000 -0400
+@@ -680,7 +680,7 @@ static struct ddb_entry * qla4xxx_alloc_
+ 	ddb_entry->fw_ddb_index = fw_ddb_index;
+ 	atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
+ 	atomic_set(&ddb_entry->relogin_timer, 0);
+-	atomic_set(&ddb_entry->relogin_retry_count, 0);
++	atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
+ 	atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
+ 	list_add_tail(&ddb_entry->list, &ha->ddb_list);
+ 	ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
+@@ -1570,7 +1570,7 @@ int qla4xxx_process_ddb_changed(struct s
+ 	/* Device is back online. */
+ 	if (ddb_entry->fw_ddb_device_state == DDB_DS_SESSION_ACTIVE) {
+ 		atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
+-		atomic_set(&ddb_entry->relogin_retry_count, 0);
++		atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
+ 		atomic_set(&ddb_entry->relogin_timer, 0);
+ 		clear_bit(DF_RELOGIN, &ddb_entry->flags);
+ 		clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
+diff -urNp linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_os.c
+--- linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_os.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/qla4xxx/ql4_os.c	2011-04-28 19:57:25.000000000 -0400
+@@ -801,13 +801,13 @@ static void qla4xxx_timer(struct scsi_ql
+ 			    ddb_entry->fw_ddb_device_state ==
+ 			    DDB_DS_SESSION_FAILED) {
+ 				/* Reset retry relogin timer */
+-				atomic_inc(&ddb_entry->relogin_retry_count);
++				atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
+ 				DEBUG2(printk("scsi%ld: ddb [%d] relogin"
+ 					      " timed out-retrying"
+ 					      " relogin (%d)\n",
+ 					      ha->host_no,
+ 					      ddb_entry->fw_ddb_index,
+-					      atomic_read(&ddb_entry->
++					      atomic_read_unchecked(&ddb_entry->
+ 							  relogin_retry_count))
+ 					);
+ 				start_dpc++;
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi.c linux-2.6.38.7/drivers/scsi/scsi.c
+--- linux-2.6.38.7/drivers/scsi/scsi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi.c	2011-04-28 19:57:25.000000000 -0400
+@@ -655,7 +655,7 @@ int scsi_dispatch_cmd(struct scsi_cmnd *
+ 	unsigned long timeout;
+ 	int rtn = 0;
+ 
+-	atomic_inc(&cmd->device->iorequest_cnt);
++	atomic_inc_unchecked(&cmd->device->iorequest_cnt);
+ 
+ 	/* check if the device is still usable */
+ 	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_debug.c linux-2.6.38.7/drivers/scsi/scsi_debug.c
+--- linux-2.6.38.7/drivers/scsi/scsi_debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_debug.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1476,6 +1476,8 @@ static int resp_mode_select(struct scsi_
+ 	unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
+ 	unsigned char *cmd = (unsigned char *)scp->cmnd;
+ 
++	pax_track_stack();
++
+ 	if ((errsts = check_readiness(scp, 1, devip)))
+ 		return errsts;
+ 	memset(arr, 0, sizeof(arr));
+@@ -1573,6 +1575,8 @@ static int resp_log_sense(struct scsi_cm
+ 	unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
+ 	unsigned char *cmd = (unsigned char *)scp->cmnd;
+ 
++	pax_track_stack();
++
+ 	if ((errsts = check_readiness(scp, 1, devip)))
+ 		return errsts;
+ 	memset(arr, 0, sizeof(arr));
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_lib.c linux-2.6.38.7/drivers/scsi/scsi_lib.c
+--- linux-2.6.38.7/drivers/scsi/scsi_lib.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_lib.c	2011-05-10 22:08:57.000000000 -0400
+@@ -1381,7 +1381,7 @@ static void scsi_kill_request(struct req
+ 	shost = sdev->host;
+ 	scsi_init_cmd_errh(cmd);
+ 	cmd->result = DID_NO_CONNECT << 16;
+-	atomic_inc(&cmd->device->iorequest_cnt);
++	atomic_inc_unchecked(&cmd->device->iorequest_cnt);
+ 
+ 	/*
+ 	 * SCSI request completion path will do scsi_device_unbusy(),
+@@ -1407,9 +1407,9 @@ static void scsi_softirq_done(struct req
+ 
+ 	INIT_LIST_HEAD(&cmd->eh_entry);
+ 
+-	atomic_inc(&cmd->device->iodone_cnt);
++	atomic_inc_unchecked(&cmd->device->iodone_cnt);
+ 	if (cmd->result)
+-		atomic_inc(&cmd->device->ioerr_cnt);
++		atomic_inc_unchecked(&cmd->device->ioerr_cnt);
+ 
+ 	disposition = scsi_decide_disposition(cmd);
+ 	if (disposition != SUCCESS &&
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_sysfs.c linux-2.6.38.7/drivers/scsi/scsi_sysfs.c
+--- linux-2.6.38.7/drivers/scsi/scsi_sysfs.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_sysfs.c	2011-05-10 22:08:57.000000000 -0400
+@@ -621,7 +621,7 @@ show_iostat_##field(struct device *dev, 
+ 		    char *buf)						\
+ {									\
+ 	struct scsi_device *sdev = to_scsi_device(dev);			\
+-	unsigned long long count = atomic_read(&sdev->field);		\
++	unsigned long long count = atomic_read_unchecked(&sdev->field);	\
+ 	return snprintf(buf, 20, "0x%llx\n", count);			\
+ }									\
+ static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_transport_fc.c linux-2.6.38.7/drivers/scsi/scsi_transport_fc.c
+--- linux-2.6.38.7/drivers/scsi/scsi_transport_fc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_transport_fc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -485,7 +485,7 @@ static DECLARE_TRANSPORT_CLASS(fc_vport_
+  * Netlink Infrastructure
+  */
+ 
+-static atomic_t fc_event_seq;
++static atomic_unchecked_t fc_event_seq;
+ 
+ /**
+  * fc_get_event_number - Obtain the next sequential FC event number
+@@ -498,7 +498,7 @@ static atomic_t fc_event_seq;
+ u32
+ fc_get_event_number(void)
+ {
+-	return atomic_add_return(1, &fc_event_seq);
++	return atomic_add_return_unchecked(1, &fc_event_seq);
+ }
+ EXPORT_SYMBOL(fc_get_event_number);
+ 
+@@ -646,7 +646,7 @@ static __init int fc_transport_init(void
+ {
+ 	int error;
+ 
+-	atomic_set(&fc_event_seq, 0);
++	atomic_set_unchecked(&fc_event_seq, 0);
+ 
+ 	error = transport_class_register(&fc_host_class);
+ 	if (error)
+@@ -836,7 +836,7 @@ static int fc_str_to_dev_loss(const char
+ 	char *cp;
+ 
+ 	*val = simple_strtoul(buf, &cp, 0);
+-	if ((*cp && (*cp != '\n')) || (*val < 0))
++	if (*cp && (*cp != '\n'))
+ 		return -EINVAL;
+ 	/*
+ 	 * Check for overflow; dev_loss_tmo is u32
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_transport_iscsi.c linux-2.6.38.7/drivers/scsi/scsi_transport_iscsi.c
+--- linux-2.6.38.7/drivers/scsi/scsi_transport_iscsi.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_transport_iscsi.c	2011-04-28 19:57:25.000000000 -0400
+@@ -83,7 +83,7 @@ struct iscsi_internal {
+ 	struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
+ };
+ 
+-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
++static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
+ static struct workqueue_struct *iscsi_eh_timer_workq;
  
  /*
-diff -urNp linux-2.6.38.2/drivers/scsi/scsi_transport_iscsi.c linux-2.6.38.2/drivers/scsi/scsi_transport_iscsi.c
---- linux-2.6.38.2/drivers/scsi/scsi_transport_iscsi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/scsi_transport_iscsi.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1847,7 +1847,7 @@ store_priv_session_##field(struct device
- #define iscsi_priv_session_rw_attr(field, format)			\
- 	iscsi_priv_session_attr_show(field, format)			\
- 	iscsi_priv_session_attr_store(field)				\
--static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO | S_IWUGO,		\
-+static ISCSI_CLASS_ATTR(priv_sess, field, S_IRUGO | S_IWUSR,		\
- 			show_priv_session_##field,			\
- 			store_priv_session_##field)
- iscsi_priv_session_rw_attr(recovery_tmo, "%d");
-diff -urNp linux-2.6.38.2/drivers/scsi/sg.c linux-2.6.38.2/drivers/scsi/sg.c
---- linux-2.6.38.2/drivers/scsi/sg.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/scsi/sg.c	2011-03-21 18:31:35.000000000 -0400
+@@ -761,7 +761,7 @@ int iscsi_add_session(struct iscsi_cls_s
+ 	int err;
+ 
+ 	ihost = shost->shost_data;
+-	session->sid = atomic_add_return(1, &iscsi_session_nr);
++	session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
+ 
+ 	if (id == ISCSI_MAX_TARGET) {
+ 		for (id = 0; id < ISCSI_MAX_TARGET; id++) {
+@@ -2130,7 +2130,7 @@ static __init int iscsi_transport_init(v
+ 	printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
+ 		ISCSI_TRANSPORT_VERSION);
+ 
+-	atomic_set(&iscsi_session_nr, 0);
++	atomic_set_unchecked(&iscsi_session_nr, 0);
+ 
+ 	err = class_register(&iscsi_transport_class);
+ 	if (err)
+diff -urNp linux-2.6.38.7/drivers/scsi/scsi_transport_srp.c linux-2.6.38.7/drivers/scsi/scsi_transport_srp.c
+--- linux-2.6.38.7/drivers/scsi/scsi_transport_srp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/scsi_transport_srp.c	2011-04-28 19:57:25.000000000 -0400
+@@ -33,7 +33,7 @@
+ #include "scsi_transport_srp_internal.h"
+ 
+ struct srp_host_attrs {
+-	atomic_t next_port_id;
++	atomic_unchecked_t next_port_id;
+ };
+ #define to_srp_host_attrs(host)	((struct srp_host_attrs *)(host)->shost_data)
+ 
+@@ -62,7 +62,7 @@ static int srp_host_setup(struct transpo
+ 	struct Scsi_Host *shost = dev_to_shost(dev);
+ 	struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
+ 
+-	atomic_set(&srp_host->next_port_id, 0);
++	atomic_set_unchecked(&srp_host->next_port_id, 0);
+ 	return 0;
+ }
+ 
+@@ -211,7 +211,7 @@ struct srp_rport *srp_rport_add(struct S
+ 	memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
+ 	rport->roles = ids->roles;
+ 
+-	id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
++	id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
+ 	dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
+ 
+ 	transport_setup_device(&rport->dev);
+diff -urNp linux-2.6.38.7/drivers/scsi/sg.c linux-2.6.38.7/drivers/scsi/sg.c
+--- linux-2.6.38.7/drivers/scsi/sg.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/sg.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2310,7 +2310,7 @@ struct sg_proc_leaf {
  	const struct file_operations * fops;
  };
@@ -27409,9 +33480,45 @@ diff -urNp linux-2.6.38.2/drivers/scsi/sg.c linux-2.6.38.2/drivers/scsi/sg.c
  
  	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
  	if (!sg_proc_sgp)
-diff -urNp linux-2.6.38.2/drivers/staging/autofs/root.c linux-2.6.38.2/drivers/staging/autofs/root.c
---- linux-2.6.38.2/drivers/staging/autofs/root.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/autofs/root.c	2011-03-28 16:57:18.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.38.7/drivers/scsi/sym53c8xx_2/sym_glue.c
+--- linux-2.6.38.7/drivers/scsi/sym53c8xx_2/sym_glue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/sym53c8xx_2/sym_glue.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1756,6 +1756,8 @@ static int __devinit sym2_probe(struct p
+ 	int do_iounmap = 0;
+ 	int do_disable_device = 1;
+ 
++	pax_track_stack();
++
+ 	memset(&sym_dev, 0, sizeof(sym_dev));
+ 	memset(&nvram, 0, sizeof(nvram));
+ 	sym_dev.pdev = pdev;
+diff -urNp linux-2.6.38.7/drivers/scsi/vmw_pvscsi.c linux-2.6.38.7/drivers/scsi/vmw_pvscsi.c
+--- linux-2.6.38.7/drivers/scsi/vmw_pvscsi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/scsi/vmw_pvscsi.c	2011-05-16 21:47:08.000000000 -0400
+@@ -447,6 +447,8 @@ static void pvscsi_setup_all_rings(const
+ 	dma_addr_t base;
+ 	unsigned i;
+ 
++	pax_track_stack();
++
+ 	cmd.ringsStatePPN   = adapter->ringStatePA >> PAGE_SHIFT;
+ 	cmd.reqRingNumPages = adapter->req_pages;
+ 	cmd.cmpRingNumPages = adapter->cmp_pages;
+diff -urNp linux-2.6.38.7/drivers/spi/spi.c linux-2.6.38.7/drivers/spi/spi.c
+--- linux-2.6.38.7/drivers/spi/spi.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/spi/spi.c	2011-05-11 18:34:57.000000000 -0400
+@@ -1023,7 +1023,7 @@ int spi_bus_unlock(struct spi_master *ma
+ EXPORT_SYMBOL_GPL(spi_bus_unlock);
+ 
+ /* portable code must never pass more than 32 bytes */
+-#define	SPI_BUFSIZ	max(32,SMP_CACHE_BYTES)
++#define	SPI_BUFSIZ	max(32U,SMP_CACHE_BYTES)
+ 
+ static u8	*buf;
+ 
+diff -urNp linux-2.6.38.7/drivers/staging/autofs/root.c linux-2.6.38.7/drivers/staging/autofs/root.c
+--- linux-2.6.38.7/drivers/staging/autofs/root.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/autofs/root.c	2011-04-28 19:34:15.000000000 -0400
 @@ -311,7 +311,8 @@ static int autofs_root_symlink(struct in
  	set_bit(n,sbi->symlink_bitmap);
  	sl = &sbi->symlink[n];
@@ -27422,9 +33529,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/autofs/root.c linux-2.6.38.2/drivers/s
  	if (!sl->data) {
  		clear_bit(n,sbi->symlink_bitmap);
  		unlock_kernel();
-diff -urNp linux-2.6.38.2/drivers/staging/bcm/Bcmchar.c linux-2.6.38.2/drivers/staging/bcm/Bcmchar.c
---- linux-2.6.38.2/drivers/staging/bcm/Bcmchar.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/bcm/Bcmchar.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/bcm/Bcmchar.c linux-2.6.38.7/drivers/staging/bcm/Bcmchar.c
+--- linux-2.6.38.7/drivers/staging/bcm/Bcmchar.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/bcm/Bcmchar.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2093,7 +2093,7 @@ static long bcm_char_ioctl(struct file *
  }
  
@@ -27434,9 +33541,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/bcm/Bcmchar.c linux-2.6.38.2/drivers/s
  	.owner    = THIS_MODULE,
  	.open     = bcm_char_open,
  	.release  = bcm_char_release,
-diff -urNp linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
---- linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/dhd_linux.c
+--- linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/dhd_linux.c	2011-04-28 19:34:15.000000000 -0400
 @@ -863,14 +863,14 @@ static void dhd_op_if(dhd_if_t *ifp)
  			free_netdev(ifp->net);
  		}
@@ -27492,9 +33599,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/dhd_linux.c linux-2
  
  #if defined(CUSTOMER_HW2) && defined(CONFIG_WIFI_CONTROL_FUNC)
  	g_bus = bus;
-diff -urNp linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c
---- linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/wl_iw.c
+--- linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/brcm80211/brcmfmac/wl_iw.c	2011-04-28 19:34:15.000000000 -0400
 @@ -513,7 +513,7 @@ wl_iw_get_range(struct net_device *dev,
  	list = (wl_u32_list_t *) channels;
  
@@ -27504,9 +33611,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/brcm80211/brcmfmac/wl_iw.c linux-2.6.3
  
  	range->min_nwid = range->max_nwid = 0;
  
-diff -urNp linux-2.6.38.2/drivers/staging/comedi/comedi_fops.c linux-2.6.38.2/drivers/staging/comedi/comedi_fops.c
---- linux-2.6.38.2/drivers/staging/comedi/comedi_fops.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/comedi/comedi_fops.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/comedi/comedi_fops.c linux-2.6.38.7/drivers/staging/comedi/comedi_fops.c
+--- linux-2.6.38.7/drivers/staging/comedi/comedi_fops.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/comedi/comedi_fops.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1426,7 +1426,7 @@ static void comedi_unmap(struct vm_area_
  	mutex_unlock(&dev->mutex);
  }
@@ -27516,9 +33623,45 @@ diff -urNp linux-2.6.38.2/drivers/staging/comedi/comedi_fops.c linux-2.6.38.2/dr
  	.close = comedi_unmap,
  };
  
-diff -urNp linux-2.6.38.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.38.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
---- linux-2.6.38.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/et131x/et1310_tx.c linux-2.6.38.7/drivers/staging/et131x/et1310_tx.c
+--- linux-2.6.38.7/drivers/staging/et131x/et1310_tx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/et131x/et1310_tx.c	2011-04-28 19:57:25.000000000 -0400
+@@ -635,11 +635,11 @@ inline void et131x_free_send_packet(stru
+ 	struct net_device_stats *stats = &etdev->net_stats;
+ 
+ 	if (tcb->flags & fMP_DEST_BROAD)
+-		atomic_inc(&etdev->Stats.brdcstxmt);
++		atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
+ 	else if (tcb->flags & fMP_DEST_MULTI)
+-		atomic_inc(&etdev->Stats.multixmt);
++		atomic_inc_unchecked(&etdev->Stats.multixmt);
+ 	else
+-		atomic_inc(&etdev->Stats.unixmt);
++		atomic_inc_unchecked(&etdev->Stats.unixmt);
+ 
+ 	if (tcb->skb) {
+ 		stats->tx_bytes += tcb->skb->len;
+diff -urNp linux-2.6.38.7/drivers/staging/et131x/et131x_adapter.h linux-2.6.38.7/drivers/staging/et131x/et131x_adapter.h
+--- linux-2.6.38.7/drivers/staging/et131x/et131x_adapter.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/et131x/et131x_adapter.h	2011-04-28 19:57:25.000000000 -0400
+@@ -112,11 +112,11 @@ typedef struct _ce_stats_t {
+ 	 * operations
+ 	 */
+ 	u32 unircv;	/* # multicast packets received */
+-	atomic_t unixmt;	/* # multicast packets for Tx */
++	atomic_unchecked_t unixmt;	/* # multicast packets for Tx */
+ 	u32 multircv;	/* # multicast packets received */
+-	atomic_t multixmt;	/* # multicast packets for Tx */
++	atomic_unchecked_t multixmt;	/* # multicast packets for Tx */
+ 	u32 brdcstrcv;	/* # broadcast packets received */
+-	atomic_t brdcstxmt;	/* # broadcast packets for Tx */
++	atomic_unchecked_t brdcstxmt;	/* # broadcast packets for Tx */
+ 	u32 norcvbuf;	/* # Rx packets discarded */
+ 	u32 noxmtbuf;	/* # Tx packets discarded */
+ 
+diff -urNp linux-2.6.38.7/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux-2.6.38.7/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c
+--- linux-2.6.38.7/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c	2011-04-28 19:34:15.000000000 -0400
 @@ -55,7 +55,7 @@ int numofmsgbuf = 0;
  //
  // Table of entry-point routines for char device
@@ -27528,9 +33671,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/ft1000/ft1000-usb/ft1000_debug.c linux
  {
  	.unlocked_ioctl	= ft1000_ioctl,
  	.poll		= ft1000_poll_dev,
-diff -urNp linux-2.6.38.2/drivers/staging/go7007/go7007-v4l2.c linux-2.6.38.2/drivers/staging/go7007/go7007-v4l2.c
---- linux-2.6.38.2/drivers/staging/go7007/go7007-v4l2.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/go7007/go7007-v4l2.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/go7007/go7007-v4l2.c linux-2.6.38.7/drivers/staging/go7007/go7007-v4l2.c
+--- linux-2.6.38.7/drivers/staging/go7007/go7007-v4l2.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/go7007/go7007-v4l2.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1672,7 +1672,7 @@ static int go7007_vm_fault(struct vm_are
  	return 0;
  }
@@ -27540,9 +33683,23 @@ diff -urNp linux-2.6.38.2/drivers/staging/go7007/go7007-v4l2.c linux-2.6.38.2/dr
  	.open	= go7007_vm_open,
  	.close	= go7007_vm_close,
  	.fault	= go7007_vm_fault,
-diff -urNp linux-2.6.38.2/drivers/staging/hv/hv.c linux-2.6.38.2/drivers/staging/hv/hv.c
---- linux-2.6.38.2/drivers/staging/hv/hv.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/hv/hv.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/hv/channel.c linux-2.6.38.7/drivers/staging/hv/channel.c
+--- linux-2.6.38.7/drivers/staging/hv/channel.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/hv/channel.c	2011-04-28 19:57:25.000000000 -0400
+@@ -501,8 +501,8 @@ int vmbus_establish_gpadl(struct vmbus_c
+ 	unsigned long flags;
+ 	int ret = 0;
+ 
+-	next_gpadl_handle = atomic_read(&gVmbusConnection.NextGpadlHandle);
+-	atomic_inc(&gVmbusConnection.NextGpadlHandle);
++	next_gpadl_handle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
++	atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
+ 
+ 	ret = create_gpadl_header(kbuffer, size, &msginfo, &msgcount);
+ 	if (ret)
+diff -urNp linux-2.6.38.7/drivers/staging/hv/hv.c linux-2.6.38.7/drivers/staging/hv/hv.c
+--- linux-2.6.38.7/drivers/staging/hv/hv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/hv/hv.c	2011-04-28 19:34:15.000000000 -0400
 @@ -163,7 +163,7 @@ static u64 do_hypercall(u64 control, voi
  	u64 output_address = (output) ? virt_to_phys(output) : 0;
  	u32 output_address_hi = output_address >> 32;
@@ -27552,9 +33709,121 @@ diff -urNp linux-2.6.38.2/drivers/staging/hv/hv.c linux-2.6.38.2/drivers/staging
  
  	DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
  		   control, input, output);
-diff -urNp linux-2.6.38.2/drivers/staging/phison/phison.c linux-2.6.38.2/drivers/staging/phison/phison.c
---- linux-2.6.38.2/drivers/staging/phison/phison.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/phison/phison.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/hv/rndis_filter.c linux-2.6.38.7/drivers/staging/hv/rndis_filter.c
+--- linux-2.6.38.7/drivers/staging/hv/rndis_filter.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/hv/rndis_filter.c	2011-04-28 19:57:25.000000000 -0400
+@@ -47,7 +47,7 @@ struct rndis_device {
+ 
+ 	enum rndis_device_state state;
+ 	u32 link_stat;
+-	atomic_t new_req_id;
++	atomic_unchecked_t new_req_id;
+ 
+ 	spinlock_t request_lock;
+ 	struct list_head req_list;
+@@ -145,7 +145,7 @@ static struct rndis_request *get_rndis_r
+ 	 * template
+ 	 */
+ 	set = &rndis_msg->msg.set_req;
+-	set->req_id = atomic_inc_return(&dev->new_req_id);
++	set->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
+ 
+ 	/* Add to the request list */
+ 	spin_lock_irqsave(&dev->request_lock, flags);
+@@ -707,7 +707,7 @@ static void rndis_filter_halt_device(str
+ 
+ 	/* Setup the rndis set */
+ 	halt = &request->request_msg.msg.halt_req;
+-	halt->req_id = atomic_inc_return(&dev->new_req_id);
++	halt->req_id = atomic_inc_return_unchecked(&dev->new_req_id);
+ 
+ 	/* Ignore return since this msg is optional. */
+ 	rndis_filter_send_request(dev, request);
+diff -urNp linux-2.6.38.7/drivers/staging/hv/vmbus_drv.c linux-2.6.38.7/drivers/staging/hv/vmbus_drv.c
+--- linux-2.6.38.7/drivers/staging/hv/vmbus_drv.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/hv/vmbus_drv.c	2011-04-28 19:57:25.000000000 -0400
+@@ -727,14 +727,14 @@ int vmbus_child_device_register(struct h
+ 				to_vm_device(root_device_obj);
+ 	struct vm_device *child_device_ctx =
+ 				to_vm_device(child_device_obj);
+-	static atomic_t device_num = ATOMIC_INIT(0);
++	static atomic_unchecked_t device_num = ATOMIC_INIT(0);
+ 
+ 	DPRINT_DBG(VMBUS_DRV, "child device (%p) registering",
+ 		   child_device_ctx);
+ 
+ 	/* Set the device name. Otherwise, device_register() will fail. */
+ 	dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
+-		     atomic_inc_return(&device_num));
++		     atomic_inc_return_unchecked(&device_num));
+ 
+ 	/* The new device belongs to this bus */
+ 	child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
+diff -urNp linux-2.6.38.7/drivers/staging/hv/vmbus_private.h linux-2.6.38.7/drivers/staging/hv/vmbus_private.h
+--- linux-2.6.38.7/drivers/staging/hv/vmbus_private.h	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/hv/vmbus_private.h	2011-04-28 19:57:25.000000000 -0400
+@@ -58,7 +58,7 @@ enum VMBUS_CONNECT_STATE {
+ struct VMBUS_CONNECTION {
+ 	enum VMBUS_CONNECT_STATE ConnectState;
+ 
+-	atomic_t NextGpadlHandle;
++	atomic_unchecked_t NextGpadlHandle;
+ 
+ 	/*
+ 	 * Represents channel interrupts. Each bit position represents a
+diff -urNp linux-2.6.38.7/drivers/staging/octeon/ethernet.c linux-2.6.38.7/drivers/staging/octeon/ethernet.c
+--- linux-2.6.38.7/drivers/staging/octeon/ethernet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/octeon/ethernet.c	2011-04-28 19:57:25.000000000 -0400
+@@ -258,11 +258,11 @@ static struct net_device_stats *cvm_oct_
+ 		 * since the RX tasklet also increments it.
+ 		 */
+ #ifdef CONFIG_64BIT
+-		atomic64_add(rx_status.dropped_packets,
+-			     (atomic64_t *)&priv->stats.rx_dropped);
++		atomic64_add_unchecked(rx_status.dropped_packets,
++			     (atomic64_unchecked_t *)&priv->stats.rx_dropped);
+ #else
+-		atomic_add(rx_status.dropped_packets,
+-			     (atomic_t *)&priv->stats.rx_dropped);
++		atomic_add_unchecked(rx_status.dropped_packets,
++			     (atomic_unchecked_t *)&priv->stats.rx_dropped);
+ #endif
+ 	}
+ 
+diff -urNp linux-2.6.38.7/drivers/staging/octeon/ethernet-rx.c linux-2.6.38.7/drivers/staging/octeon/ethernet-rx.c
+--- linux-2.6.38.7/drivers/staging/octeon/ethernet-rx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/octeon/ethernet-rx.c	2011-04-28 19:57:25.000000000 -0400
+@@ -417,11 +417,11 @@ static int cvm_oct_napi_poll(struct napi
+ 				/* Increment RX stats for virtual ports */
+ 				if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
+ #ifdef CONFIG_64BIT
+-					atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
+-					atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
++					atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
++					atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
+ #else
+-					atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
+-					atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
++					atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
++					atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
+ #endif
+ 				}
+ 				netif_receive_skb(skb);
+@@ -433,9 +433,9 @@ static int cvm_oct_napi_poll(struct napi
+ 					   dev->name);
+ 				*/
+ #ifdef CONFIG_64BIT
+-				atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
++				atomic64_unchecked_add(1, (atomic64_unchecked_t *)&priv->stats.rx_dropped);
+ #else
+-				atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
++				atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_dropped);
+ #endif
+ 				dev_kfree_skb_irq(skb);
+ 			}
+diff -urNp linux-2.6.38.7/drivers/staging/phison/phison.c linux-2.6.38.7/drivers/staging/phison/phison.c
+--- linux-2.6.38.7/drivers/staging/phison/phison.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/phison/phison.c	2011-04-28 19:34:15.000000000 -0400
 @@ -43,7 +43,7 @@ static struct scsi_host_template phison_
  	ATA_BMDMA_SHT(DRV_NAME),
  };
@@ -27564,9 +33833,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/phison/phison.c linux-2.6.38.2/drivers
  	.inherits		= &ata_bmdma_port_ops,
  	.prereset		= phison_pre_reset,
  };
-diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/inode.c linux-2.6.38.2/drivers/staging/pohmelfs/inode.c
---- linux-2.6.38.2/drivers/staging/pohmelfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/pohmelfs/inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/pohmelfs/inode.c linux-2.6.38.7/drivers/staging/pohmelfs/inode.c
+--- linux-2.6.38.7/drivers/staging/pohmelfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/pohmelfs/inode.c	2011-04-28 19:57:25.000000000 -0400
 @@ -1855,7 +1855,7 @@ static int pohmelfs_fill_super(struct su
  	mutex_init(&psb->mcache_lock);
  	psb->mcache_root = RB_ROOT;
@@ -27576,9 +33845,18 @@ diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/inode.c linux-2.6.38.2/driver
  
  	psb->trans_max_pages = 100;
  
-diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/mcache.c linux-2.6.38.2/drivers/staging/pohmelfs/mcache.c
---- linux-2.6.38.2/drivers/staging/pohmelfs/mcache.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/pohmelfs/mcache.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1870,7 +1870,7 @@ static int pohmelfs_fill_super(struct su
+ 	INIT_LIST_HEAD(&psb->crypto_ready_list);
+ 	INIT_LIST_HEAD(&psb->crypto_active_list);
+ 
+-	atomic_set(&psb->trans_gen, 1);
++	atomic_set_unchecked(&psb->trans_gen, 1);
+ 	atomic_long_set(&psb->total_inodes, 0);
+ 
+ 	mutex_init(&psb->state_lock);
+diff -urNp linux-2.6.38.7/drivers/staging/pohmelfs/mcache.c linux-2.6.38.7/drivers/staging/pohmelfs/mcache.c
+--- linux-2.6.38.7/drivers/staging/pohmelfs/mcache.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/pohmelfs/mcache.c	2011-04-28 19:34:15.000000000 -0400
 @@ -121,7 +121,7 @@ struct pohmelfs_mcache *pohmelfs_mcache_
  	m->data = data;
  	m->start = start;
@@ -27588,10 +33866,10 @@ diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/mcache.c linux-2.6.38.2/drive
  
  	mutex_lock(&psb->mcache_lock);
  	err = pohmelfs_mcache_insert(psb, m);
-diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/netfs.h linux-2.6.38.2/drivers/staging/pohmelfs/netfs.h
---- linux-2.6.38.2/drivers/staging/pohmelfs/netfs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/pohmelfs/netfs.h	2011-03-21 18:31:35.000000000 -0400
-@@ -571,7 +571,7 @@ struct pohmelfs_config;
+diff -urNp linux-2.6.38.7/drivers/staging/pohmelfs/netfs.h linux-2.6.38.7/drivers/staging/pohmelfs/netfs.h
+--- linux-2.6.38.7/drivers/staging/pohmelfs/netfs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/pohmelfs/netfs.h	2011-04-28 19:57:25.000000000 -0400
+@@ -571,14 +571,14 @@ struct pohmelfs_config;
  struct pohmelfs_sb {
  	struct rb_root		mcache_root;
  	struct mutex		mcache_lock;
@@ -27600,9 +33878,29 @@ diff -urNp linux-2.6.38.2/drivers/staging/pohmelfs/netfs.h linux-2.6.38.2/driver
  	unsigned long		mcache_timeout;
  
  	unsigned int		idx;
-diff -urNp linux-2.6.38.2/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.38.2/drivers/staging/rtl8192u/ieee80211/proc.c
---- linux-2.6.38.2/drivers/staging/rtl8192u/ieee80211/proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/rtl8192u/ieee80211/proc.c	2011-03-21 18:31:35.000000000 -0400
+ 
+ 	unsigned int		trans_retries;
+ 
+-	atomic_t		trans_gen;
++	atomic_unchecked_t	trans_gen;
+ 
+ 	unsigned int		crypto_attached_size;
+ 	unsigned int		crypto_align_size;
+diff -urNp linux-2.6.38.7/drivers/staging/pohmelfs/trans.c linux-2.6.38.7/drivers/staging/pohmelfs/trans.c
+--- linux-2.6.38.7/drivers/staging/pohmelfs/trans.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/pohmelfs/trans.c	2011-04-28 19:57:25.000000000 -0400
+@@ -492,7 +492,7 @@ int netfs_trans_finish(struct netfs_tran
+ 	int err;
+ 	struct netfs_cmd *cmd = t->iovec.iov_base;
+ 
+-	t->gen = atomic_inc_return(&psb->trans_gen);
++	t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
+ 
+ 	cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
+ 		t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
+diff -urNp linux-2.6.38.7/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.38.7/drivers/staging/rtl8192u/ieee80211/proc.c
+--- linux-2.6.38.7/drivers/staging/rtl8192u/ieee80211/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/rtl8192u/ieee80211/proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -99,7 +99,7 @@ static int crypto_info_open(struct inode
  	return seq_open(file, &crypto_seq_ops);
  }
@@ -27612,9 +33910,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/rtl8192u/ieee80211/proc.c linux-2.6.38
  	.open		= crypto_info_open,
  	.read		= seq_read,
  	.llseek		= seq_lseek,
-diff -urNp linux-2.6.38.2/drivers/staging/spectra/ffsport.c linux-2.6.38.2/drivers/staging/spectra/ffsport.c
---- linux-2.6.38.2/drivers/staging/spectra/ffsport.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/spectra/ffsport.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/spectra/ffsport.c linux-2.6.38.7/drivers/staging/spectra/ffsport.c
+--- linux-2.6.38.7/drivers/staging/spectra/ffsport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/spectra/ffsport.c	2011-04-28 19:34:15.000000000 -0400
 @@ -604,7 +604,7 @@ int GLOB_SBD_unlocked_ioctl(struct block
  	return ret;
  }
@@ -27624,9 +33922,63 @@ diff -urNp linux-2.6.38.2/drivers/staging/spectra/ffsport.c linux-2.6.38.2/drive
  	.owner = THIS_MODULE,
  	.open = GLOB_SBD_open,
  	.release = GLOB_SBD_release,
-diff -urNp linux-2.6.38.2/drivers/staging/vme/devices/vme_user.c linux-2.6.38.2/drivers/staging/vme/devices/vme_user.c
---- linux-2.6.38.2/drivers/staging/vme/devices/vme_user.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/vme/devices/vme_user.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/usbip/vhci.h linux-2.6.38.7/drivers/staging/usbip/vhci.h
+--- linux-2.6.38.7/drivers/staging/usbip/vhci.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/usbip/vhci.h	2011-04-28 19:57:25.000000000 -0400
+@@ -92,7 +92,7 @@ struct vhci_hcd {
+ 	unsigned	resuming:1;
+ 	unsigned long	re_timeout;
+ 
+-	atomic_t seqnum;
++	atomic_unchecked_t seqnum;
+ 
+ 	/*
+ 	 * NOTE:
+diff -urNp linux-2.6.38.7/drivers/staging/usbip/vhci_hcd.c linux-2.6.38.7/drivers/staging/usbip/vhci_hcd.c
+--- linux-2.6.38.7/drivers/staging/usbip/vhci_hcd.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/usbip/vhci_hcd.c	2011-05-10 22:08:57.000000000 -0400
+@@ -535,7 +535,7 @@ static void vhci_tx_urb(struct urb *urb)
+ 		return;
+ 	}
+ 
+-	priv->seqnum = atomic_inc_return(&the_controller->seqnum);
++	priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
+ 	if (priv->seqnum == 0xffff)
+ 		usbip_uinfo("seqnum max\n");
+ 
+@@ -794,7 +794,7 @@ static int vhci_urb_dequeue(struct usb_h
+ 			return -ENOMEM;
+ 		}
+ 
+-		unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
++		unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
+ 		if (unlink->seqnum == 0xffff)
+ 			usbip_uinfo("seqnum max\n");
+ 
+@@ -989,7 +989,7 @@ static int vhci_start(struct usb_hcd *hc
+ 		vdev->rhport = rhport;
+ 	}
+ 
+-	atomic_set(&vhci->seqnum, 0);
++	atomic_set_unchecked(&vhci->seqnum, 0);
+ 	spin_lock_init(&vhci->lock);
+ 
+ 
+diff -urNp linux-2.6.38.7/drivers/staging/usbip/vhci_rx.c linux-2.6.38.7/drivers/staging/usbip/vhci_rx.c
+--- linux-2.6.38.7/drivers/staging/usbip/vhci_rx.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/usbip/vhci_rx.c	2011-04-28 19:57:25.000000000 -0400
+@@ -80,7 +80,7 @@ static void vhci_recv_ret_submit(struct 
+ 		usbip_uerr("cannot find a urb of seqnum %u\n",
+ 							pdu->base.seqnum);
+ 		usbip_uinfo("max seqnum %d\n",
+-					atomic_read(&the_controller->seqnum));
++					atomic_read_unchecked(&the_controller->seqnum));
+ 		usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
+ 		return;
+ 	}
+diff -urNp linux-2.6.38.7/drivers/staging/vme/devices/vme_user.c linux-2.6.38.7/drivers/staging/vme/devices/vme_user.c
+--- linux-2.6.38.7/drivers/staging/vme/devices/vme_user.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/vme/devices/vme_user.c	2011-04-28 19:34:15.000000000 -0400
 @@ -138,7 +138,7 @@ static long vme_user_unlocked_ioctl(stru
  static int __devinit vme_user_probe(struct device *, int, int);
  static int __devexit vme_user_remove(struct device *, int, int);
@@ -27636,9 +33988,9 @@ diff -urNp linux-2.6.38.2/drivers/staging/vme/devices/vme_user.c linux-2.6.38.2/
  	.open = vme_user_open,
  	.release = vme_user_release,
  	.read = vme_user_read,
-diff -urNp linux-2.6.38.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.38.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
---- linux-2.6.38.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c linux-2.6.38.7/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c
+--- linux-2.6.38.7/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/staging/westbridge/astoria/block/cyasblkdev_block.c	2011-04-28 19:34:15.000000000 -0400
 @@ -426,7 +426,7 @@ int cyasblkdev_revalidate_disk(struct ge
  
  
@@ -27648,9 +34000,204 @@ diff -urNp linux-2.6.38.2/drivers/staging/westbridge/astoria/block/cyasblkdev_bl
  	.open			= cyasblkdev_blk_open,
  	.release		= cyasblkdev_blk_release,
  	.ioctl			= cyasblkdev_blk_ioctl,
-diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvc_console.h linux-2.6.38.2/drivers/tty/hvc/hvc_console.h
---- linux-2.6.38.2/drivers/tty/hvc/hvc_console.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/hvc/hvc_console.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/target/target_core_alua.c linux-2.6.38.7/drivers/target/target_core_alua.c
+--- linux-2.6.38.7/drivers/target/target_core_alua.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_alua.c	2011-05-16 21:47:08.000000000 -0400
+@@ -675,6 +675,8 @@ static int core_alua_update_tpg_primary_
+ 	char path[ALUA_METADATA_PATH_LEN];
+ 	int len;
+ 
++	pax_track_stack();
++
+ 	memset(path, 0, ALUA_METADATA_PATH_LEN);
+ 
+ 	len = snprintf(md_buf, tg_pt_gp->tg_pt_gp_md_buf_len,
+@@ -938,6 +940,8 @@ static int core_alua_update_tpg_secondar
+ 	char path[ALUA_METADATA_PATH_LEN], wwn[ALUA_SECONDARY_METADATA_WWN_LEN];
+ 	int len;
+ 
++	pax_track_stack();
++
+ 	memset(path, 0, ALUA_METADATA_PATH_LEN);
+ 	memset(wwn, 0, ALUA_SECONDARY_METADATA_WWN_LEN);
+ 
+diff -urNp linux-2.6.38.7/drivers/target/target_core_cdb.c linux-2.6.38.7/drivers/target/target_core_cdb.c
+--- linux-2.6.38.7/drivers/target/target_core_cdb.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_cdb.c	2011-05-16 21:47:08.000000000 -0400
+@@ -838,6 +838,8 @@ target_emulate_modesense(struct se_cmd *
+ 	int length = 0;
+ 	unsigned char buf[SE_MODE_PAGE_BUF];
+ 
++	pax_track_stack();
++
+ 	memset(buf, 0, SE_MODE_PAGE_BUF);
+ 
+ 	switch (cdb[2] & 0x3f) {
+diff -urNp linux-2.6.38.7/drivers/target/target_core_configfs.c linux-2.6.38.7/drivers/target/target_core_configfs.c
+--- linux-2.6.38.7/drivers/target/target_core_configfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_configfs.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1279,6 +1279,8 @@ static ssize_t target_core_dev_pr_show_a
+ 	ssize_t len = 0;
+ 	int reg_count = 0, prf_isid;
+ 
++	pax_track_stack();
++
+ 	if (!(su_dev->se_dev_ptr))
+ 		return -ENODEV;
+ 
+diff -urNp linux-2.6.38.7/drivers/target/target_core_pr.c linux-2.6.38.7/drivers/target/target_core_pr.c
+--- linux-2.6.38.7/drivers/target/target_core_pr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_pr.c	2011-05-16 21:47:08.000000000 -0400
+@@ -918,6 +918,8 @@ static int __core_scsi3_check_aptpl_regi
+ 	unsigned char t_port[PR_APTPL_MAX_TPORT_LEN];
+ 	u16 tpgt;
+ 
++	pax_track_stack();
++
+ 	memset(i_port, 0, PR_APTPL_MAX_IPORT_LEN);
+ 	memset(t_port, 0, PR_APTPL_MAX_TPORT_LEN);
+ 	/*
+@@ -1861,6 +1863,8 @@ static int __core_scsi3_update_aptpl_buf
+ 	ssize_t len = 0;
+ 	int reg_count = 0;
+ 
++	pax_track_stack();
++
+ 	memset(buf, 0, pr_aptpl_buf_len);
+ 	/*
+ 	 * Called to clear metadata once APTPL has been deactivated.
+@@ -1983,6 +1987,8 @@ static int __core_scsi3_write_aptpl_to_f
+ 	char path[512];
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	memset(iov, 0, sizeof(struct iovec));
+ 	memset(path, 0, 512);
+ 
+diff -urNp linux-2.6.38.7/drivers/target/target_core_tmr.c linux-2.6.38.7/drivers/target/target_core_tmr.c
+--- linux-2.6.38.7/drivers/target/target_core_tmr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_tmr.c	2011-04-28 19:57:25.000000000 -0400
+@@ -262,7 +262,7 @@ int core_tmr_lun_reset(
+ 			CMD_TFO(cmd)->get_task_tag(cmd), cmd->pr_res_key,
+ 			T_TASK(cmd)->t_task_cdbs,
+ 			atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
+-			atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
++			atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
+ 			atomic_read(&T_TASK(cmd)->t_transport_active),
+ 			atomic_read(&T_TASK(cmd)->t_transport_stop),
+ 			atomic_read(&T_TASK(cmd)->t_transport_sent));
+@@ -304,7 +304,7 @@ int core_tmr_lun_reset(
+ 			DEBUG_LR("LUN_RESET: got t_transport_active = 1 for"
+ 				" task: %p, t_fe_count: %d dev: %p\n", task,
+ 				fe_count, dev);
+-			atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
++			atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
+ 			spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock,
+ 						flags);
+ 			core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
+@@ -314,7 +314,7 @@ int core_tmr_lun_reset(
+ 		}
+ 		DEBUG_LR("LUN_RESET: Got t_transport_active = 0 for task: %p,"
+ 			" t_fe_count: %d dev: %p\n", task, fe_count, dev);
+-		atomic_set(&T_TASK(cmd)->t_transport_aborted, 1);
++		atomic_set_unchecked(&T_TASK(cmd)->t_transport_aborted, 1);
+ 		spin_unlock_irqrestore(&T_TASK(cmd)->t_state_lock, flags);
+ 		core_tmr_handle_tas_abort(tmr_nacl, cmd, tas, fe_count);
+ 
+diff -urNp linux-2.6.38.7/drivers/target/target_core_transport.c linux-2.6.38.7/drivers/target/target_core_transport.c
+--- linux-2.6.38.7/drivers/target/target_core_transport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/target/target_core_transport.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1678,7 +1678,7 @@ struct se_device *transport_add_device_t
+ 
+ 	dev->queue_depth	= dev_limits->queue_depth;
+ 	atomic_set(&dev->depth_left, dev->queue_depth);
+-	atomic_set(&dev->dev_ordered_id, 0);
++	atomic_set_unchecked(&dev->dev_ordered_id, 0);
+ 
+ 	se_dev_set_default_attribs(dev, dev_limits);
+ 
+@@ -1880,7 +1880,7 @@ static int transport_check_alloc_task_at
+ 	 * Used to determine when ORDERED commands should go from
+ 	 * Dormant to Active status.
+ 	 */
+-	cmd->se_ordered_id = atomic_inc_return(&SE_DEV(cmd)->dev_ordered_id);
++	cmd->se_ordered_id = atomic_inc_return_unchecked(&SE_DEV(cmd)->dev_ordered_id);
+ 	smp_mb__after_atomic_inc();
+ 	DEBUG_STA("Allocated se_ordered_id: %u for Task Attr: 0x%02x on %s\n",
+ 			cmd->se_ordered_id, cmd->sam_task_attr,
+@@ -2160,7 +2160,7 @@ static void transport_generic_request_fa
+ 		" t_transport_active: %d t_transport_stop: %d"
+ 		" t_transport_sent: %d\n", T_TASK(cmd)->t_task_cdbs,
+ 		atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
+-		atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
++		atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
+ 		atomic_read(&T_TASK(cmd)->t_task_cdbs_ex_left),
+ 		atomic_read(&T_TASK(cmd)->t_transport_active),
+ 		atomic_read(&T_TASK(cmd)->t_transport_stop),
+@@ -2664,9 +2664,9 @@ check_depth:
+ 	spin_lock_irqsave(&T_TASK(cmd)->t_state_lock, flags);
+ 	atomic_set(&task->task_active, 1);
+ 	atomic_set(&task->task_sent, 1);
+-	atomic_inc(&T_TASK(cmd)->t_task_cdbs_sent);
++	atomic_inc_unchecked(&T_TASK(cmd)->t_task_cdbs_sent);
+ 
+-	if (atomic_read(&T_TASK(cmd)->t_task_cdbs_sent) ==
++	if (atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent) ==
+ 	    T_TASK(cmd)->t_task_cdbs)
+ 		atomic_set(&cmd->transport_sent, 1);
+ 
+@@ -5550,7 +5550,7 @@ static void transport_generic_wait_for_t
+ 		atomic_set(&T_TASK(cmd)->transport_lun_stop, 0);
+ 	}
+ 	if (!atomic_read(&T_TASK(cmd)->t_transport_active) ||
+-	     atomic_read(&T_TASK(cmd)->t_transport_aborted))
++	     atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted))
+ 		goto remove;
+ 
+ 	atomic_set(&T_TASK(cmd)->t_transport_stop, 1);
+@@ -5779,7 +5779,7 @@ int transport_check_aborted_status(struc
+ {
+ 	int ret = 0;
+ 
+-	if (atomic_read(&T_TASK(cmd)->t_transport_aborted) != 0) {
++	if (atomic_read_unchecked(&T_TASK(cmd)->t_transport_aborted) != 0) {
+ 		if (!(send_status) ||
+ 		     (cmd->se_cmd_flags & SCF_SENT_DELAYED_TAS))
+ 			return 1;
+@@ -5807,7 +5807,7 @@ void transport_send_task_abort(struct se
+ 	 */
+ 	if (cmd->data_direction == DMA_TO_DEVICE) {
+ 		if (CMD_TFO(cmd)->write_pending_status(cmd) != 0) {
+-			atomic_inc(&T_TASK(cmd)->t_transport_aborted);
++			atomic_inc_unchecked(&T_TASK(cmd)->t_transport_aborted);
+ 			smp_mb__after_atomic_inc();
+ 			cmd->scsi_status = SAM_STAT_TASK_ABORTED;
+ 			transport_new_cmd_failure(cmd);
+@@ -5936,7 +5936,7 @@ static void transport_processing_shutdow
+ 			CMD_TFO(cmd)->get_task_tag(cmd),
+ 			T_TASK(cmd)->t_task_cdbs,
+ 			atomic_read(&T_TASK(cmd)->t_task_cdbs_left),
+-			atomic_read(&T_TASK(cmd)->t_task_cdbs_sent),
++			atomic_read_unchecked(&T_TASK(cmd)->t_task_cdbs_sent),
+ 			atomic_read(&T_TASK(cmd)->t_transport_active),
+ 			atomic_read(&T_TASK(cmd)->t_transport_stop),
+ 			atomic_read(&T_TASK(cmd)->t_transport_sent));
+diff -urNp linux-2.6.38.7/drivers/telephony/ixj.c linux-2.6.38.7/drivers/telephony/ixj.c
+--- linux-2.6.38.7/drivers/telephony/ixj.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/telephony/ixj.c	2011-05-16 21:47:08.000000000 -0400
+@@ -4976,6 +4976,8 @@ static int ixj_daa_cid_read(IXJ *j)
+ 	bool mContinue;
+ 	char *pIn, *pOut;
+ 
++	pax_track_stack();
++
+ 	if (!SCI_Prepare(j))
+ 		return 0;
+ 
+diff -urNp linux-2.6.38.7/drivers/tty/hvc/hvc_console.h linux-2.6.38.7/drivers/tty/hvc/hvc_console.h
+--- linux-2.6.38.7/drivers/tty/hvc/hvc_console.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/hvc/hvc_console.h	2011-04-28 19:34:15.000000000 -0400
 @@ -82,6 +82,7 @@ extern int hvc_instantiate(uint32_t vter
  /* register a vterm for hvc tty operation (module_init or hotplug add) */
  extern struct hvc_struct * hvc_alloc(uint32_t vtermno, int data,
@@ -27659,9 +34206,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvc_console.h linux-2.6.38.2/drivers/t
  /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
  extern int hvc_remove(struct hvc_struct *hp);
  
-diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvcs.c linux-2.6.38.2/drivers/tty/hvc/hvcs.c
---- linux-2.6.38.2/drivers/tty/hvc/hvcs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/hvc/hvcs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/hvc/hvcs.c linux-2.6.38.7/drivers/tty/hvc/hvcs.c
+--- linux-2.6.38.7/drivers/tty/hvc/hvcs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/hvc/hvcs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -83,6 +83,7 @@
  #include <asm/hvcserver.h>
  #include <asm/uaccess.h>
@@ -27764,9 +34311,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvcs.c linux-2.6.38.2/drivers/tty/hvc/
  		return 0;
  
  	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
-diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvc_xen.c linux-2.6.38.2/drivers/tty/hvc/hvc_xen.c
---- linux-2.6.38.2/drivers/tty/hvc/hvc_xen.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/hvc/hvc_xen.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/hvc/hvc_xen.c linux-2.6.38.7/drivers/tty/hvc/hvc_xen.c
+--- linux-2.6.38.7/drivers/tty/hvc/hvc_xen.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/hvc/hvc_xen.c	2011-04-28 19:34:15.000000000 -0400
 @@ -123,7 +123,7 @@ static int domU_read_console(uint32_t vt
  	return recv;
  }
@@ -27803,9 +34350,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/hvc/hvc_xen.c linux-2.6.38.2/drivers/tty/h
  
  	if (!xen_pv_domain())
  		return 0;
-diff -urNp linux-2.6.38.2/drivers/tty/n_gsm.c linux-2.6.38.2/drivers/tty/n_gsm.c
---- linux-2.6.38.2/drivers/tty/n_gsm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/n_gsm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/n_gsm.c linux-2.6.38.7/drivers/tty/n_gsm.c
+--- linux-2.6.38.7/drivers/tty/n_gsm.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/n_gsm.c	2011-05-10 22:06:56.000000000 -0400
 @@ -1589,7 +1589,7 @@ static struct gsm_dlci *gsm_dlci_alloc(s
  		return NULL;
  	spin_lock_init(&dlci->lock);
@@ -27815,9 +34362,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/n_gsm.c linux-2.6.38.2/drivers/tty/n_gsm.c
  		kfree(dlci);
  		return NULL;
  	}
-diff -urNp linux-2.6.38.2/drivers/tty/n_tty.c linux-2.6.38.2/drivers/tty/n_tty.c
---- linux-2.6.38.2/drivers/tty/n_tty.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/n_tty.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/n_tty.c linux-2.6.38.7/drivers/tty/n_tty.c
+--- linux-2.6.38.7/drivers/tty/n_tty.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/n_tty.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2116,6 +2116,7 @@ void n_tty_inherit_ops(struct tty_ldisc_
  {
  	*ops = tty_ldisc_N_TTY;
@@ -27827,9 +34374,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/n_tty.c linux-2.6.38.2/drivers/tty/n_tty.c
 +	ops->flags = 0;
  }
  EXPORT_SYMBOL_GPL(n_tty_inherit_ops);
-diff -urNp linux-2.6.38.2/drivers/tty/pty.c linux-2.6.38.2/drivers/tty/pty.c
---- linux-2.6.38.2/drivers/tty/pty.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/pty.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/pty.c linux-2.6.38.7/drivers/tty/pty.c
+--- linux-2.6.38.7/drivers/tty/pty.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/pty.c	2011-04-28 19:34:15.000000000 -0400
 @@ -700,7 +700,18 @@ out:
  	return retval;
  }
@@ -27861,21 +34408,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/pty.c linux-2.6.38.2/drivers/tty/pty.c
  	cdev_init(&ptmx_cdev, &ptmx_fops);
  	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
  	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
-diff -urNp linux-2.6.38.2/drivers/tty/serial/8250_pci.c linux-2.6.38.2/drivers/tty/serial/8250_pci.c
---- linux-2.6.38.2/drivers/tty/serial/8250_pci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/serial/8250_pci.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3818,7 +3818,7 @@ static struct pci_device_id serial_pci_t
- 		PCI_ANY_ID, PCI_ANY_ID,
- 		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8,
- 		0xffff00, pbn_default },
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- static struct pci_driver serial_pci_driver = {
-diff -urNp linux-2.6.38.2/drivers/tty/serial/kgdboc.c linux-2.6.38.2/drivers/tty/serial/kgdboc.c
---- linux-2.6.38.2/drivers/tty/serial/kgdboc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/serial/kgdboc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/serial/kgdboc.c linux-2.6.38.7/drivers/tty/serial/kgdboc.c
+--- linux-2.6.38.7/drivers/tty/serial/kgdboc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/serial/kgdboc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -22,7 +22,7 @@
  
  #define MAX_CONFIG_LEN		40
@@ -27894,9 +34429,21 @@ diff -urNp linux-2.6.38.2/drivers/tty/serial/kgdboc.c linux-2.6.38.2/drivers/tty
  	.name			= "kgdboc",
  	.read_char		= kgdboc_get_char,
  	.write_char		= kgdboc_put_char,
-diff -urNp linux-2.6.38.2/drivers/tty/tty_io.c linux-2.6.38.2/drivers/tty/tty_io.c
---- linux-2.6.38.2/drivers/tty/tty_io.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/tty_io.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/serial/mrst_max3110.c linux-2.6.38.7/drivers/tty/serial/mrst_max3110.c
+--- linux-2.6.38.7/drivers/tty/serial/mrst_max3110.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/serial/mrst_max3110.c	2011-05-16 21:47:08.000000000 -0400
+@@ -393,6 +393,8 @@ static void max3110_con_receive(struct u
+ 	int loop = 1, num, total = 0;
+ 	u8 recv_buf[512], *pbuf;
+ 
++	pax_track_stack();
++
+ 	pbuf = recv_buf;
+ 	do {
+ 		num = max3110_read_multi(max, pbuf);
+diff -urNp linux-2.6.38.7/drivers/tty/tty_io.c linux-2.6.38.7/drivers/tty/tty_io.c
+--- linux-2.6.38.7/drivers/tty/tty_io.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/tty_io.c	2011-04-28 19:34:15.000000000 -0400
 @@ -140,21 +140,11 @@ EXPORT_SYMBOL(tty_mutex);
  /* Spinlock to protect the tty->tty_files list */
  DEFINE_SPINLOCK(tty_files_lock);
@@ -28034,9 +34581,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/tty_io.c linux-2.6.38.2/drivers/tty/tty_io
  /*
   * Initialize the console device. This is called *early*, so
   * we can't necessarily depend on lots of kernel help here.
-diff -urNp linux-2.6.38.2/drivers/tty/tty_ldisc.c linux-2.6.38.2/drivers/tty/tty_ldisc.c
---- linux-2.6.38.2/drivers/tty/tty_ldisc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/tty_ldisc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/tty_ldisc.c linux-2.6.38.7/drivers/tty/tty_ldisc.c
+--- linux-2.6.38.7/drivers/tty/tty_ldisc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/tty_ldisc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -76,7 +76,7 @@ static void put_ldisc(struct tty_ldisc *
  	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
  		struct tty_ldisc_ops *ldo = ld->ops;
@@ -28082,9 +34629,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/tty_ldisc.c linux-2.6.38.2/drivers/tty/tty
  	module_put(ldops->owner);
  	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
  }
-diff -urNp linux-2.6.38.2/drivers/tty/vt/keyboard.c linux-2.6.38.2/drivers/tty/vt/keyboard.c
---- linux-2.6.38.2/drivers/tty/vt/keyboard.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/vt/keyboard.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/vt/keyboard.c linux-2.6.38.7/drivers/tty/vt/keyboard.c
+--- linux-2.6.38.7/drivers/tty/vt/keyboard.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/vt/keyboard.c	2011-04-28 19:34:15.000000000 -0400
 @@ -657,6 +657,16 @@ static void k_spec(struct vc_data *vc, u
  	     kbd->kbdmode == VC_MEDIUMRAW) &&
  	     value != KVAL(K_SAK))
@@ -28102,18 +34649,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/vt/keyboard.c linux-2.6.38.2/drivers/tty/v
  	fn_handler[value](vc);
  }
  
-@@ -1413,7 +1423,7 @@ static const struct input_device_id kbd_
-                 .evbit = { BIT_MASK(EV_SND) },
-         },
- 
--	{ },    /* Terminating entry */
-+	{ 0 },    /* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE(input, kbd_ids);
-diff -urNp linux-2.6.38.2/drivers/tty/vt/vt.c linux-2.6.38.2/drivers/tty/vt/vt.c
---- linux-2.6.38.2/drivers/tty/vt/vt.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/vt/vt.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/vt/vt.c linux-2.6.38.7/drivers/tty/vt/vt.c
+--- linux-2.6.38.7/drivers/tty/vt/vt.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/vt/vt.c	2011-04-28 19:34:15.000000000 -0400
 @@ -262,7 +262,7 @@ EXPORT_SYMBOL_GPL(unregister_vt_notifier
  
  static void notify_write(struct vc_data *vc, unsigned int unicode)
@@ -28123,9 +34661,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/vt/vt.c linux-2.6.38.2/drivers/tty/vt/vt.c
  	atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
  }
  
-diff -urNp linux-2.6.38.2/drivers/tty/vt/vt_ioctl.c linux-2.6.38.2/drivers/tty/vt/vt_ioctl.c
---- linux-2.6.38.2/drivers/tty/vt/vt_ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/tty/vt/vt_ioctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/tty/vt/vt_ioctl.c linux-2.6.38.7/drivers/tty/vt/vt_ioctl.c
+--- linux-2.6.38.7/drivers/tty/vt/vt_ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/tty/vt/vt_ioctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -210,9 +210,6 @@ do_kdsk_ioctl(int cmd, struct kbentry __
  	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
  		return -EFAULT;
@@ -28166,9 +34704,9 @@ diff -urNp linux-2.6.38.2/drivers/tty/vt/vt_ioctl.c linux-2.6.38.2/drivers/tty/v
  		if (!perm) {
  			ret = -EPERM;
  			goto reterr;
-diff -urNp linux-2.6.38.2/drivers/uio/uio.c linux-2.6.38.2/drivers/uio/uio.c
---- linux-2.6.38.2/drivers/uio/uio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/uio/uio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/uio/uio.c linux-2.6.38.7/drivers/uio/uio.c
+--- linux-2.6.38.7/drivers/uio/uio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/uio/uio.c	2011-04-28 19:57:25.000000000 -0400
 @@ -25,6 +25,7 @@
  #include <linux/kobject.h>
  #include <linux/cdev.h>
@@ -28177,8 +34715,12 @@ diff -urNp linux-2.6.38.2/drivers/uio/uio.c linux-2.6.38.2/drivers/uio/uio.c
  
  #define UIO_MAX_DEVICES		(1U << MINORBITS)
  
-@@ -35,7 +36,7 @@ struct uio_device {
- 	atomic_t		event;
+@@ -32,10 +33,10 @@ struct uio_device {
+ 	struct module		*owner;
+ 	struct device		*dev;
+ 	int			minor;
+-	atomic_t		event;
++	atomic_unchecked_t	event;
  	struct fasync_struct	*async_queue;
  	wait_queue_head_t	wait;
 -	int			vma_count;
@@ -28186,6 +34728,51 @@ diff -urNp linux-2.6.38.2/drivers/uio/uio.c linux-2.6.38.2/drivers/uio/uio.c
  	struct uio_info		*info;
  	struct kobject		*map_dir;
  	struct kobject		*portio_dir;
+@@ -242,7 +243,7 @@ static ssize_t show_event(struct device 
+ 			  struct device_attribute *attr, char *buf)
+ {
+ 	struct uio_device *idev = dev_get_drvdata(dev);
+-	return sprintf(buf, "%u\n", (unsigned int)atomic_read(&idev->event));
++	return sprintf(buf, "%u\n", (unsigned int)atomic_read_unchecked(&idev->event));
+ }
+ 
+ static struct device_attribute uio_class_attributes[] = {
+@@ -402,7 +403,7 @@ void uio_event_notify(struct uio_info *i
+ {
+ 	struct uio_device *idev = info->uio_dev;
+ 
+-	atomic_inc(&idev->event);
++	atomic_inc_unchecked(&idev->event);
+ 	wake_up_interruptible(&idev->wait);
+ 	kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
+ }
+@@ -455,7 +456,7 @@ static int uio_open(struct inode *inode,
+ 	}
+ 
+ 	listener->dev = idev;
+-	listener->event_count = atomic_read(&idev->event);
++	listener->event_count = atomic_read_unchecked(&idev->event);
+ 	filep->private_data = listener;
+ 
+ 	if (idev->info->open) {
+@@ -506,7 +507,7 @@ static unsigned int uio_poll(struct file
+ 		return -EIO;
+ 
+ 	poll_wait(filep, &idev->wait, wait);
+-	if (listener->event_count != atomic_read(&idev->event))
++	if (listener->event_count != atomic_read_unchecked(&idev->event))
+ 		return POLLIN | POLLRDNORM;
+ 	return 0;
+ }
+@@ -531,7 +532,7 @@ static ssize_t uio_read(struct file *fil
+ 	do {
+ 		set_current_state(TASK_INTERRUPTIBLE);
+ 
+-		event_count = atomic_read(&idev->event);
++		event_count = atomic_read_unchecked(&idev->event);
+ 		if (event_count != listener->event_count) {
+ 			if (copy_to_user(buf, &event_count, count))
+ 				retval = -EFAULT;
 @@ -602,13 +603,13 @@ static int uio_find_mem_index(struct vm_
  static void uio_vma_open(struct vm_area_struct *vma)
  {
@@ -28202,9 +34789,18 @@ diff -urNp linux-2.6.38.2/drivers/uio/uio.c linux-2.6.38.2/drivers/uio/uio.c
  }
  
  static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-diff -urNp linux-2.6.38.2/drivers/usb/atm/cxacru.c linux-2.6.38.2/drivers/usb/atm/cxacru.c
---- linux-2.6.38.2/drivers/usb/atm/cxacru.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/atm/cxacru.c	2011-03-21 18:31:35.000000000 -0400
+@@ -819,7 +820,7 @@ int __uio_register_device(struct module 
+ 	idev->owner = owner;
+ 	idev->info = info;
+ 	init_waitqueue_head(&idev->wait);
+-	atomic_set(&idev->event, 0);
++	atomic_set_unchecked(&idev->event, 0);
+ 
+ 	ret = uio_get_minor(idev);
+ 	if (ret)
+diff -urNp linux-2.6.38.7/drivers/usb/atm/cxacru.c linux-2.6.38.7/drivers/usb/atm/cxacru.c
+--- linux-2.6.38.7/drivers/usb/atm/cxacru.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/atm/cxacru.c	2011-04-28 19:34:15.000000000 -0400
 @@ -473,7 +473,7 @@ static ssize_t cxacru_sysfs_store_adsl_c
  		ret = sscanf(buf + pos, "%x=%x%n", &index, &value, &tmp);
  		if (ret < 2)
@@ -28214,9 +34810,9 @@ diff -urNp linux-2.6.38.2/drivers/usb/atm/cxacru.c linux-2.6.38.2/drivers/usb/at
  			return -EINVAL;
  		pos += tmp;
  
-diff -urNp linux-2.6.38.2/drivers/usb/atm/usbatm.c linux-2.6.38.2/drivers/usb/atm/usbatm.c
---- linux-2.6.38.2/drivers/usb/atm/usbatm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/atm/usbatm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/usb/atm/usbatm.c linux-2.6.38.7/drivers/usb/atm/usbatm.c
+--- linux-2.6.38.7/drivers/usb/atm/usbatm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/atm/usbatm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -332,7 +332,7 @@ static void usbatm_extract_one_cell(stru
  		if (printk_ratelimit())
  			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
@@ -28296,42 +34892,39 @@ diff -urNp linux-2.6.38.2/drivers/usb/atm/usbatm.c linux-2.6.38.2/drivers/usb/at
  
  	if (!left--) {
  		if (instance->disconnected)
-diff -urNp linux-2.6.38.2/drivers/usb/class/cdc-acm.c linux-2.6.38.2/drivers/usb/class/cdc-acm.c
---- linux-2.6.38.2/drivers/usb/class/cdc-acm.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/class/cdc-acm.c	2011-03-28 17:42:53.000000000 -0400
-@@ -1640,7 +1640,7 @@ static const struct usb_device_id acm_id
- 	{ USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM,
- 		USB_CDC_ACM_PROTO_AT_CDMA) },
+diff -urNp linux-2.6.38.7/drivers/usb/core/devices.c linux-2.6.38.7/drivers/usb/core/devices.c
+--- linux-2.6.38.7/drivers/usb/core/devices.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/core/devices.c	2011-04-28 19:57:25.000000000 -0400
+@@ -126,7 +126,7 @@ static const char *format_endpt =
+  * time it gets called.
+  */
+ static struct device_connect_event {
+-	atomic_t count;
++	atomic_unchecked_t count;
+ 	wait_queue_head_t wait;
+ } device_event = {
+ 	.count = ATOMIC_INIT(1),
+@@ -164,7 +164,7 @@ static const struct class_info clas_info
  
--	{ }
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(usb, acm_ids);
-diff -urNp linux-2.6.38.2/drivers/usb/class/usblp.c linux-2.6.38.2/drivers/usb/class/usblp.c
---- linux-2.6.38.2/drivers/usb/class/usblp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/class/usblp.c	2011-03-21 18:31:35.000000000 -0400
-@@ -227,7 +227,7 @@ static const struct quirk_printer_struct
- 	{ 0x0482, 0x0010, USBLP_QUIRK_BIDIR }, /* Kyocera Mita FS 820, by zut <kernel@zut.de> */
- 	{ 0x04f9, 0x000d, USBLP_QUIRK_BIDIR }, /* Brother Industries, Ltd HL-1440 Laser Printer */
- 	{ 0x04b8, 0x0202, USBLP_QUIRK_BAD_CLASS }, /* Seiko Epson Receipt Printer M129C */
--	{ 0, 0 }
-+	{ 0, 0, 0 }
- };
- 
- static int usblp_wwait(struct usblp *usblp, int nonblock);
-@@ -1398,7 +1398,7 @@ static const struct usb_device_id usblp_
- 	{ USB_INTERFACE_INFO(7, 1, 2) },
- 	{ USB_INTERFACE_INFO(7, 1, 3) },
- 	{ USB_DEVICE(0x04b8, 0x0202) },	/* Seiko Epson Receipt Printer M129C */
--	{ }						/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE(usb, usblp_ids);
-diff -urNp linux-2.6.38.2/drivers/usb/core/hcd.c linux-2.6.38.2/drivers/usb/core/hcd.c
---- linux-2.6.38.2/drivers/usb/core/hcd.c	2011-03-23 17:20:07.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/core/hcd.c	2011-03-26 20:49:43.000000000 -0400
+ void usbfs_conn_disc_event(void)
+ {
+-	atomic_add(2, &device_event.count);
++	atomic_add_unchecked(2, &device_event.count);
+ 	wake_up(&device_event.wait);
+ }
+ 
+@@ -648,7 +648,7 @@ static unsigned int usb_device_poll(stru
+ 
+ 	poll_wait(file, &device_event.wait, wait);
+ 
+-	event_count = atomic_read(&device_event.count);
++	event_count = atomic_read_unchecked(&device_event.count);
+ 	if (file->f_version != event_count) {
+ 		file->f_version = event_count;
+ 		return POLLIN | POLLRDNORM;
+diff -urNp linux-2.6.38.7/drivers/usb/core/hcd.c linux-2.6.38.7/drivers/usb/core/hcd.c
+--- linux-2.6.38.7/drivers/usb/core/hcd.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/core/hcd.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2457,7 +2457,7 @@ EXPORT_SYMBOL_GPL(usb_hcd_platform_shutd
  
  #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
@@ -28350,21 +34943,9 @@ diff -urNp linux-2.6.38.2/drivers/usb/core/hcd.c linux-2.6.38.2/drivers/usb/core
  {
  
  	if (mon_ops)
-diff -urNp linux-2.6.38.2/drivers/usb/core/hub.c linux-2.6.38.2/drivers/usb/core/hub.c
---- linux-2.6.38.2/drivers/usb/core/hub.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/core/hub.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3492,7 +3492,7 @@ static const struct usb_device_id hub_id
-       .bDeviceClass = USB_CLASS_HUB},
-     { .match_flags = USB_DEVICE_ID_MATCH_INT_CLASS,
-       .bInterfaceClass = USB_CLASS_HUB},
--    { }						/* Terminating entry */
-+    { 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }						/* Terminating entry */
- };
- 
- MODULE_DEVICE_TABLE (usb, hub_id_table);
-diff -urNp linux-2.6.38.2/drivers/usb/core/message.c linux-2.6.38.2/drivers/usb/core/message.c
---- linux-2.6.38.2/drivers/usb/core/message.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/core/message.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/usb/core/message.c linux-2.6.38.7/drivers/usb/core/message.c
+--- linux-2.6.38.7/drivers/usb/core/message.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/core/message.c	2011-04-28 19:34:15.000000000 -0400
 @@ -869,8 +869,8 @@ char *usb_cache_string(struct usb_device
  	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
  	if (buf) {
@@ -28376,9 +34957,9 @@ diff -urNp linux-2.6.38.2/drivers/usb/core/message.c linux-2.6.38.2/drivers/usb/
  			if (!smallbuf)
  				return buf;
  			memcpy(smallbuf, buf, len);
-diff -urNp linux-2.6.38.2/drivers/usb/early/ehci-dbgp.c linux-2.6.38.2/drivers/usb/early/ehci-dbgp.c
---- linux-2.6.38.2/drivers/usb/early/ehci-dbgp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/early/ehci-dbgp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/usb/early/ehci-dbgp.c linux-2.6.38.7/drivers/usb/early/ehci-dbgp.c
+--- linux-2.6.38.7/drivers/usb/early/ehci-dbgp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/early/ehci-dbgp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -96,7 +96,7 @@ static inline u32 dbgp_len_update(u32 x,
  }
  
@@ -28397,33 +34978,21 @@ diff -urNp linux-2.6.38.2/drivers/usb/early/ehci-dbgp.c linux-2.6.38.2/drivers/u
  	.name = "kgdbdbgp",
  	.read_char = kgdbdbgp_read_char,
  	.write_char = kgdbdbgp_write_char,
-diff -urNp linux-2.6.38.2/drivers/usb/host/ehci-pci.c linux-2.6.38.2/drivers/usb/host/ehci-pci.c
---- linux-2.6.38.2/drivers/usb/host/ehci-pci.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/host/ehci-pci.c	2011-03-21 18:31:35.000000000 -0400
-@@ -516,7 +516,7 @@ static const struct pci_device_id pci_id
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_EHCI, ~0),
- 	.driver_data =	(unsigned long) &ehci_pci_hc_driver,
- 	},
--	{ /* end: all zeroes */ }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- MODULE_DEVICE_TABLE(pci, pci_ids);
- 
-diff -urNp linux-2.6.38.2/drivers/usb/host/uhci-hcd.c linux-2.6.38.2/drivers/usb/host/uhci-hcd.c
---- linux-2.6.38.2/drivers/usb/host/uhci-hcd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/host/uhci-hcd.c	2011-03-21 18:31:35.000000000 -0400
-@@ -948,7 +948,7 @@ static const struct pci_device_id uhci_p
- 	/* handle any USB UHCI controller */
- 	PCI_DEVICE_CLASS(PCI_CLASS_SERIAL_USB_UHCI, ~0),
- 	.driver_data =	(unsigned long) &uhci_driver,
--	}, { /* end: all zeroes */ }
-+	}, { 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, uhci_pci_ids);
-diff -urNp linux-2.6.38.2/drivers/usb/mon/mon_main.c linux-2.6.38.2/drivers/usb/mon/mon_main.c
---- linux-2.6.38.2/drivers/usb/mon/mon_main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/mon/mon_main.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/usb/host/xhci-mem.c linux-2.6.38.7/drivers/usb/host/xhci-mem.c
+--- linux-2.6.38.7/drivers/usb/host/xhci-mem.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/host/xhci-mem.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1616,6 +1616,8 @@ static int xhci_check_trb_in_td_math(str
+ 	unsigned int num_tests;
+ 	int i, ret;
+ 
++	pax_track_stack();
++
+ 	num_tests = ARRAY_SIZE(simple_test_vector);
+ 	for (i = 0; i < num_tests; i++) {
+ 		ret = xhci_test_trb_in_td(xhci,
+diff -urNp linux-2.6.38.7/drivers/usb/mon/mon_main.c linux-2.6.38.7/drivers/usb/mon/mon_main.c
+--- linux-2.6.38.7/drivers/usb/mon/mon_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/mon/mon_main.c	2011-04-28 19:34:15.000000000 -0400
 @@ -238,7 +238,7 @@ static struct notifier_block mon_nb = {
  /*
   * Ops
@@ -28433,49 +35002,42 @@ diff -urNp linux-2.6.38.2/drivers/usb/mon/mon_main.c linux-2.6.38.2/drivers/usb/
  	.urb_submit =	mon_submit,
  	.urb_submit_error = mon_submit_error,
  	.urb_complete =	mon_complete,
-diff -urNp linux-2.6.38.2/drivers/usb/storage/debug.h linux-2.6.38.2/drivers/usb/storage/debug.h
---- linux-2.6.38.2/drivers/usb/storage/debug.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/storage/debug.h	2011-03-21 18:31:35.000000000 -0400
-@@ -54,9 +54,9 @@ void usb_stor_show_sense( unsigned char 
- #define US_DEBUGPX(x...) printk( x )
- #define US_DEBUG(x) x 
- #else
--#define US_DEBUGP(x...)
--#define US_DEBUGPX(x...)
--#define US_DEBUG(x)
-+#define US_DEBUGP(x...) do {} while (0)
-+#define US_DEBUGPX(x...) do {} while (0)
-+#define US_DEBUG(x) do {} while (0)
- #endif
- 
- #endif
-diff -urNp linux-2.6.38.2/drivers/usb/storage/usb.c linux-2.6.38.2/drivers/usb/storage/usb.c
---- linux-2.6.38.2/drivers/usb/storage/usb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/storage/usb.c	2011-03-21 18:31:35.000000000 -0400
-@@ -122,7 +122,7 @@ MODULE_PARM_DESC(quirks, "supplemental l
- 
- static struct us_unusual_dev us_unusual_dev_list[] = {
- #	include "unusual_devs.h" 
--	{ }		/* Terminating entry */
-+	{ NULL, NULL, 0, 0, NULL } /* Terminating entry */
+diff -urNp linux-2.6.38.7/drivers/usb/wusbcore/wa-hc.h linux-2.6.38.7/drivers/usb/wusbcore/wa-hc.h
+--- linux-2.6.38.7/drivers/usb/wusbcore/wa-hc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/wusbcore/wa-hc.h	2011-04-28 19:57:25.000000000 -0400
+@@ -192,7 +192,7 @@ struct wahc {
+ 	struct list_head xfer_delayed_list;
+ 	spinlock_t xfer_list_lock;
+ 	struct work_struct xfer_work;
+-	atomic_t xfer_id_count;
++	atomic_unchecked_t xfer_id_count;
  };
  
- #undef UNUSUAL_DEV
-diff -urNp linux-2.6.38.2/drivers/usb/storage/usual-tables.c linux-2.6.38.2/drivers/usb/storage/usual-tables.c
---- linux-2.6.38.2/drivers/usb/storage/usual-tables.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/usb/storage/usual-tables.c	2011-03-21 18:31:35.000000000 -0400
-@@ -48,7 +48,7 @@
  
- struct usb_device_id usb_storage_usb_ids[] = {
- #	include "unusual_devs.h"
--	{ }		/* Terminating entry */
-+	{ 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0 }		/* Terminating entry */
- };
- EXPORT_SYMBOL_GPL(usb_storage_usb_ids);
+@@ -246,7 +246,7 @@ static inline void wa_init(struct wahc *
+ 	INIT_LIST_HEAD(&wa->xfer_delayed_list);
+ 	spin_lock_init(&wa->xfer_list_lock);
+ 	INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
+-	atomic_set(&wa->xfer_id_count, 1);
++	atomic_set_unchecked(&wa->xfer_id_count, 1);
+ }
  
-diff -urNp linux-2.6.38.2/drivers/vhost/vhost.c linux-2.6.38.2/drivers/vhost/vhost.c
---- linux-2.6.38.2/drivers/vhost/vhost.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/vhost/vhost.c	2011-03-21 18:31:35.000000000 -0400
+ /**
+diff -urNp linux-2.6.38.7/drivers/usb/wusbcore/wa-xfer.c linux-2.6.38.7/drivers/usb/wusbcore/wa-xfer.c
+--- linux-2.6.38.7/drivers/usb/wusbcore/wa-xfer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/usb/wusbcore/wa-xfer.c	2011-04-28 19:57:25.000000000 -0400
+@@ -294,7 +294,7 @@ out:
+  */
+ static void wa_xfer_id_init(struct wa_xfer *xfer)
+ {
+-	xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
++	xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
+ }
+ 
+ /*
+diff -urNp linux-2.6.38.7/drivers/vhost/vhost.c linux-2.6.38.7/drivers/vhost/vhost.c
+--- linux-2.6.38.7/drivers/vhost/vhost.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/vhost/vhost.c	2011-04-28 19:34:15.000000000 -0400
 @@ -565,7 +565,7 @@ static int init_used(struct vhost_virtqu
  	return get_user(vq->last_used_idx, &used->idx);
  }
@@ -28485,9 +35047,9 @@ diff -urNp linux-2.6.38.2/drivers/vhost/vhost.c linux-2.6.38.2/drivers/vhost/vho
  {
  	struct file *eventfp, *filep = NULL,
  		    *pollstart = NULL, *pollstop = NULL;
-diff -urNp linux-2.6.38.2/drivers/video/fbcmap.c linux-2.6.38.2/drivers/video/fbcmap.c
---- linux-2.6.38.2/drivers/video/fbcmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/fbcmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/fbcmap.c linux-2.6.38.7/drivers/video/fbcmap.c
+--- linux-2.6.38.7/drivers/video/fbcmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/fbcmap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -285,8 +285,7 @@ int fb_set_user_cmap(struct fb_cmap_user
  		rc = -ENODEV;
  		goto out;
@@ -28498,9 +35060,9 @@ diff -urNp linux-2.6.38.2/drivers/video/fbcmap.c linux-2.6.38.2/drivers/video/fb
  		rc = -EINVAL;
  		goto out1;
  	}
-diff -urNp linux-2.6.38.2/drivers/video/fbmem.c linux-2.6.38.2/drivers/video/fbmem.c
---- linux-2.6.38.2/drivers/video/fbmem.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/fbmem.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/fbmem.c linux-2.6.38.7/drivers/video/fbmem.c
+--- linux-2.6.38.7/drivers/video/fbmem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/fbmem.c	2011-05-16 21:47:08.000000000 -0400
 @@ -403,7 +403,7 @@ static void fb_do_show_logo(struct fb_in
  			image->dx += image->width + 8;
  		}
@@ -28519,7 +35081,25 @@ diff -urNp linux-2.6.38.2/drivers/video/fbmem.c linux-2.6.38.2/drivers/video/fbm
  			info->fbops->fb_imageblit(info, image);
  			image->dy -= image->height + 8;
  		}
-@@ -1101,7 +1101,7 @@ static long do_fb_ioctl(struct fb_info *
+@@ -897,6 +897,8 @@ fb_set_var(struct fb_info *info, struct 
+ 	int flags = info->flags;
+ 	int ret = 0;
+ 
++	pax_track_stack();
++
+ 	if (var->activate & FB_ACTIVATE_INV_MODE) {
+ 		struct fb_videomode mode1, mode2;
+ 
+@@ -1022,6 +1024,8 @@ static long do_fb_ioctl(struct fb_info *
+ 	void __user *argp = (void __user *)arg;
+ 	long ret = 0;
+ 
++	pax_track_stack();
++
+ 	switch (cmd) {
+ 	case FBIOGET_VSCREENINFO:
+ 		if (!lock_fb_info(info))
+@@ -1101,7 +1105,7 @@ static long do_fb_ioctl(struct fb_info *
  			return -EFAULT;
  		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
  			return -EINVAL;
@@ -28528,21 +35108,9 @@ diff -urNp linux-2.6.38.2/drivers/video/fbmem.c linux-2.6.38.2/drivers/video/fbm
  			return -EINVAL;
  		if (!registered_fb[con2fb.framebuffer])
  			request_module("fb%d", con2fb.framebuffer);
-diff -urNp linux-2.6.38.2/drivers/video/fbmon.c linux-2.6.38.2/drivers/video/fbmon.c
---- linux-2.6.38.2/drivers/video/fbmon.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/fbmon.c	2011-03-21 18:31:35.000000000 -0400
-@@ -46,7 +46,7 @@
- #ifdef DEBUG
- #define DPRINTK(fmt, args...) printk(fmt,## args)
- #else
--#define DPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
- #endif
- 
- #define FBMON_FIX_HEADER  1
-diff -urNp linux-2.6.38.2/drivers/video/i810/i810_accel.c linux-2.6.38.2/drivers/video/i810/i810_accel.c
---- linux-2.6.38.2/drivers/video/i810/i810_accel.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/i810/i810_accel.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/i810/i810_accel.c linux-2.6.38.7/drivers/video/i810/i810_accel.c
+--- linux-2.6.38.7/drivers/video/i810/i810_accel.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/i810/i810_accel.c	2011-04-28 19:34:15.000000000 -0400
 @@ -73,6 +73,7 @@ static inline int wait_for_space(struct 
  		}
  	}
@@ -28551,340 +35119,9 @@ diff -urNp linux-2.6.38.2/drivers/video/i810/i810_accel.c linux-2.6.38.2/drivers
  	i810_report_error(mmio); 
  	par->dev_flags |= LOCKUP;
  	info->pixmap.scan_align = 1;
-diff -urNp linux-2.6.38.2/drivers/video/i810/i810_main.c linux-2.6.38.2/drivers/video/i810/i810_main.c
---- linux-2.6.38.2/drivers/video/i810/i810_main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/i810/i810_main.c	2011-03-21 18:31:35.000000000 -0400
-@@ -120,7 +120,7 @@ static struct pci_device_id i810fb_pci_t
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 4 },
- 	{ PCI_VENDOR_ID_INTEL, PCI_DEVICE_ID_INTEL_82815_CGC,
- 	  PCI_ANY_ID, PCI_ANY_ID, 0, 0, 5 },
--	{ 0 },
-+	{ 0, 0, 0, 0, 0, 0, 0 },
- };
- 
- static struct pci_driver i810fb_driver = {
-diff -urNp linux-2.6.38.2/drivers/video/modedb.c linux-2.6.38.2/drivers/video/modedb.c
---- linux-2.6.38.2/drivers/video/modedb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/modedb.c	2011-03-21 18:31:35.000000000 -0400
-@@ -40,255 +40,255 @@ static const struct fb_videomode modedb[
- 
- 	/* 640x400 @ 70 Hz, 31.5 kHz hsync */
- 	{ NULL, 70, 640, 400, 39721, 40, 24, 39, 9, 96, 2, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x480 @ 60 Hz, 31.5 kHz hsync */
- 	{ NULL, 60, 640, 480, 39721, 40, 24, 32, 11, 96, 2,	0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 800x600 @ 56 Hz, 35.15 kHz hsync */
- 	{ NULL, 56, 800, 600, 27777, 128, 24, 22, 1, 72, 2,	0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 87 Hz interlaced, 35.5 kHz hsync */
- 	{ NULL, 87, 1024, 768, 22271, 56, 24, 33, 8, 160, 8, 0,
--		FB_VMODE_INTERLACED },
-+		FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x400 @ 85 Hz, 37.86 kHz hsync */
- 	{ NULL, 85, 640, 400, 31746, 96, 32, 41, 1, 64, 3,
--		FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED },
-+		FB_SYNC_VERT_HIGH_ACT, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x480 @ 72 Hz, 36.5 kHz hsync */
- 	{ NULL, 72, 640, 480, 31746, 144, 40, 30, 8, 40, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x480 @ 75 Hz, 37.50 kHz hsync */
- 	{ NULL, 75, 640, 480, 31746, 120, 16, 16, 1, 64, 3,	0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 800x600 @ 60 Hz, 37.8 kHz hsync */
- 	{ NULL, 60, 800, 600, 25000, 88, 40, 23, 1, 128, 4,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x480 @ 85 Hz, 43.27 kHz hsync */
- 	{ NULL, 85, 640, 480, 27777, 80, 56, 25, 1, 56, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 89 Hz interlaced, 44 kHz hsync */
- 	{ NULL, 89, 1152, 864, 15384, 96, 16, 110, 1, 216, 10, 0,
--		FB_VMODE_INTERLACED },
-+		FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN },
- 	/* 800x600 @ 72 Hz, 48.0 kHz hsync */
- 	{ NULL, 72, 800, 600, 20000, 64, 56, 23, 37, 120, 6,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 60 Hz, 48.4 kHz hsync */
- 	{ NULL, 60, 1024, 768, 15384, 168, 8, 29, 3, 144, 6, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 640x480 @ 100 Hz, 53.01 kHz hsync */
- 	{ NULL, 100, 640, 480, 21834, 96, 32, 36, 8, 96, 6,	0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 60 Hz, 53.5 kHz hsync */
- 	{ NULL, 60, 1152, 864, 11123, 208, 64, 16, 4, 256, 8, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 800x600 @ 85 Hz, 55.84 kHz hsync */
- 	{ NULL, 85, 800, 600, 16460, 160, 64, 36, 16, 64, 5, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 70 Hz, 56.5 kHz hsync */
- 	{ NULL, 70, 1024, 768, 13333, 144, 24, 29, 3, 136, 6, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 87 Hz interlaced, 51 kHz hsync */
- 	{ NULL, 87, 1280, 1024, 12500, 56, 16, 128, 1, 216, 12,	0,
--		FB_VMODE_INTERLACED },
-+		FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 800x600 @ 100 Hz, 64.02 kHz hsync */
- 	{ NULL, 100, 800, 600, 14357, 160, 64, 30, 4, 64, 6, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 76 Hz, 62.5 kHz hsync */
- 	{ NULL, 76, 1024, 768, 11764, 208, 8, 36, 16, 120, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 70 Hz, 62.4 kHz hsync */
- 	{ NULL, 70, 1152, 864, 10869, 106, 56, 20, 1, 160, 10, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 61 Hz, 64.2 kHz hsync */
- 	{ NULL, 61, 1280, 1024, 9090, 200, 48, 26, 1, 184, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1400x1050 @ 60Hz, 63.9 kHz hsync */
- 	{ NULL, 60, 1400, 1050, 9259, 136, 40, 13, 1, 112, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1400x1050 @ 75,107 Hz, 82,392 kHz +hsync +vsync*/
- 	{ NULL, 75, 1400, 1050, 7190, 120, 56, 23, 10, 112, 13,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1400x1050 @ 60 Hz, ? kHz +hsync +vsync*/
- 	{ NULL, 60, 1400, 1050, 9259, 128, 40, 12, 0, 112, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 85 Hz, 70.24 kHz hsync */
- 	{ NULL, 85, 1024, 768, 10111, 192, 32, 34, 14, 160, 6, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 78 Hz, 70.8 kHz hsync */
- 	{ NULL, 78, 1152, 864, 9090, 228, 88, 32, 0, 84, 12, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 70 Hz, 74.59 kHz hsync */
- 	{ NULL, 70, 1280, 1024, 7905, 224, 32, 28, 8, 160, 8, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1600x1200 @ 60Hz, 75.00 kHz hsync */
- 	{ NULL, 60, 1600, 1200, 6172, 304, 64, 46, 1, 192, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 84 Hz, 76.0 kHz hsync */
- 	{ NULL, 84, 1152, 864, 7407, 184, 312, 32, 0, 128, 12, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 74 Hz, 78.85 kHz hsync */
- 	{ NULL, 74, 1280, 1024, 7407, 256, 32, 34, 3, 144, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1024x768 @ 100Hz, 80.21 kHz hsync */
- 	{ NULL, 100, 1024, 768, 8658, 192, 32, 21, 3, 192, 10, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 76 Hz, 81.13 kHz hsync */
- 	{ NULL, 76, 1280, 1024, 7407, 248, 32, 34, 3, 104, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1600x1200 @ 70 Hz, 87.50 kHz hsync */
- 	{ NULL, 70, 1600, 1200, 5291, 304, 64, 46, 1, 192, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x864 @ 100 Hz, 89.62 kHz hsync */
- 	{ NULL, 100, 1152, 864, 7264, 224, 32, 17, 2, 128, 19, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 85 Hz, 91.15 kHz hsync */
- 	{ NULL, 85, 1280, 1024, 6349, 224, 64, 44, 1, 160, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1600x1200 @ 75 Hz, 93.75 kHz hsync */
- 	{ NULL, 75, 1600, 1200, 4938, 304, 64, 46, 1, 192, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1680x1050 @ 60 Hz, 65.191 kHz hsync */
- 	{ NULL, 60, 1680, 1050, 6848, 280, 104, 30, 3, 176, 6,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1600x1200 @ 85 Hz, 105.77 kHz hsync */
- 	{ NULL, 85, 1600, 1200, 4545, 272, 16, 37, 4, 192, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x1024 @ 100 Hz, 107.16 kHz hsync */
- 	{ NULL, 100, 1280, 1024, 5502, 256, 32, 26, 7, 128, 15, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1800x1440 @ 64Hz, 96.15 kHz hsync  */
- 	{ NULL, 64, 1800, 1440, 4347, 304, 96, 46, 1, 192, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1800x1440 @ 70Hz, 104.52 kHz hsync  */
- 	{ NULL, 70, 1800, 1440, 4000, 304, 96, 46, 1, 192, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 512x384 @ 78 Hz, 31.50 kHz hsync */
- 	{ NULL, 78, 512, 384, 49603, 48, 16, 16, 1, 64, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 512x384 @ 85 Hz, 34.38 kHz hsync */
- 	{ NULL, 85, 512, 384, 45454, 48, 16, 16, 1, 64, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 320x200 @ 70 Hz, 31.5 kHz hsync, 8:5 aspect ratio */
- 	{ NULL, 70, 320, 200, 79440, 16, 16, 20, 4, 48, 1, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 320x240 @ 60 Hz, 31.5 kHz hsync, 4:3 aspect ratio */
- 	{ NULL, 60, 320, 240, 79440, 16, 16, 16, 5, 48, 1, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 320x240 @ 72 Hz, 36.5 kHz hsync */
- 	{ NULL, 72, 320, 240, 63492, 16, 16, 16, 4, 48, 2, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 400x300 @ 56 Hz, 35.2 kHz hsync, 4:3 aspect ratio */
- 	{ NULL, 56, 400, 300, 55555, 64, 16, 10, 1, 32, 1, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 400x300 @ 60 Hz, 37.8 kHz hsync */
- 	{ NULL, 60, 400, 300, 50000, 48, 16, 11, 1, 64, 2, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 400x300 @ 72 Hz, 48.0 kHz hsync */
- 	{ NULL, 72, 400, 300, 40000, 32, 24, 11, 19, 64, 3,	0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 480x300 @ 56 Hz, 35.2 kHz hsync, 8:5 aspect ratio */
- 	{ NULL, 56, 480, 300, 46176, 80, 16, 10, 1, 40, 1, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 480x300 @ 60 Hz, 37.8 kHz hsync */
- 	{ NULL, 60, 480, 300, 41858, 56, 16, 11, 1, 80, 2, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 480x300 @ 63 Hz, 39.6 kHz hsync */
- 	{ NULL, 63, 480, 300, 40000, 56, 16, 11, 1, 80, 2, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 480x300 @ 72 Hz, 48.0 kHz hsync */
- 	{ NULL, 72, 480, 300, 33386, 40, 24, 11, 19, 80, 3, 0,
--		FB_VMODE_DOUBLE },
-+		FB_VMODE_DOUBLE, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1920x1200 @ 60 Hz, 74.5 Khz hsync */
- 	{ NULL, 60, 1920, 1200, 5177, 128, 336, 1, 38, 208, 3,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1152x768, 60 Hz, PowerBook G4 Titanium I and II */
- 	{ NULL, 60, 1152, 768, 14047, 158, 26, 29, 3, 136, 6,
- 		FB_SYNC_HOR_HIGH_ACT | FB_SYNC_VERT_HIGH_ACT,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1366x768, 60 Hz, 47.403 kHz hsync, WXGA 16:9 aspect ratio */
- 	{ NULL, 60, 1366, 768, 13806, 120, 10, 14, 3, 32, 5, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 1280x800, 60 Hz, 47.403 kHz hsync, WXGA 16:10 aspect ratio */
- 	{ NULL, 60, 1280, 800, 12048, 200, 64, 24, 1, 136, 3, 0,
--		FB_VMODE_NONINTERLACED },
-+		FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 720x576i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
- 	{ NULL, 50, 720, 576, 74074, 64, 16, 39, 5, 64, 5, 0,
--		FB_VMODE_INTERLACED },
-+		FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 800x520i @ 50 Hz, 15.625 kHz hsync (PAL RGB) */
- 	{ NULL, 50, 800, 520, 58823, 144, 64, 72, 28, 80, 5, 0,
--		FB_VMODE_INTERLACED },
-+		FB_VMODE_INTERLACED, FB_MODE_IS_UNKNOWN },
- 
- 	/* 864x480 @ 60 Hz, 35.15 kHz hsync */
- 	{ NULL, 60, 864, 480, 27777, 1, 1, 1, 1, 0, 0,
--		0, FB_VMODE_NONINTERLACED },
-+		0, FB_VMODE_NONINTERLACED, FB_MODE_IS_UNKNOWN },
- };
- 
- #ifdef CONFIG_FB_MODE_HELPERS
-diff -urNp linux-2.6.38.2/drivers/video/pxa3xx-gcu.c linux-2.6.38.2/drivers/video/pxa3xx-gcu.c
---- linux-2.6.38.2/drivers/video/pxa3xx-gcu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/pxa3xx-gcu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/pxa3xx-gcu.c linux-2.6.38.7/drivers/video/pxa3xx-gcu.c
+--- linux-2.6.38.7/drivers/video/pxa3xx-gcu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/pxa3xx-gcu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -103,7 +103,7 @@ struct pxa3xx_gcu_priv {
  	dma_addr_t		  shared_phys;
  	struct resource		 *resource_mem;
@@ -28894,9 +35131,95 @@ diff -urNp linux-2.6.38.2/drivers/video/pxa3xx-gcu.c linux-2.6.38.2/drivers/vide
  	wait_queue_head_t	  wait_idle;
  	wait_queue_head_t	  wait_free;
  	spinlock_t		  spinlock;
-diff -urNp linux-2.6.38.2/drivers/video/uvesafb.c linux-2.6.38.2/drivers/video/uvesafb.c
---- linux-2.6.38.2/drivers/video/uvesafb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/uvesafb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/udlfb.c linux-2.6.38.7/drivers/video/udlfb.c
+--- linux-2.6.38.7/drivers/video/udlfb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/udlfb.c	2011-04-28 19:57:25.000000000 -0400
+@@ -584,11 +584,11 @@ int dlfb_handle_damage(struct dlfb_data 
+ 		dlfb_urb_completion(urb);
+ 
+ error:
+-	atomic_add(bytes_sent, &dev->bytes_sent);
+-	atomic_add(bytes_identical, &dev->bytes_identical);
+-	atomic_add(width*height*2, &dev->bytes_rendered);
++	atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
++	atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
++	atomic_add_unchecked(width*height*2, &dev->bytes_rendered);
+ 	end_cycles = get_cycles();
+-	atomic_add(((unsigned int) ((end_cycles - start_cycles)
++	atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
+ 		    >> 10)), /* Kcycles */
+ 		   &dev->cpu_kcycles_used);
+ 
+@@ -709,11 +709,11 @@ static void dlfb_dpy_deferred_io(struct 
+ 		dlfb_urb_completion(urb);
+ 
+ error:
+-	atomic_add(bytes_sent, &dev->bytes_sent);
+-	atomic_add(bytes_identical, &dev->bytes_identical);
+-	atomic_add(bytes_rendered, &dev->bytes_rendered);
++	atomic_add_unchecked(bytes_sent, &dev->bytes_sent);
++	atomic_add_unchecked(bytes_identical, &dev->bytes_identical);
++	atomic_add_unchecked(bytes_rendered, &dev->bytes_rendered);
+ 	end_cycles = get_cycles();
+-	atomic_add(((unsigned int) ((end_cycles - start_cycles)
++	atomic_add_unchecked(((unsigned int) ((end_cycles - start_cycles)
+ 		    >> 10)), /* Kcycles */
+ 		   &dev->cpu_kcycles_used);
+ }
+@@ -1301,7 +1301,7 @@ static ssize_t metrics_bytes_rendered_sh
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dev = fb_info->par;
+ 	return snprintf(buf, PAGE_SIZE, "%u\n",
+-			atomic_read(&dev->bytes_rendered));
++			atomic_read_unchecked(&dev->bytes_rendered));
+ }
+ 
+ static ssize_t metrics_bytes_identical_show(struct device *fbdev,
+@@ -1309,7 +1309,7 @@ static ssize_t metrics_bytes_identical_s
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dev = fb_info->par;
+ 	return snprintf(buf, PAGE_SIZE, "%u\n",
+-			atomic_read(&dev->bytes_identical));
++			atomic_read_unchecked(&dev->bytes_identical));
+ }
+ 
+ static ssize_t metrics_bytes_sent_show(struct device *fbdev,
+@@ -1317,7 +1317,7 @@ static ssize_t metrics_bytes_sent_show(s
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dev = fb_info->par;
+ 	return snprintf(buf, PAGE_SIZE, "%u\n",
+-			atomic_read(&dev->bytes_sent));
++			atomic_read_unchecked(&dev->bytes_sent));
+ }
+ 
+ static ssize_t metrics_cpu_kcycles_used_show(struct device *fbdev,
+@@ -1325,7 +1325,7 @@ static ssize_t metrics_cpu_kcycles_used_
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dev = fb_info->par;
+ 	return snprintf(buf, PAGE_SIZE, "%u\n",
+-			atomic_read(&dev->cpu_kcycles_used));
++			atomic_read_unchecked(&dev->cpu_kcycles_used));
+ }
+ 
+ static ssize_t edid_show(
+@@ -1382,10 +1382,10 @@ static ssize_t metrics_reset_store(struc
+ 	struct fb_info *fb_info = dev_get_drvdata(fbdev);
+ 	struct dlfb_data *dev = fb_info->par;
+ 
+-	atomic_set(&dev->bytes_rendered, 0);
+-	atomic_set(&dev->bytes_identical, 0);
+-	atomic_set(&dev->bytes_sent, 0);
+-	atomic_set(&dev->cpu_kcycles_used, 0);
++	atomic_set_unchecked(&dev->bytes_rendered, 0);
++	atomic_set_unchecked(&dev->bytes_identical, 0);
++	atomic_set_unchecked(&dev->bytes_sent, 0);
++	atomic_set_unchecked(&dev->cpu_kcycles_used, 0);
+ 
+ 	return count;
+ }
+diff -urNp linux-2.6.38.7/drivers/video/uvesafb.c linux-2.6.38.7/drivers/video/uvesafb.c
+--- linux-2.6.38.7/drivers/video/uvesafb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/uvesafb.c	2011-04-28 19:34:15.000000000 -0400
 @@ -19,6 +19,7 @@
  #include <linux/io.h>
  #include <linux/mutex.h>
@@ -28972,9 +35295,9 @@ diff -urNp linux-2.6.38.2/drivers/video/uvesafb.c linux-2.6.38.2/drivers/video/u
  		}
  
  		framebuffer_release(info);
-diff -urNp linux-2.6.38.2/drivers/video/vesafb.c linux-2.6.38.2/drivers/video/vesafb.c
---- linux-2.6.38.2/drivers/video/vesafb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/drivers/video/vesafb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/video/vesafb.c linux-2.6.38.7/drivers/video/vesafb.c
+--- linux-2.6.38.7/drivers/video/vesafb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/video/vesafb.c	2011-04-28 19:34:15.000000000 -0400
 @@ -9,6 +9,7 @@
   */
  
@@ -29078,9 +35401,21 @@ diff -urNp linux-2.6.38.2/drivers/video/vesafb.c linux-2.6.38.2/drivers/video/ve
  	if (info->screen_base)
  		iounmap(info->screen_base);
  	framebuffer_release(info);
-diff -urNp linux-2.6.38.2/fs/9p/vfs_inode.c linux-2.6.38.2/fs/9p/vfs_inode.c
---- linux-2.6.38.2/fs/9p/vfs_inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/9p/vfs_inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/drivers/virtio/virtio_balloon.c linux-2.6.38.7/drivers/virtio/virtio_balloon.c
+--- linux-2.6.38.7/drivers/virtio/virtio_balloon.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/drivers/virtio/virtio_balloon.c	2011-05-16 21:47:08.000000000 -0400
+@@ -176,6 +176,8 @@ static void update_balloon_stats(struct 
+ 	struct sysinfo i;
+ 	int idx = 0;
+ 
++	pax_track_stack();
++
+ 	all_vm_events(events);
+ 	si_meminfo(&i);
+ 
+diff -urNp linux-2.6.38.7/fs/9p/vfs_inode.c linux-2.6.38.7/fs/9p/vfs_inode.c
+--- linux-2.6.38.7/fs/9p/vfs_inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/9p/vfs_inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1094,7 +1094,7 @@ static void *v9fs_vfs_follow_link(struct
  void
  v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
@@ -29090,9 +35425,9 @@ diff -urNp linux-2.6.38.2/fs/9p/vfs_inode.c linux-2.6.38.2/fs/9p/vfs_inode.c
  
  	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
  		IS_ERR(s) ? "<error>" : s);
-diff -urNp linux-2.6.38.2/fs/aio.c linux-2.6.38.2/fs/aio.c
---- linux-2.6.38.2/fs/aio.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/fs/aio.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/aio.c linux-2.6.38.7/fs/aio.c
+--- linux-2.6.38.7/fs/aio.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/fs/aio.c	2011-05-16 21:47:08.000000000 -0400
 @@ -130,7 +130,7 @@ static int aio_setup_ring(struct kioctx 
  	size += sizeof(struct io_event) * nr_events;
  	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
@@ -29102,9 +35437,18 @@ diff -urNp linux-2.6.38.2/fs/aio.c linux-2.6.38.2/fs/aio.c
  		return -EINVAL;
  
  	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
-diff -urNp linux-2.6.38.2/fs/attr.c linux-2.6.38.2/fs/attr.c
---- linux-2.6.38.2/fs/attr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/attr.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1099,6 +1099,8 @@ static int read_events(struct kioctx *ct
+ 	struct aio_timeout	to;
+ 	int			retry = 0;
+ 
++	pax_track_stack();
++
+ 	/* needed to zero any padding within an entry (there shouldn't be 
+ 	 * any, but C is fun!
+ 	 */
+diff -urNp linux-2.6.38.7/fs/attr.c linux-2.6.38.7/fs/attr.c
+--- linux-2.6.38.7/fs/attr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/attr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -98,6 +98,7 @@ int inode_newsize_ok(const struct inode 
  		unsigned long limit;
  
@@ -29113,9 +35457,9 @@ diff -urNp linux-2.6.38.2/fs/attr.c linux-2.6.38.2/fs/attr.c
  		if (limit != RLIM_INFINITY && offset > limit)
  			goto out_sig;
  		if (offset > inode->i_sb->s_maxbytes)
-diff -urNp linux-2.6.38.2/fs/befs/linuxvfs.c linux-2.6.38.2/fs/befs/linuxvfs.c
---- linux-2.6.38.2/fs/befs/linuxvfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/befs/linuxvfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/befs/linuxvfs.c linux-2.6.38.7/fs/befs/linuxvfs.c
+--- linux-2.6.38.7/fs/befs/linuxvfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/befs/linuxvfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -499,7 +499,7 @@ static void befs_put_link(struct dentry 
  {
  	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
@@ -29125,9 +35469,9 @@ diff -urNp linux-2.6.38.2/fs/befs/linuxvfs.c linux-2.6.38.2/fs/befs/linuxvfs.c
  		if (!IS_ERR(link))
  			kfree(link);
  	}
-diff -urNp linux-2.6.38.2/fs/binfmt_aout.c linux-2.6.38.2/fs/binfmt_aout.c
---- linux-2.6.38.2/fs/binfmt_aout.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/binfmt_aout.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/binfmt_aout.c linux-2.6.38.7/fs/binfmt_aout.c
+--- linux-2.6.38.7/fs/binfmt_aout.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/binfmt_aout.c	2011-04-28 19:34:15.000000000 -0400
 @@ -16,6 +16,7 @@
  #include <linux/string.h>
  #include <linux/fs.h>
@@ -29204,9 +35548,9 @@ diff -urNp linux-2.6.38.2/fs/binfmt_aout.c linux-2.6.38.2/fs/binfmt_aout.c
  				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
  				fd_offset + ex.a_text);
  		up_write(&current->mm->mmap_sem);
-diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
---- linux-2.6.38.2/fs/binfmt_elf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/binfmt_elf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/binfmt_elf.c linux-2.6.38.7/fs/binfmt_elf.c
+--- linux-2.6.38.7/fs/binfmt_elf.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/fs/binfmt_elf.c	2011-05-16 21:47:08.000000000 -0400
 @@ -51,6 +51,10 @@ static int elf_core_dump(struct coredump
  #define elf_core_dump	NULL
  #endif
@@ -29248,7 +35592,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	return 0;
  }
  
-@@ -148,7 +159,7 @@ create_elf_tables(struct linux_binprm *b
+@@ -148,12 +159,15 @@ create_elf_tables(struct linux_binprm *b
  	elf_addr_t __user *u_rand_bytes;
  	const char *k_platform = ELF_PLATFORM;
  	const char *k_base_platform = ELF_BASE_PLATFORM;
@@ -29257,7 +35601,15 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	int items;
  	elf_addr_t *elf_info;
  	int ei_index = 0;
-@@ -195,8 +206,12 @@ create_elf_tables(struct linux_binprm *b
+ 	const struct cred *cred = current_cred();
+ 	struct vm_area_struct *vma;
++	unsigned long saved_auxv[AT_VECTOR_SIZE];
++
++	pax_track_stack();
+ 
+ 	/*
+ 	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
+@@ -195,8 +209,12 @@ create_elf_tables(struct linux_binprm *b
  	 * Generate 16 random bytes for userspace PRNG seeding.
  	 */
  	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
@@ -29272,7 +35624,20 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
  		return -EFAULT;
  
-@@ -381,10 +396,10 @@ static unsigned long load_elf_interp(str
+@@ -308,9 +326,11 @@ create_elf_tables(struct linux_binprm *b
+ 		return -EFAULT;
+ 	current->mm->env_end = p;
+ 
++	memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
++
+ 	/* Put the elf_info on the stack in the right place.  */
+ 	sp = (elf_addr_t __user *)envp + 1;
+-	if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
++	if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
+ 		return -EFAULT;
+ 	return 0;
+ }
+@@ -381,10 +401,10 @@ static unsigned long load_elf_interp(str
  {
  	struct elf_phdr *elf_phdata;
  	struct elf_phdr *eppnt;
@@ -29285,7 +35650,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	unsigned long total_size;
  	int retval, i, size;
  
-@@ -430,6 +445,11 @@ static unsigned long load_elf_interp(str
+@@ -430,6 +450,11 @@ static unsigned long load_elf_interp(str
  		goto out_close;
  	}
  
@@ -29297,7 +35662,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	eppnt = elf_phdata;
  	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
  		if (eppnt->p_type == PT_LOAD) {
-@@ -473,8 +493,8 @@ static unsigned long load_elf_interp(str
+@@ -473,8 +498,8 @@ static unsigned long load_elf_interp(str
  			k = load_addr + eppnt->p_vaddr;
  			if (BAD_ADDR(k) ||
  			    eppnt->p_filesz > eppnt->p_memsz ||
@@ -29308,7 +35673,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  				error = -ENOMEM;
  				goto out_close;
  			}
-@@ -528,6 +548,177 @@ out:
+@@ -528,6 +553,193 @@ out:
  	return error;
  }
  
@@ -29448,6 +35813,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
 +
 +#ifdef CONFIG_PAX_PT_PAX_FLAGS
 +	unsigned long i;
++	int found_flags = 0;
 +#endif
 +
 +#ifdef CONFIG_PAX_EI_PAX
@@ -29471,10 +35837,25 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
 +#endif
 +
 +				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
++			found_flags = 1;
 +			break;
 +		}
 +#endif
 +
++#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
++	if (found_flags == 0) {
++		struct elf_phdr phdr;
++		memset(&phdr, 0, sizeof(phdr));
++		phdr.p_flags = PF_NOEMUTRAMP;
++#ifdef CONFIG_PAX_SOFTMODE
++		if (pax_softmode)
++			pax_flags = pax_parse_softmode(&phdr);
++		else
++#endif
++			pax_flags = pax_parse_hardmode(&phdr);
++	}
++#endif
++
 +	if (0 > pax_check_flags(&pax_flags))
 +		return -EINVAL;
 +
@@ -29486,7 +35867,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  /*
   * These are the functions used to load ELF style executables and shared
   * libraries.  There is no binary dependent code anywhere else.
-@@ -544,6 +735,11 @@ static unsigned long randomize_stack_top
+@@ -544,6 +756,11 @@ static unsigned long randomize_stack_top
  {
  	unsigned int random_variable = 0;
  
@@ -29498,7 +35879,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	if ((current->flags & PF_RANDOMIZE) &&
  		!(current->personality & ADDR_NO_RANDOMIZE)) {
  		random_variable = get_random_int() & STACK_RND_MASK;
-@@ -562,7 +758,7 @@ static int load_elf_binary(struct linux_
+@@ -562,7 +779,7 @@ static int load_elf_binary(struct linux_
   	unsigned long load_addr = 0, load_bias = 0;
  	int load_addr_set = 0;
  	char * elf_interpreter = NULL;
@@ -29507,7 +35888,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	struct elf_phdr *elf_ppnt, *elf_phdata;
  	unsigned long elf_bss, elf_brk;
  	int retval, i;
-@@ -572,11 +768,11 @@ static int load_elf_binary(struct linux_
+@@ -572,11 +789,11 @@ static int load_elf_binary(struct linux_
  	unsigned long start_code, end_code, start_data, end_data;
  	unsigned long reloc_func_desc = 0;
  	int executable_stack = EXSTACK_DEFAULT;
@@ -29520,7 +35901,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  
  	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
  	if (!loc) {
-@@ -714,11 +910,80 @@ static int load_elf_binary(struct linux_
+@@ -714,11 +931,81 @@ static int load_elf_binary(struct linux_
  
  	/* OK, This is the point of no return */
  	current->flags &= ~PF_FORKNOEXEC;
@@ -29571,6 +35952,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
 +		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
 +		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
 +		pax_task_size = SEGMEXEC_TASK_SIZE;
++		current->mm->def_flags |= VM_NOHUGEPAGE;
 +	}
 +#endif
 +
@@ -29602,7 +35984,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
  		current->personality |= READ_IMPLIES_EXEC;
  
-@@ -800,6 +1065,20 @@ static int load_elf_binary(struct linux_
+@@ -800,6 +1087,20 @@ static int load_elf_binary(struct linux_
  #else
  			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
  #endif
@@ -29623,7 +36005,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  		}
  
  		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
-@@ -832,9 +1111,9 @@ static int load_elf_binary(struct linux_
+@@ -832,9 +1133,9 @@ static int load_elf_binary(struct linux_
  		 * allowed task size. Note that p_filesz must always be
  		 * <= p_memsz so it is only necessary to check p_memsz.
  		 */
@@ -29636,7 +36018,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  			/* set_brk can never work. Avoid overflows. */
  			send_sig(SIGKILL, current, 0);
  			retval = -EINVAL;
-@@ -862,6 +1141,11 @@ static int load_elf_binary(struct linux_
+@@ -862,6 +1163,11 @@ static int load_elf_binary(struct linux_
  	start_data += load_bias;
  	end_data += load_bias;
  
@@ -29648,7 +36030,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	/* Calling set_brk effectively mmaps the pages that we need
  	 * for the bss and break sections.  We must do this before
  	 * mapping in the interpreter, to make sure it doesn't wind
-@@ -873,9 +1157,11 @@ static int load_elf_binary(struct linux_
+@@ -873,9 +1179,11 @@ static int load_elf_binary(struct linux_
  		goto out_free_dentry;
  	}
  	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
@@ -29663,7 +36045,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	}
  
  	if (elf_interpreter) {
-@@ -1086,7 +1372,7 @@ out:
+@@ -1090,7 +1398,7 @@ out:
   * Decide what to dump of a segment, part, all or none.
   */
  static unsigned long vma_dump_size(struct vm_area_struct *vma,
@@ -29672,7 +36054,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  {
  #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
  
-@@ -1120,7 +1406,7 @@ static unsigned long vma_dump_size(struc
+@@ -1124,7 +1432,7 @@ static unsigned long vma_dump_size(struc
  	if (vma->vm_file == NULL)
  		return 0;
  
@@ -29681,7 +36063,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  		goto whole;
  
  	/*
-@@ -1342,9 +1628,9 @@ static void fill_auxv_note(struct memelf
+@@ -1346,9 +1654,9 @@ static void fill_auxv_note(struct memelf
  {
  	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
  	int i = 0;
@@ -29693,7 +36075,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
  }
  
-@@ -1850,14 +2136,14 @@ static void fill_extnum_info(struct elfh
+@@ -1854,14 +2162,14 @@ static void fill_extnum_info(struct elfh
  }
  
  static size_t elf_core_vma_data_size(struct vm_area_struct *gate_vma,
@@ -29710,7 +36092,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	return size;
  }
  
-@@ -1951,7 +2237,7 @@ static int elf_core_dump(struct coredump
+@@ -1955,7 +2263,7 @@ static int elf_core_dump(struct coredump
  
  	dataoff = offset = roundup(offset, ELF_EXEC_PAGESIZE);
  
@@ -29719,7 +36101,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	offset += elf_core_extra_data_size();
  	e_shoff = offset;
  
-@@ -1965,10 +2251,12 @@ static int elf_core_dump(struct coredump
+@@ -1969,10 +2277,12 @@ static int elf_core_dump(struct coredump
  	offset = dataoff;
  
  	size += sizeof(*elf);
@@ -29732,7 +36114,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  	if (size > cprm->limit
  	    || !dump_write(cprm->file, phdr4note, sizeof(*phdr4note)))
  		goto end_coredump;
-@@ -1982,7 +2270,7 @@ static int elf_core_dump(struct coredump
+@@ -1986,7 +2296,7 @@ static int elf_core_dump(struct coredump
  		phdr.p_offset = offset;
  		phdr.p_vaddr = vma->vm_start;
  		phdr.p_paddr = 0;
@@ -29741,7 +36123,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  		phdr.p_memsz = vma->vm_end - vma->vm_start;
  		offset += phdr.p_filesz;
  		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
-@@ -1993,6 +2281,7 @@ static int elf_core_dump(struct coredump
+@@ -1997,6 +2307,7 @@ static int elf_core_dump(struct coredump
  		phdr.p_align = ELF_EXEC_PAGESIZE;
  
  		size += sizeof(phdr);
@@ -29749,7 +36131,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, &phdr, sizeof(phdr)))
  			goto end_coredump;
-@@ -2017,7 +2306,7 @@ static int elf_core_dump(struct coredump
+@@ -2021,7 +2332,7 @@ static int elf_core_dump(struct coredump
  		unsigned long addr;
  		unsigned long end;
  
@@ -29758,7 +36140,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  
  		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
  			struct page *page;
-@@ -2026,6 +2315,7 @@ static int elf_core_dump(struct coredump
+@@ -2030,6 +2341,7 @@ static int elf_core_dump(struct coredump
  			page = get_dump_page(addr);
  			if (page) {
  				void *kaddr = kmap(page);
@@ -29766,7 +36148,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  				stop = ((size += PAGE_SIZE) > cprm->limit) ||
  					!dump_write(cprm->file, kaddr,
  						    PAGE_SIZE);
-@@ -2043,6 +2333,7 @@ static int elf_core_dump(struct coredump
+@@ -2047,6 +2359,7 @@ static int elf_core_dump(struct coredump
  
  	if (e_phnum == PN_XNUM) {
  		size += sizeof(*shdr4extnum);
@@ -29774,7 +36156,7 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  		if (size > cprm->limit
  		    || !dump_write(cprm->file, shdr4extnum,
  				   sizeof(*shdr4extnum)))
-@@ -2063,6 +2354,97 @@ out:
+@@ -2067,6 +2380,97 @@ out:
  
  #endif		/* CONFIG_ELF_CORE */
  
@@ -29872,9 +36254,9 @@ diff -urNp linux-2.6.38.2/fs/binfmt_elf.c linux-2.6.38.2/fs/binfmt_elf.c
  static int __init init_elf_binfmt(void)
  {
  	return register_binfmt(&elf_format);
-diff -urNp linux-2.6.38.2/fs/binfmt_flat.c linux-2.6.38.2/fs/binfmt_flat.c
---- linux-2.6.38.2/fs/binfmt_flat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/binfmt_flat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/binfmt_flat.c linux-2.6.38.7/fs/binfmt_flat.c
+--- linux-2.6.38.7/fs/binfmt_flat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/binfmt_flat.c	2011-04-28 19:34:15.000000000 -0400
 @@ -567,7 +567,9 @@ static int load_flat_file(struct linux_b
  				realdatastart = (unsigned long) -ENOMEM;
  			printk("Unable to allocate RAM for process data, errno %d\n",
@@ -29907,21 +36289,9 @@ diff -urNp linux-2.6.38.2/fs/binfmt_flat.c linux-2.6.38.2/fs/binfmt_flat.c
  			ret = result;
  			goto err;
  		}
-diff -urNp linux-2.6.38.2/fs/binfmt_misc.c linux-2.6.38.2/fs/binfmt_misc.c
---- linux-2.6.38.2/fs/binfmt_misc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/binfmt_misc.c	2011-03-21 18:31:35.000000000 -0400
-@@ -698,7 +698,7 @@ static int bm_fill_super(struct super_bl
- 	static struct tree_descr bm_files[] = {
- 		[2] = {"status", &bm_status_operations, S_IWUSR|S_IRUGO},
- 		[3] = {"register", &bm_register_operations, S_IWUSR},
--		/* last one */ {""}
-+		/* last one */ {"", NULL, 0}
- 	};
- 	int err = simple_fill_super(sb, 0x42494e4d, bm_files);
- 	if (!err)
-diff -urNp linux-2.6.38.2/fs/bio.c linux-2.6.38.2/fs/bio.c
---- linux-2.6.38.2/fs/bio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/bio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/bio.c linux-2.6.38.7/fs/bio.c
+--- linux-2.6.38.7/fs/bio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/bio.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1233,7 +1233,7 @@ static void bio_copy_kern_endio(struct b
  	const int read = bio_data_dir(bio) == READ;
  	struct bio_map_data *bmd = bio->bi_private;
@@ -29931,9 +36301,9 @@ diff -urNp linux-2.6.38.2/fs/bio.c linux-2.6.38.2/fs/bio.c
  
  	__bio_for_each_segment(bvec, bio, i, 0) {
  		char *addr = page_address(bvec->bv_page);
-diff -urNp linux-2.6.38.2/fs/block_dev.c linux-2.6.38.2/fs/block_dev.c
---- linux-2.6.38.2/fs/block_dev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/block_dev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/block_dev.c linux-2.6.38.7/fs/block_dev.c
+--- linux-2.6.38.7/fs/block_dev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/block_dev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -669,7 +669,7 @@ static bool bd_may_claim(struct block_de
  	else if (bdev->bd_contains == bdev)
  		return true;  	 /* is a whole device which isn't held */
@@ -29943,9 +36313,9 @@ diff -urNp linux-2.6.38.2/fs/block_dev.c linux-2.6.38.2/fs/block_dev.c
  		return true; 	 /* is a partition of a device that is being partitioned */
  	else if (whole->bd_holder != NULL)
  		return false;	 /* is a partition of a held device */
-diff -urNp linux-2.6.38.2/fs/btrfs/ctree.c linux-2.6.38.2/fs/btrfs/ctree.c
---- linux-2.6.38.2/fs/btrfs/ctree.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/ctree.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/ctree.c linux-2.6.38.7/fs/btrfs/ctree.c
+--- linux-2.6.38.7/fs/btrfs/ctree.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/ctree.c	2011-04-28 19:34:15.000000000 -0400
 @@ -468,9 +468,12 @@ static noinline int __btrfs_cow_block(st
  		free_extent_buffer(buf);
  		add_root_to_dirty_list(root);
@@ -29970,9 +36340,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/ctree.c linux-2.6.38.2/fs/btrfs/ctree.c
  		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
  		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
  	}
-diff -urNp linux-2.6.38.2/fs/btrfs/disk-io.c linux-2.6.38.2/fs/btrfs/disk-io.c
---- linux-2.6.38.2/fs/btrfs/disk-io.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/disk-io.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/disk-io.c linux-2.6.38.7/fs/btrfs/disk-io.c
+--- linux-2.6.38.7/fs/btrfs/disk-io.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/disk-io.c	2011-04-28 19:34:15.000000000 -0400
 @@ -41,7 +41,7 @@
  #include "tree-log.h"
  #include "free-space-cache.h"
@@ -29982,7 +36352,7 @@ diff -urNp linux-2.6.38.2/fs/btrfs/disk-io.c linux-2.6.38.2/fs/btrfs/disk-io.c
  static void end_workqueue_fn(struct btrfs_work *work);
  static void free_fs_root(struct btrfs_root *root);
  static void btrfs_check_super_valid(struct btrfs_fs_info *fs_info,
-@@ -3028,7 +3028,7 @@ static int btrfs_cleanup_transaction(str
+@@ -3030,7 +3030,7 @@ static int btrfs_cleanup_transaction(str
  	return 0;
  }
  
@@ -29991,9 +36361,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/disk-io.c linux-2.6.38.2/fs/btrfs/disk-io.c
  	.write_cache_pages_lock_hook = btree_lock_page_hook,
  	.readpage_end_io_hook = btree_readpage_end_io_hook,
  	.submit_bio_hook = btree_submit_bio_hook,
-diff -urNp linux-2.6.38.2/fs/btrfs/extent_io.h linux-2.6.38.2/fs/btrfs/extent_io.h
---- linux-2.6.38.2/fs/btrfs/extent_io.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/extent_io.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/extent_io.h linux-2.6.38.7/fs/btrfs/extent_io.h
+--- linux-2.6.38.7/fs/btrfs/extent_io.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/extent_io.h	2011-04-28 19:34:15.000000000 -0400
 @@ -55,36 +55,36 @@ typedef	int (extent_submit_bio_hook_t)(s
  				       struct bio *bio, int mirror_num,
  				       unsigned long bio_flags, u64 bio_offset);
@@ -30054,9 +36424,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/extent_io.h linux-2.6.38.2/fs/btrfs/extent_io
  };
  
  struct extent_state {
-diff -urNp linux-2.6.38.2/fs/btrfs/free-space-cache.c linux-2.6.38.2/fs/btrfs/free-space-cache.c
---- linux-2.6.38.2/fs/btrfs/free-space-cache.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/free-space-cache.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/free-space-cache.c linux-2.6.38.7/fs/btrfs/free-space-cache.c
+--- linux-2.6.38.7/fs/btrfs/free-space-cache.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/free-space-cache.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1855,8 +1855,6 @@ u64 btrfs_alloc_from_cluster(struct btrf
  
  	while(1) {
@@ -30075,9 +36445,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/free-space-cache.c linux-2.6.38.2/fs/btrfs/fr
  
  		if (entry->bitmap && entry->bytes > bytes + empty_size) {
  			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
-diff -urNp linux-2.6.38.2/fs/btrfs/inode.c linux-2.6.38.2/fs/btrfs/inode.c
---- linux-2.6.38.2/fs/btrfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/inode.c	2011-03-24 23:08:20.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/inode.c linux-2.6.38.7/fs/btrfs/inode.c
+--- linux-2.6.38.7/fs/btrfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -64,7 +64,7 @@ static const struct inode_operations btr
  static const struct address_space_operations btrfs_aops;
  static const struct address_space_operations btrfs_symlink_aops;
@@ -30120,10 +36490,10 @@ diff -urNp linux-2.6.38.2/fs/btrfs/inode.c linux-2.6.38.2/fs/btrfs/inode.c
  	.fill_delalloc = run_delalloc_range,
  	.submit_bio_hook = btrfs_submit_bio_hook,
  	.merge_bio_hook = btrfs_merge_bio_hook,
-diff -urNp linux-2.6.38.2/fs/btrfs/ioctl.c linux-2.6.38.2/fs/btrfs/ioctl.c
---- linux-2.6.38.2/fs/btrfs/ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/ioctl.c	2011-03-21 18:31:35.000000000 -0400
-@@ -2270,9 +2270,12 @@ long btrfs_ioctl_space_info(struct btrfs
+diff -urNp linux-2.6.38.7/fs/btrfs/ioctl.c linux-2.6.38.7/fs/btrfs/ioctl.c
+--- linux-2.6.38.7/fs/btrfs/ioctl.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/ioctl.c	2011-04-28 19:34:15.000000000 -0400
+@@ -2274,9 +2274,12 @@ long btrfs_ioctl_space_info(struct btrfs
  	for (i = 0; i < num_types; i++) {
  		struct btrfs_space_info *tmp;
  
@@ -30136,7 +36506,7 @@ diff -urNp linux-2.6.38.2/fs/btrfs/ioctl.c linux-2.6.38.2/fs/btrfs/ioctl.c
  		info = NULL;
  		rcu_read_lock();
  		list_for_each_entry_rcu(tmp, &root->fs_info->space_info,
-@@ -2294,10 +2297,7 @@ long btrfs_ioctl_space_info(struct btrfs
+@@ -2298,10 +2301,7 @@ long btrfs_ioctl_space_info(struct btrfs
  				memcpy(dest, &space, sizeof(space));
  				dest++;
  				space_args.total_spaces++;
@@ -30147,9 +36517,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/ioctl.c linux-2.6.38.2/fs/btrfs/ioctl.c
  		}
  		up_read(&info->groups_sem);
  	}
-diff -urNp linux-2.6.38.2/fs/btrfs/relocation.c linux-2.6.38.2/fs/btrfs/relocation.c
---- linux-2.6.38.2/fs/btrfs/relocation.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/btrfs/relocation.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/btrfs/relocation.c linux-2.6.38.7/fs/btrfs/relocation.c
+--- linux-2.6.38.7/fs/btrfs/relocation.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/btrfs/relocation.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1239,7 +1239,7 @@ static int __update_reloc_root(struct bt
  	}
  	spin_unlock(&rc->reloc_root_tree.lock);
@@ -30159,9 +36529,9 @@ diff -urNp linux-2.6.38.2/fs/btrfs/relocation.c linux-2.6.38.2/fs/btrfs/relocati
  
  	if (!del) {
  		spin_lock(&rc->reloc_root_tree.lock);
-diff -urNp linux-2.6.38.2/fs/cachefiles/bind.c linux-2.6.38.2/fs/cachefiles/bind.c
---- linux-2.6.38.2/fs/cachefiles/bind.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/cachefiles/bind.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/cachefiles/bind.c linux-2.6.38.7/fs/cachefiles/bind.c
+--- linux-2.6.38.7/fs/cachefiles/bind.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/bind.c	2011-04-28 19:34:15.000000000 -0400
 @@ -39,13 +39,11 @@ int cachefiles_daemon_bind(struct cachef
  	       args);
  
@@ -30178,9 +36548,9 @@ diff -urNp linux-2.6.38.2/fs/cachefiles/bind.c linux-2.6.38.2/fs/cachefiles/bind
  	       cache->bcull_percent < cache->brun_percent &&
  	       cache->brun_percent  < 100);
  
-diff -urNp linux-2.6.38.2/fs/cachefiles/daemon.c linux-2.6.38.2/fs/cachefiles/daemon.c
---- linux-2.6.38.2/fs/cachefiles/daemon.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/cachefiles/daemon.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/cachefiles/daemon.c linux-2.6.38.7/fs/cachefiles/daemon.c
+--- linux-2.6.38.7/fs/cachefiles/daemon.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/daemon.c	2011-04-28 19:34:15.000000000 -0400
 @@ -196,7 +196,7 @@ static ssize_t cachefiles_daemon_read(st
  	if (n > buflen)
  		return -EMSGSIZE;
@@ -30217,9 +36587,87 @@ diff -urNp linux-2.6.38.2/fs/cachefiles/daemon.c linux-2.6.38.2/fs/cachefiles/da
  		return cachefiles_daemon_range_error(cache, args);
  
  	cache->bstop_percent = bstop;
-diff -urNp linux-2.6.38.2/fs/cachefiles/rdwr.c linux-2.6.38.2/fs/cachefiles/rdwr.c
---- linux-2.6.38.2/fs/cachefiles/rdwr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/cachefiles/rdwr.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/cachefiles/internal.h linux-2.6.38.7/fs/cachefiles/internal.h
+--- linux-2.6.38.7/fs/cachefiles/internal.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/internal.h	2011-04-28 19:57:25.000000000 -0400
+@@ -57,7 +57,7 @@ struct cachefiles_cache {
+ 	wait_queue_head_t		daemon_pollwq;	/* poll waitqueue for daemon */
+ 	struct rb_root			active_nodes;	/* active nodes (can't be culled) */
+ 	rwlock_t			active_lock;	/* lock for active_nodes */
+-	atomic_t			gravecounter;	/* graveyard uniquifier */
++	atomic_unchecked_t		gravecounter;	/* graveyard uniquifier */
+ 	unsigned			frun_percent;	/* when to stop culling (% files) */
+ 	unsigned			fcull_percent;	/* when to start culling (% files) */
+ 	unsigned			fstop_percent;	/* when to stop allocating (% files) */
+@@ -169,19 +169,19 @@ extern int cachefiles_check_in_use(struc
+  * proc.c
+  */
+ #ifdef CONFIG_CACHEFILES_HISTOGRAM
+-extern atomic_t cachefiles_lookup_histogram[HZ];
+-extern atomic_t cachefiles_mkdir_histogram[HZ];
+-extern atomic_t cachefiles_create_histogram[HZ];
++extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
++extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
++extern atomic_unchecked_t cachefiles_create_histogram[HZ];
+ 
+ extern int __init cachefiles_proc_init(void);
+ extern void cachefiles_proc_cleanup(void);
+ static inline
+-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
++void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
+ {
+ 	unsigned long jif = jiffies - start_jif;
+ 	if (jif >= HZ)
+ 		jif = HZ - 1;
+-	atomic_inc(&histogram[jif]);
++	atomic_inc_unchecked(&histogram[jif]);
+ }
+ 
+ #else
+diff -urNp linux-2.6.38.7/fs/cachefiles/namei.c linux-2.6.38.7/fs/cachefiles/namei.c
+--- linux-2.6.38.7/fs/cachefiles/namei.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/namei.c	2011-04-28 19:57:25.000000000 -0400
+@@ -309,7 +309,7 @@ try_again:
+ 	/* first step is to make up a grave dentry in the graveyard */
+ 	sprintf(nbuffer, "%08x%08x",
+ 		(uint32_t) get_seconds(),
+-		(uint32_t) atomic_inc_return(&cache->gravecounter));
++		(uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
+ 
+ 	/* do the multiway lock magic */
+ 	trap = lock_rename(cache->graveyard, dir);
+diff -urNp linux-2.6.38.7/fs/cachefiles/proc.c linux-2.6.38.7/fs/cachefiles/proc.c
+--- linux-2.6.38.7/fs/cachefiles/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/proc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -14,9 +14,9 @@
+ #include <linux/seq_file.h>
+ #include "internal.h"
+ 
+-atomic_t cachefiles_lookup_histogram[HZ];
+-atomic_t cachefiles_mkdir_histogram[HZ];
+-atomic_t cachefiles_create_histogram[HZ];
++atomic_unchecked_t cachefiles_lookup_histogram[HZ];
++atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
++atomic_unchecked_t cachefiles_create_histogram[HZ];
+ 
+ /*
+  * display the latency histogram
+@@ -35,9 +35,9 @@ static int cachefiles_histogram_show(str
+ 		return 0;
+ 	default:
+ 		index = (unsigned long) v - 3;
+-		x = atomic_read(&cachefiles_lookup_histogram[index]);
+-		y = atomic_read(&cachefiles_mkdir_histogram[index]);
+-		z = atomic_read(&cachefiles_create_histogram[index]);
++		x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
++		y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
++		z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
+ 		if (x == 0 && y == 0 && z == 0)
+ 			return 0;
+ 
+diff -urNp linux-2.6.38.7/fs/cachefiles/rdwr.c linux-2.6.38.7/fs/cachefiles/rdwr.c
+--- linux-2.6.38.7/fs/cachefiles/rdwr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cachefiles/rdwr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -945,7 +945,7 @@ int cachefiles_write_page(struct fscache
  			old_fs = get_fs();
  			set_fs(KERNEL_DS);
@@ -30229,9 +36677,9 @@ diff -urNp linux-2.6.38.2/fs/cachefiles/rdwr.c linux-2.6.38.2/fs/cachefiles/rdwr
  			set_fs(old_fs);
  			kunmap(page);
  			if (ret != len)
-diff -urNp linux-2.6.38.2/fs/ceph/dir.c linux-2.6.38.2/fs/ceph/dir.c
---- linux-2.6.38.2/fs/ceph/dir.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ceph/dir.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ceph/dir.c linux-2.6.38.7/fs/ceph/dir.c
+--- linux-2.6.38.7/fs/ceph/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ceph/dir.c	2011-04-28 19:34:15.000000000 -0400
 @@ -226,7 +226,7 @@ static int ceph_readdir(struct file *fil
  	struct ceph_fs_client *fsc = ceph_inode_to_client(inode);
  	struct ceph_mds_client *mdsc = fsc->mdsc;
@@ -30250,21 +36698,182 @@ diff -urNp linux-2.6.38.2/fs/ceph/dir.c linux-2.6.38.2/fs/ceph/dir.c
  		u64 pos = ceph_make_fpos(frag, off);
  		struct ceph_mds_reply_inode *in =
  			rinfo->dir_in[off - fi->offset].in;
-diff -urNp linux-2.6.38.2/fs/cifs/cifs_uniupr.h linux-2.6.38.2/fs/cifs/cifs_uniupr.h
---- linux-2.6.38.2/fs/cifs/cifs_uniupr.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/cifs/cifs_uniupr.h	2011-03-21 18:31:35.000000000 -0400
-@@ -132,7 +132,7 @@ const struct UniCaseRange CifsUniUpperRa
- 	{0x0490, 0x04cc, UniCaseRangeU0490},
- 	{0x1e00, 0x1ffc, UniCaseRangeU1e00},
- 	{0xff40, 0xff5a, UniCaseRangeUff40},
--	{0}
-+	{0, 0, NULL}
- };
- #endif
- 
-diff -urNp linux-2.6.38.2/fs/cifs/link.c linux-2.6.38.2/fs/cifs/link.c
---- linux-2.6.38.2/fs/cifs/link.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/cifs/link.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/cifs/cifs_debug.c linux-2.6.38.7/fs/cifs/cifs_debug.c
+--- linux-2.6.38.7/fs/cifs/cifs_debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cifs/cifs_debug.c	2011-04-28 19:57:25.000000000 -0400
+@@ -279,25 +279,25 @@ static ssize_t cifs_stats_proc_write(str
+ 					tcon = list_entry(tmp3,
+ 							  struct cifsTconInfo,
+ 							  tcon_list);
+-					atomic_set(&tcon->num_smbs_sent, 0);
+-					atomic_set(&tcon->num_writes, 0);
+-					atomic_set(&tcon->num_reads, 0);
+-					atomic_set(&tcon->num_oplock_brks, 0);
+-					atomic_set(&tcon->num_opens, 0);
+-					atomic_set(&tcon->num_posixopens, 0);
+-					atomic_set(&tcon->num_posixmkdirs, 0);
+-					atomic_set(&tcon->num_closes, 0);
+-					atomic_set(&tcon->num_deletes, 0);
+-					atomic_set(&tcon->num_mkdirs, 0);
+-					atomic_set(&tcon->num_rmdirs, 0);
+-					atomic_set(&tcon->num_renames, 0);
+-					atomic_set(&tcon->num_t2renames, 0);
+-					atomic_set(&tcon->num_ffirst, 0);
+-					atomic_set(&tcon->num_fnext, 0);
+-					atomic_set(&tcon->num_fclose, 0);
+-					atomic_set(&tcon->num_hardlinks, 0);
+-					atomic_set(&tcon->num_symlinks, 0);
+-					atomic_set(&tcon->num_locks, 0);
++					atomic_set_unchecked(&tcon->num_smbs_sent, 0);
++					atomic_set_unchecked(&tcon->num_writes, 0);
++					atomic_set_unchecked(&tcon->num_reads, 0);
++					atomic_set_unchecked(&tcon->num_oplock_brks, 0);
++					atomic_set_unchecked(&tcon->num_opens, 0);
++					atomic_set_unchecked(&tcon->num_posixopens, 0);
++					atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
++					atomic_set_unchecked(&tcon->num_closes, 0);
++					atomic_set_unchecked(&tcon->num_deletes, 0);
++					atomic_set_unchecked(&tcon->num_mkdirs, 0);
++					atomic_set_unchecked(&tcon->num_rmdirs, 0);
++					atomic_set_unchecked(&tcon->num_renames, 0);
++					atomic_set_unchecked(&tcon->num_t2renames, 0);
++					atomic_set_unchecked(&tcon->num_ffirst, 0);
++					atomic_set_unchecked(&tcon->num_fnext, 0);
++					atomic_set_unchecked(&tcon->num_fclose, 0);
++					atomic_set_unchecked(&tcon->num_hardlinks, 0);
++					atomic_set_unchecked(&tcon->num_symlinks, 0);
++					atomic_set_unchecked(&tcon->num_locks, 0);
+ 				}
+ 			}
+ 		}
+@@ -357,41 +357,41 @@ static int cifs_stats_proc_show(struct s
+ 				if (tcon->need_reconnect)
+ 					seq_puts(m, "\tDISCONNECTED ");
+ 				seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
+-					atomic_read(&tcon->num_smbs_sent),
+-					atomic_read(&tcon->num_oplock_brks));
++					atomic_read_unchecked(&tcon->num_smbs_sent),
++					atomic_read_unchecked(&tcon->num_oplock_brks));
+ 				seq_printf(m, "\nReads:  %d Bytes: %lld",
+-					atomic_read(&tcon->num_reads),
++					atomic_read_unchecked(&tcon->num_reads),
+ 					(long long)(tcon->bytes_read));
+ 				seq_printf(m, "\nWrites: %d Bytes: %lld",
+-					atomic_read(&tcon->num_writes),
++					atomic_read_unchecked(&tcon->num_writes),
+ 					(long long)(tcon->bytes_written));
+ 				seq_printf(m, "\nFlushes: %d",
+-					atomic_read(&tcon->num_flushes));
++					atomic_read_unchecked(&tcon->num_flushes));
+ 				seq_printf(m, "\nLocks: %d HardLinks: %d "
+ 					      "Symlinks: %d",
+-					atomic_read(&tcon->num_locks),
+-					atomic_read(&tcon->num_hardlinks),
+-					atomic_read(&tcon->num_symlinks));
++					atomic_read_unchecked(&tcon->num_locks),
++					atomic_read_unchecked(&tcon->num_hardlinks),
++					atomic_read_unchecked(&tcon->num_symlinks));
+ 				seq_printf(m, "\nOpens: %d Closes: %d "
+ 					      "Deletes: %d",
+-					atomic_read(&tcon->num_opens),
+-					atomic_read(&tcon->num_closes),
+-					atomic_read(&tcon->num_deletes));
++					atomic_read_unchecked(&tcon->num_opens),
++					atomic_read_unchecked(&tcon->num_closes),
++					atomic_read_unchecked(&tcon->num_deletes));
+ 				seq_printf(m, "\nPosix Opens: %d "
+ 					      "Posix Mkdirs: %d",
+-					atomic_read(&tcon->num_posixopens),
+-					atomic_read(&tcon->num_posixmkdirs));
++					atomic_read_unchecked(&tcon->num_posixopens),
++					atomic_read_unchecked(&tcon->num_posixmkdirs));
+ 				seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
+-					atomic_read(&tcon->num_mkdirs),
+-					atomic_read(&tcon->num_rmdirs));
++					atomic_read_unchecked(&tcon->num_mkdirs),
++					atomic_read_unchecked(&tcon->num_rmdirs));
+ 				seq_printf(m, "\nRenames: %d T2 Renames %d",
+-					atomic_read(&tcon->num_renames),
+-					atomic_read(&tcon->num_t2renames));
++					atomic_read_unchecked(&tcon->num_renames),
++					atomic_read_unchecked(&tcon->num_t2renames));
+ 				seq_printf(m, "\nFindFirst: %d FNext %d "
+ 					      "FClose %d",
+-					atomic_read(&tcon->num_ffirst),
+-					atomic_read(&tcon->num_fnext),
+-					atomic_read(&tcon->num_fclose));
++					atomic_read_unchecked(&tcon->num_ffirst),
++					atomic_read_unchecked(&tcon->num_fnext),
++					atomic_read_unchecked(&tcon->num_fclose));
+ 			}
+ 		}
+ 	}
+diff -urNp linux-2.6.38.7/fs/cifs/cifsglob.h linux-2.6.38.7/fs/cifs/cifsglob.h
+--- linux-2.6.38.7/fs/cifs/cifsglob.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cifs/cifsglob.h	2011-04-28 19:57:25.000000000 -0400
+@@ -305,28 +305,28 @@ struct cifsTconInfo {
+ 	__u16 Flags;		/* optional support bits */
+ 	enum statusEnum tidStatus;
+ #ifdef CONFIG_CIFS_STATS
+-	atomic_t num_smbs_sent;
+-	atomic_t num_writes;
+-	atomic_t num_reads;
+-	atomic_t num_flushes;
+-	atomic_t num_oplock_brks;
+-	atomic_t num_opens;
+-	atomic_t num_closes;
+-	atomic_t num_deletes;
+-	atomic_t num_mkdirs;
+-	atomic_t num_posixopens;
+-	atomic_t num_posixmkdirs;
+-	atomic_t num_rmdirs;
+-	atomic_t num_renames;
+-	atomic_t num_t2renames;
+-	atomic_t num_ffirst;
+-	atomic_t num_fnext;
+-	atomic_t num_fclose;
+-	atomic_t num_hardlinks;
+-	atomic_t num_symlinks;
+-	atomic_t num_locks;
+-	atomic_t num_acl_get;
+-	atomic_t num_acl_set;
++	atomic_unchecked_t num_smbs_sent;
++	atomic_unchecked_t num_writes;
++	atomic_unchecked_t num_reads;
++	atomic_unchecked_t num_flushes;
++	atomic_unchecked_t num_oplock_brks;
++	atomic_unchecked_t num_opens;
++	atomic_unchecked_t num_closes;
++	atomic_unchecked_t num_deletes;
++	atomic_unchecked_t num_mkdirs;
++	atomic_unchecked_t num_posixopens;
++	atomic_unchecked_t num_posixmkdirs;
++	atomic_unchecked_t num_rmdirs;
++	atomic_unchecked_t num_renames;
++	atomic_unchecked_t num_t2renames;
++	atomic_unchecked_t num_ffirst;
++	atomic_unchecked_t num_fnext;
++	atomic_unchecked_t num_fclose;
++	atomic_unchecked_t num_hardlinks;
++	atomic_unchecked_t num_symlinks;
++	atomic_unchecked_t num_locks;
++	atomic_unchecked_t num_acl_get;
++	atomic_unchecked_t num_acl_set;
+ #ifdef CONFIG_CIFS_STATS2
+ 	unsigned long long time_writes;
+ 	unsigned long long time_reads;
+@@ -509,7 +509,7 @@ static inline char CIFS_DIR_SEP(const st
+ }
+ 
+ #ifdef CONFIG_CIFS_STATS
+-#define cifs_stats_inc atomic_inc
++#define cifs_stats_inc atomic_inc_unchecked
+ 
+ static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
+ 					    unsigned int bytes)
+diff -urNp linux-2.6.38.7/fs/cifs/link.c linux-2.6.38.7/fs/cifs/link.c
+--- linux-2.6.38.7/fs/cifs/link.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/cifs/link.c	2011-04-28 19:34:15.000000000 -0400
 @@ -577,7 +577,7 @@ symlink_exit:
  
  void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
@@ -30274,9 +36883,56 @@ diff -urNp linux-2.6.38.2/fs/cifs/link.c linux-2.6.38.2/fs/cifs/link.c
  	if (!IS_ERR(p))
  		kfree(p);
  }
-diff -urNp linux-2.6.38.2/fs/compat_binfmt_elf.c linux-2.6.38.2/fs/compat_binfmt_elf.c
---- linux-2.6.38.2/fs/compat_binfmt_elf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/compat_binfmt_elf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/coda/cache.c linux-2.6.38.7/fs/coda/cache.c
+--- linux-2.6.38.7/fs/coda/cache.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/coda/cache.c	2011-04-28 19:57:25.000000000 -0400
+@@ -24,7 +24,7 @@
+ #include "coda_linux.h"
+ #include "coda_cache.h"
+ 
+-static atomic_t permission_epoch = ATOMIC_INIT(0);
++static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
+ 
+ /* replace or extend an acl cache hit */
+ void coda_cache_enter(struct inode *inode, int mask)
+@@ -32,7 +32,7 @@ void coda_cache_enter(struct inode *inod
+ 	struct coda_inode_info *cii = ITOC(inode);
+ 
+ 	spin_lock(&cii->c_lock);
+-	cii->c_cached_epoch = atomic_read(&permission_epoch);
++	cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
+ 	if (cii->c_uid != current_fsuid()) {
+ 		cii->c_uid = current_fsuid();
+                 cii->c_cached_perm = mask;
+@@ -46,14 +46,14 @@ void coda_cache_clear_inode(struct inode
+ {
+ 	struct coda_inode_info *cii = ITOC(inode);
+ 	spin_lock(&cii->c_lock);
+-	cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
++	cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
+ 	spin_unlock(&cii->c_lock);
+ }
+ 
+ /* remove all acl caches */
+ void coda_cache_clear_all(struct super_block *sb)
+ {
+-	atomic_inc(&permission_epoch);
++	atomic_inc_unchecked(&permission_epoch);
+ }
+ 
+ 
+@@ -66,7 +66,7 @@ int coda_cache_check(struct inode *inode
+ 	spin_lock(&cii->c_lock);
+ 	hit = (mask & cii->c_cached_perm) == mask &&
+ 	    cii->c_uid == current_fsuid() &&
+-	    cii->c_cached_epoch == atomic_read(&permission_epoch);
++	    cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
+ 	spin_unlock(&cii->c_lock);
+ 
+ 	return hit;
+diff -urNp linux-2.6.38.7/fs/compat_binfmt_elf.c linux-2.6.38.7/fs/compat_binfmt_elf.c
+--- linux-2.6.38.7/fs/compat_binfmt_elf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/compat_binfmt_elf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -30,11 +30,13 @@
  #undef	elf_phdr
  #undef	elf_shdr
@@ -30291,9 +36947,9 @@ diff -urNp linux-2.6.38.2/fs/compat_binfmt_elf.c linux-2.6.38.2/fs/compat_binfmt
  #define elf_addr_t	Elf32_Addr
  
  /*
-diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
---- linux-2.6.38.2/fs/compat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/compat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/compat.c linux-2.6.38.7/fs/compat.c
+--- linux-2.6.38.7/fs/compat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/compat.c	2011-05-16 21:47:08.000000000 -0400
 @@ -594,7 +594,7 @@ ssize_t compat_rw_copy_check_uvector(int
  		goto out;
  
@@ -30384,15 +37040,7 @@ diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
  
  	error = vfs_readdir(file, compat_filldir64, &buf);
  	if (error >= 0)
-@@ -1423,6 +1441,7 @@ static int compat_copy_strings(int argc,
- 
- 				page = get_arg_page(bprm, pos, 1);
- 				if (!page) {
-+					/* We've exceed the stack rlimit. */
- 					ret = -E2BIG;
- 					goto out;
- 				}
-@@ -1464,6 +1483,11 @@ int compat_do_execve(char * filename,
+@@ -1464,6 +1482,11 @@ int compat_do_execve(char * filename,
  	compat_uptr_t __user *envp,
  	struct pt_regs * regs)
  {
@@ -30404,10 +37052,15 @@ diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1500,6 +1524,14 @@ int compat_do_execve(char * filename,
+@@ -1500,6 +1523,19 @@ int compat_do_execve(char * filename,
  	bprm->filename = filename;
  	bprm->interp = filename;
  
++	if (gr_process_user_ban()) {
++		retval = -EPERM;
++		goto out_file;
++	}
++
 +	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
 +	retval = -EAGAIN;
 +	if (gr_handle_nproc())
@@ -30419,7 +37072,7 @@ diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1529,9 +1561,40 @@ int compat_do_execve(char * filename,
+@@ -1529,9 +1565,40 @@ int compat_do_execve(char * filename,
  	if (retval < 0)
  		goto out;
  
@@ -30461,7 +37114,7 @@ diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
  
  	/* execve succeeded */
  	current->fs->in_exec = 0;
-@@ -1542,6 +1605,14 @@ int compat_do_execve(char * filename,
+@@ -1542,6 +1609,14 @@ int compat_do_execve(char * filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -30476,9 +37129,18 @@ diff -urNp linux-2.6.38.2/fs/compat.c linux-2.6.38.2/fs/compat.c
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-diff -urNp linux-2.6.38.2/fs/compat_ioctl.c linux-2.6.38.2/fs/compat_ioctl.c
---- linux-2.6.38.2/fs/compat_ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/compat_ioctl.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1712,6 +1787,8 @@ int compat_core_sys_select(int n, compat
+ 	struct fdtable *fdt;
+ 	long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
+ 
++	pax_track_stack();
++
+ 	if (n < 0)
+ 		goto out_nofds;
+ 
+diff -urNp linux-2.6.38.7/fs/compat_ioctl.c linux-2.6.38.7/fs/compat_ioctl.c
+--- linux-2.6.38.7/fs/compat_ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/compat_ioctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -208,6 +208,8 @@ static int do_video_set_spu_palette(unsi
  
  	err  = get_user(palp, &up->palette);
@@ -30499,21 +37161,48 @@ diff -urNp linux-2.6.38.2/fs/compat_ioctl.c linux-2.6.38.2/fs/compat_ioctl.c
  	if (a > b)
  		return 1;
  	if (a < b)
-diff -urNp linux-2.6.38.2/fs/debugfs/inode.c linux-2.6.38.2/fs/debugfs/inode.c
---- linux-2.6.38.2/fs/debugfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/debugfs/inode.c	2011-03-21 18:31:35.000000000 -0400
-@@ -130,7 +130,7 @@ static inline int debugfs_positive(struc
- 
- static int debug_fill_super(struct super_block *sb, void *data, int silent)
- {
--	static struct tree_descr debug_files[] = {{""}};
-+	static struct tree_descr debug_files[] = {{"", NULL, 0}};
- 
- 	return simple_fill_super(sb, DEBUGFS_MAGIC, debug_files);
- }
-diff -urNp linux-2.6.38.2/fs/dlm/lockspace.c linux-2.6.38.2/fs/dlm/lockspace.c
---- linux-2.6.38.2/fs/dlm/lockspace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/dlm/lockspace.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/configfs/dir.c linux-2.6.38.7/fs/configfs/dir.c
+--- linux-2.6.38.7/fs/configfs/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/configfs/dir.c	2011-05-11 18:34:57.000000000 -0400
+@@ -1571,7 +1571,8 @@ static int configfs_readdir(struct file 
+ 			}
+ 			for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
+ 				struct configfs_dirent *next;
+-				const char * name;
++				const unsigned char * name;
++				char d_name[sizeof(next->s_dentry->d_iname)];
+ 				int len;
+ 
+ 				next = list_entry(p, struct configfs_dirent,
+@@ -1580,7 +1581,12 @@ static int configfs_readdir(struct file 
+ 					continue;
+ 
+ 				name = configfs_get_name(next);
+-				len = strlen(name);
++				if (next->s_dentry && name == next->s_dentry->d_iname) {
++					len =  next->s_dentry->d_name.len;
++					memcpy(d_name, name, len);
++					name = d_name;
++				} else
++					len = strlen(name);
+ 				if (next->s_dentry)
+ 					ino = next->s_dentry->d_inode->i_ino;
+ 				else
+diff -urNp linux-2.6.38.7/fs/dcache.c linux-2.6.38.7/fs/dcache.c
+--- linux-2.6.38.7/fs/dcache.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/fs/dcache.c	2011-04-28 19:34:15.000000000 -0400
+@@ -3092,7 +3092,7 @@ void __init vfs_caches_init(unsigned lon
+ 	mempages -= reserve;
+ 
+ 	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
+-			SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
++			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
+ 
+ 	dcache_init();
+ 	inode_init();
+diff -urNp linux-2.6.38.7/fs/dlm/lockspace.c linux-2.6.38.7/fs/dlm/lockspace.c
+--- linux-2.6.38.7/fs/dlm/lockspace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/dlm/lockspace.c	2011-04-28 19:34:15.000000000 -0400
 @@ -200,7 +200,7 @@ static int dlm_uevent(struct kset *kset,
  	return 0;
  }
@@ -30523,9 +37212,9 @@ diff -urNp linux-2.6.38.2/fs/dlm/lockspace.c linux-2.6.38.2/fs/dlm/lockspace.c
  	.uevent = dlm_uevent,
  };
  
-diff -urNp linux-2.6.38.2/fs/ecryptfs/inode.c linux-2.6.38.2/fs/ecryptfs/inode.c
---- linux-2.6.38.2/fs/ecryptfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ecryptfs/inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ecryptfs/inode.c linux-2.6.38.7/fs/ecryptfs/inode.c
+--- linux-2.6.38.7/fs/ecryptfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ecryptfs/inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -658,7 +658,7 @@ static int ecryptfs_readlink_lower(struc
  	old_fs = get_fs();
  	set_fs(get_ds());
@@ -30553,9 +37242,9 @@ diff -urNp linux-2.6.38.2/fs/ecryptfs/inode.c linux-2.6.38.2/fs/ecryptfs/inode.c
  	if (!IS_ERR(buf)) {
  		/* Free the char* */
  		kfree(buf);
-diff -urNp linux-2.6.38.2/fs/ecryptfs/miscdev.c linux-2.6.38.2/fs/ecryptfs/miscdev.c
---- linux-2.6.38.2/fs/ecryptfs/miscdev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ecryptfs/miscdev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ecryptfs/miscdev.c linux-2.6.38.7/fs/ecryptfs/miscdev.c
+--- linux-2.6.38.7/fs/ecryptfs/miscdev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ecryptfs/miscdev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -328,7 +328,7 @@ check_list:
  		goto out_unlock_msg_ctx;
  	i = 5;
@@ -30565,9 +37254,9 @@ diff -urNp linux-2.6.38.2/fs/ecryptfs/miscdev.c linux-2.6.38.2/fs/ecryptfs/miscd
  			goto out_unlock_msg_ctx;
  		i += packet_length_size;
  		if (copy_to_user(&buf[i], msg_ctx->msg, msg_ctx->msg_size))
-diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
---- linux-2.6.38.2/fs/exec.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/exec.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/exec.c linux-2.6.38.7/fs/exec.c
+--- linux-2.6.38.7/fs/exec.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/exec.c	2011-04-28 19:57:25.000000000 -0400
 @@ -55,12 +55,24 @@
  #include <linux/fs_struct.h>
  #include <linux/pipe_fs_i.h>
@@ -30593,6 +37282,15 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  int core_uses_pid;
  char core_pattern[CORENAME_MAX_SIZE] = "core";
  unsigned int core_pipe_limit;
+@@ -70,7 +82,7 @@ struct core_name {
+ 	char *corename;
+ 	int used, size;
+ };
+-static atomic_t call_count = ATOMIC_INIT(1);
++static atomic_unchecked_t call_count = ATOMIC_INIT(1);
+ 
+ /* The maximal length of core_pattern is also specified in sysctl.c */
+ 
 @@ -120,7 +132,7 @@ SYSCALL_DEFINE1(uselib, const char __use
  		goto out;
  
@@ -30772,10 +37470,15 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  	struct linux_binprm *bprm;
  	struct file *file;
  	struct files_struct *displaced;
-@@ -1414,6 +1448,18 @@ int do_execve(const char * filename,
+@@ -1414,6 +1448,23 @@ int do_execve(const char * filename,
  	bprm->filename = filename;
  	bprm->interp = filename;
  
++	if (gr_process_user_ban()) {
++		retval = -EPERM;
++		goto out_file;
++	}
++
 +	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
 +
 +	if (gr_handle_nproc()) {
@@ -30791,7 +37494,7 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  	retval = bprm_mm_init(bprm);
  	if (retval)
  		goto out_file;
-@@ -1443,9 +1489,40 @@ int do_execve(const char * filename,
+@@ -1443,9 +1494,40 @@ int do_execve(const char * filename,
  	if (retval < 0)
  		goto out;
  
@@ -30833,7 +37536,7 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  
  	/* execve succeeded */
  	current->fs->in_exec = 0;
-@@ -1456,6 +1533,14 @@ int do_execve(const char * filename,
+@@ -1456,6 +1538,14 @@ int do_execve(const char * filename,
  		put_files_struct(displaced);
  	return retval;
  
@@ -30848,7 +37551,25 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  out:
  	if (bprm->mm) {
  		acct_arg_size(bprm, 0);
-@@ -1642,6 +1727,217 @@ out:
+@@ -1501,7 +1591,7 @@ static int expand_corename(struct core_n
+ {
+ 	char *old_corename = cn->corename;
+ 
+-	cn->size = CORENAME_MAX_SIZE * atomic_inc_return(&call_count);
++	cn->size = CORENAME_MAX_SIZE * atomic_inc_return_unchecked(&call_count);
+ 	cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL);
+ 
+ 	if (!cn->corename) {
+@@ -1554,7 +1644,7 @@ static int format_corename(struct core_n
+ 	int pid_in_pattern = 0;
+ 	int err = 0;
+ 
+-	cn->size = CORENAME_MAX_SIZE * atomic_read(&call_count);
++	cn->size = CORENAME_MAX_SIZE * atomic_read_unchecked(&call_count);
+ 	cn->corename = kmalloc(cn->size, GFP_KERNEL);
+ 	cn->used = 0;
+ 
+@@ -1642,6 +1732,208 @@ out:
  	return ispipe;
  }
  
@@ -31040,25 +37761,16 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
 +}
 +
 +
-+void pax_report_leak_to_user(const void *ptr, unsigned long len)
-+{
-+	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory leak attempt detected from %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
-+	else
-+		printk(KERN_ERR "PAX: kernel memory leak attempt detected from %p (%lu bytes)\n", ptr, len);
-+	dump_stack();
-+	do_group_exit(SIGKILL);
-+}
-+
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len)
++void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
 +{
 +	if (current->signal->curr_ip)
-+		printk(KERN_ERR "PAX: From %pI4: kernel memory overflow attempt detected to %p (%lu bytes)\n",
-+			&current->signal->curr_ip, ptr, len);
++		printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
++			&current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
 +	else
-+		printk(KERN_ERR "PAX: kernel memory overflow attempt detected to %p (%lu bytes)\n", ptr, len);
++		printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
++			to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
 +	dump_stack();
++	gr_handle_kernel_exploit();
 +	do_group_exit(SIGKILL);
 +}
 +#endif
@@ -31066,7 +37778,7 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  static int zap_process(struct task_struct *start, int exit_code)
  {
  	struct task_struct *t;
-@@ -1852,17 +2148,17 @@ static void wait_for_dump_helpers(struct
+@@ -1852,17 +2144,17 @@ static void wait_for_dump_helpers(struct
  	pipe = file->f_path.dentry->d_inode->i_pipe;
  
  	pipe_lock(pipe);
@@ -31089,20 +37801,55 @@ diff -urNp linux-2.6.38.2/fs/exec.c linux-2.6.38.2/fs/exec.c
  	pipe_unlock(pipe);
  
  }
-@@ -1978,6 +2274,10 @@ void do_coredump(long signr, int exit_co
+@@ -1923,7 +2215,7 @@ void do_coredump(long signr, int exit_co
+ 	int retval = 0;
+ 	int flag = 0;
+ 	int ispipe;
+-	static atomic_t core_dump_count = ATOMIC_INIT(0);
++	static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
+ 	struct coredump_params cprm = {
+ 		.signr = signr,
+ 		.regs = regs,
+@@ -1938,6 +2230,9 @@ void do_coredump(long signr, int exit_co
+ 
+ 	audit_core_dumps(signr);
+ 
++	if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
++		gr_handle_brute_attach(current, cprm.mm_flags);
++
+ 	binfmt = mm->binfmt;
+ 	if (!binfmt || !binfmt->core_dump)
+ 		goto fail;
+@@ -1978,6 +2273,8 @@ void do_coredump(long signr, int exit_co
  		goto fail_corename;
  	}
  
-+	if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
-+		gr_handle_brute_attach(current);
 +	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
 +
   	if (ispipe) {
  		int dump_count;
  		char **helper_argv;
-diff -urNp linux-2.6.38.2/fs/ext2/balloc.c linux-2.6.38.2/fs/ext2/balloc.c
---- linux-2.6.38.2/fs/ext2/balloc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext2/balloc.c	2011-03-21 18:31:35.000000000 -0400
+@@ -2005,7 +2302,7 @@ void do_coredump(long signr, int exit_co
+ 		}
+ 		cprm.limit = RLIM_INFINITY;
+ 
+-		dump_count = atomic_inc_return(&core_dump_count);
++		dump_count = atomic_inc_return_unchecked(&core_dump_count);
+ 		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
+ 			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
+ 			       task_tgid_vnr(current), current->comm);
+@@ -2075,7 +2372,7 @@ close_fail:
+ 		filp_close(cprm.file, NULL);
+ fail_dropcount:
+ 	if (ispipe)
+-		atomic_dec(&core_dump_count);
++		atomic_dec_unchecked(&core_dump_count);
+ fail_unlock:
+ 	kfree(cn.corename);
+ fail_corename:
+diff -urNp linux-2.6.38.7/fs/ext2/balloc.c linux-2.6.38.7/fs/ext2/balloc.c
+--- linux-2.6.38.7/fs/ext2/balloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ext2/balloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1192,7 +1192,7 @@ static int ext2_has_free_blocks(struct e
  
  	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
@@ -31112,23 +37859,9 @@ diff -urNp linux-2.6.38.2/fs/ext2/balloc.c linux-2.6.38.2/fs/ext2/balloc.c
  		sbi->s_resuid != current_fsuid() &&
  		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
  		return 0;
-diff -urNp linux-2.6.38.2/fs/ext2/xattr.c linux-2.6.38.2/fs/ext2/xattr.c
---- linux-2.6.38.2/fs/ext2/xattr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext2/xattr.c	2011-03-21 18:31:35.000000000 -0400
-@@ -86,8 +86,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static int ext2_xattr_set2(struct inode *, struct buffer_head *,
-diff -urNp linux-2.6.38.2/fs/ext3/balloc.c linux-2.6.38.2/fs/ext3/balloc.c
---- linux-2.6.38.2/fs/ext3/balloc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext3/balloc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ext3/balloc.c linux-2.6.38.7/fs/ext3/balloc.c
+--- linux-2.6.38.7/fs/ext3/balloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ext3/balloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1441,7 +1441,7 @@ static int ext3_has_free_blocks(struct e
  
  	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
@@ -31138,35 +37871,9 @@ diff -urNp linux-2.6.38.2/fs/ext3/balloc.c linux-2.6.38.2/fs/ext3/balloc.c
  		sbi->s_resuid != current_fsuid() &&
  		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
  		return 0;
-diff -urNp linux-2.6.38.2/fs/ext3/namei.c linux-2.6.38.2/fs/ext3/namei.c
---- linux-2.6.38.2/fs/ext3/namei.c	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/fs/ext3/namei.c	2011-03-23 17:21:51.000000000 -0400
-@@ -1159,7 +1159,7 @@ static struct ext3_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext3_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext3_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.38.2/fs/ext3/xattr.c linux-2.6.38.2/fs/ext3/xattr.c
---- linux-2.6.38.2/fs/ext3/xattr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext3/xattr.c	2011-03-21 18:31:35.000000000 -0400
-@@ -89,8 +89,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(f...) do {} while (0)
-+# define ea_bdebug(f...) do {} while (0)
- #endif
- 
- static void ext3_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.38.2/fs/ext4/balloc.c linux-2.6.38.2/fs/ext4/balloc.c
---- linux-2.6.38.2/fs/ext4/balloc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext4/balloc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ext4/balloc.c linux-2.6.38.7/fs/ext4/balloc.c
+--- linux-2.6.38.7/fs/ext4/balloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ext4/balloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -519,7 +519,7 @@ static int ext4_has_free_blocks(struct e
  	/* Hm, nope.  Are (enough) root reserved blocks available? */
  	if (sbi->s_resuid == current_fsuid() ||
@@ -31176,9 +37883,9 @@ diff -urNp linux-2.6.38.2/fs/ext4/balloc.c linux-2.6.38.2/fs/ext4/balloc.c
  		if (free_blocks >= (nblocks + dirty_blocks))
  			return 1;
  	}
-diff -urNp linux-2.6.38.2/fs/ext4/ext4.h linux-2.6.38.2/fs/ext4/ext4.h
---- linux-2.6.38.2/fs/ext4/ext4.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext4/ext4.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ext4/ext4.h linux-2.6.38.7/fs/ext4/ext4.h
+--- linux-2.6.38.7/fs/ext4/ext4.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ext4/ext4.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1166,19 +1166,19 @@ struct ext4_sb_info {
  	unsigned long s_mb_last_start;
  
@@ -31209,9 +37916,9 @@ diff -urNp linux-2.6.38.2/fs/ext4/ext4.h linux-2.6.38.2/fs/ext4/ext4.h
  	atomic_t s_lock_busy;
  
  	/* locality groups */
-diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
---- linux-2.6.38.2/fs/ext4/mballoc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext4/mballoc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ext4/mballoc.c linux-2.6.38.7/fs/ext4/mballoc.c
+--- linux-2.6.38.7/fs/ext4/mballoc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ext4/mballoc.c	2011-05-16 21:47:08.000000000 -0400
 @@ -1846,7 +1846,7 @@ void ext4_mb_simple_scan_group(struct ex
  		BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
  
@@ -31230,7 +37937,16 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  			goto repeat;
  		}
  	}
-@@ -2606,25 +2606,25 @@ int ext4_mb_release(struct super_block *
+@@ -2183,6 +2183,8 @@ static int ext4_mb_seq_groups_show(struc
+ 		ext4_grpblk_t counters[16];
+ 	} sg;
+ 
++	pax_track_stack();
++
+ 	group--;
+ 	if (group == 0)
+ 		seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
+@@ -2606,25 +2608,25 @@ int ext4_mb_release(struct super_block *
  	if (sbi->s_mb_stats) {
  		printk(KERN_INFO
  		       "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
@@ -31266,7 +37982,7 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  	}
  
  	free_percpu(sbi->s_locality_groups);
-@@ -3100,16 +3100,16 @@ static void ext4_mb_collect_stats(struct
+@@ -3100,16 +3102,16 @@ static void ext4_mb_collect_stats(struct
  	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
  
  	if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
@@ -31289,7 +38005,7 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  	}
  
  	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
-@@ -3507,7 +3507,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
+@@ -3507,7 +3509,7 @@ ext4_mb_new_inode_pa(struct ext4_allocat
  	trace_ext4_mb_new_inode_pa(ac, pa);
  
  	ext4_mb_use_inode_pa(ac, pa);
@@ -31298,7 +38014,7 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  
  	ei = EXT4_I(ac->ac_inode);
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
-@@ -3567,7 +3567,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
+@@ -3567,7 +3569,7 @@ ext4_mb_new_group_pa(struct ext4_allocat
  	trace_ext4_mb_new_group_pa(ac, pa);
  
  	ext4_mb_use_group_pa(ac, pa);
@@ -31307,7 +38023,7 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  
  	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
  	lg = ac->ac_lg;
-@@ -3654,7 +3654,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
+@@ -3654,7 +3656,7 @@ ext4_mb_release_inode_pa(struct ext4_bud
  		 * from the bitmap and continue.
  		 */
  	}
@@ -31316,7 +38032,7 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  
  	return err;
  }
-@@ -3672,7 +3672,7 @@ ext4_mb_release_group_pa(struct ext4_bud
+@@ -3672,7 +3674,7 @@ ext4_mb_release_group_pa(struct ext4_bud
  	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
  	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
  	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
@@ -31325,35 +38041,9 @@ diff -urNp linux-2.6.38.2/fs/ext4/mballoc.c linux-2.6.38.2/fs/ext4/mballoc.c
  	trace_ext4_mballoc_discard(sb, NULL, group, bit, pa->pa_len);
  
  	return 0;
-diff -urNp linux-2.6.38.2/fs/ext4/namei.c linux-2.6.38.2/fs/ext4/namei.c
---- linux-2.6.38.2/fs/ext4/namei.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext4/namei.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1161,7 +1161,7 @@ static struct ext4_dir_entry_2 *do_split
- 	char *data1 = (*bh)->b_data, *data2;
- 	unsigned split, move, size;
- 	struct ext4_dir_entry_2 *de = NULL, *de2;
--	int	err = 0, i;
-+	int	i, err = 0;
- 
- 	bh2 = ext4_append (handle, dir, &newblock, &err);
- 	if (!(bh2)) {
-diff -urNp linux-2.6.38.2/fs/ext4/xattr.c linux-2.6.38.2/fs/ext4/xattr.c
---- linux-2.6.38.2/fs/ext4/xattr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ext4/xattr.c	2011-03-21 18:31:35.000000000 -0400
-@@ -82,8 +82,8 @@
- 		printk("\n"); \
- 	} while (0)
- #else
--# define ea_idebug(f...)
--# define ea_bdebug(f...)
-+# define ea_idebug(inode, f...) do {} while (0)
-+# define ea_bdebug(bh, f...) do {} while (0)
- #endif
- 
- static void ext4_xattr_cache_insert(struct buffer_head *);
-diff -urNp linux-2.6.38.2/fs/fcntl.c linux-2.6.38.2/fs/fcntl.c
---- linux-2.6.38.2/fs/fcntl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fcntl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fcntl.c linux-2.6.38.7/fs/fcntl.c
+--- linux-2.6.38.7/fs/fcntl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fcntl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -224,6 +224,11 @@ int __f_setown(struct file *filp, struct
  	if (err)
  		return err;
@@ -31391,9 +38081,9 @@ diff -urNp linux-2.6.38.2/fs/fcntl.c linux-2.6.38.2/fs/fcntl.c
  		));
  
  	fasync_cache = kmem_cache_create("fasync_cache",
-diff -urNp linux-2.6.38.2/fs/fifo.c linux-2.6.38.2/fs/fifo.c
---- linux-2.6.38.2/fs/fifo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fifo.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fifo.c linux-2.6.38.7/fs/fifo.c
+--- linux-2.6.38.7/fs/fifo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fifo.c	2011-04-28 19:34:15.000000000 -0400
 @@ -58,10 +58,10 @@ static int fifo_open(struct inode *inode
  	 */
  		filp->f_op = &read_pipefifo_fops;
@@ -31464,10 +38154,10 @@ diff -urNp linux-2.6.38.2/fs/fifo.c linux-2.6.38.2/fs/fifo.c
  		free_pipe_info(inode);
  
  err_nocleanup:
-diff -urNp linux-2.6.38.2/fs/file.c linux-2.6.38.2/fs/file.c
---- linux-2.6.38.2/fs/file.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/file.c	2011-03-21 18:31:35.000000000 -0400
-@@ -14,6 +14,7 @@
+diff -urNp linux-2.6.38.7/fs/file.c linux-2.6.38.7/fs/file.c
+--- linux-2.6.38.7/fs/file.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/fs/file.c	2011-05-10 22:06:56.000000000 -0400
+@@ -15,6 +15,7 @@
  #include <linux/slab.h>
  #include <linux/vmalloc.h>
  #include <linux/file.h>
@@ -31475,7 +38165,7 @@ diff -urNp linux-2.6.38.2/fs/file.c linux-2.6.38.2/fs/file.c
  #include <linux/fdtable.h>
  #include <linux/bitops.h>
  #include <linux/interrupt.h>
-@@ -250,6 +251,7 @@ int expand_files(struct files_struct *fi
+@@ -254,6 +255,7 @@ int expand_files(struct files_struct *fi
  	 * N.B. For clone tasks sharing a files structure, this test
  	 * will limit the total number of files that can be opened.
  	 */
@@ -31483,9 +38173,1348 @@ diff -urNp linux-2.6.38.2/fs/file.c linux-2.6.38.2/fs/file.c
  	if (nr >= rlimit(RLIMIT_NOFILE))
  		return -EMFILE;
  
-diff -urNp linux-2.6.38.2/fs/fs_struct.c linux-2.6.38.2/fs/fs_struct.c
---- linux-2.6.38.2/fs/fs_struct.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fs_struct.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/filesystems.c linux-2.6.38.7/fs/filesystems.c
+--- linux-2.6.38.7/fs/filesystems.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/filesystems.c	2011-04-28 19:34:15.000000000 -0400
+@@ -275,7 +275,12 @@ struct file_system_type *get_fs_type(con
+ 	int len = dot ? dot - name : strlen(name);
+ 
+ 	fs = __get_fs_type(name, len);
++	
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
++#else
+ 	if (!fs && (request_module("%.*s", len, name) == 0))
++#endif
+ 		fs = __get_fs_type(name, len);
+ 
+ 	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
+diff -urNp linux-2.6.38.7/fs/fscache/cookie.c linux-2.6.38.7/fs/fscache/cookie.c
+--- linux-2.6.38.7/fs/fscache/cookie.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/cookie.c	2011-04-28 19:57:25.000000000 -0400
+@@ -68,11 +68,11 @@ struct fscache_cookie *__fscache_acquire
+ 	       parent ? (char *) parent->def->name : "<no-parent>",
+ 	       def->name, netfs_data);
+ 
+-	fscache_stat(&fscache_n_acquires);
++	fscache_stat_unchecked(&fscache_n_acquires);
+ 
+ 	/* if there's no parent cookie, then we don't create one here either */
+ 	if (!parent) {
+-		fscache_stat(&fscache_n_acquires_null);
++		fscache_stat_unchecked(&fscache_n_acquires_null);
+ 		_leave(" [no parent]");
+ 		return NULL;
+ 	}
+@@ -87,7 +87,7 @@ struct fscache_cookie *__fscache_acquire
+ 	/* allocate and initialise a cookie */
+ 	cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
+ 	if (!cookie) {
+-		fscache_stat(&fscache_n_acquires_oom);
++		fscache_stat_unchecked(&fscache_n_acquires_oom);
+ 		_leave(" [ENOMEM]");
+ 		return NULL;
+ 	}
+@@ -109,13 +109,13 @@ struct fscache_cookie *__fscache_acquire
+ 
+ 	switch (cookie->def->type) {
+ 	case FSCACHE_COOKIE_TYPE_INDEX:
+-		fscache_stat(&fscache_n_cookie_index);
++		fscache_stat_unchecked(&fscache_n_cookie_index);
+ 		break;
+ 	case FSCACHE_COOKIE_TYPE_DATAFILE:
+-		fscache_stat(&fscache_n_cookie_data);
++		fscache_stat_unchecked(&fscache_n_cookie_data);
+ 		break;
+ 	default:
+-		fscache_stat(&fscache_n_cookie_special);
++		fscache_stat_unchecked(&fscache_n_cookie_special);
+ 		break;
+ 	}
+ 
+@@ -126,13 +126,13 @@ struct fscache_cookie *__fscache_acquire
+ 		if (fscache_acquire_non_index_cookie(cookie) < 0) {
+ 			atomic_dec(&parent->n_children);
+ 			__fscache_cookie_put(cookie);
+-			fscache_stat(&fscache_n_acquires_nobufs);
++			fscache_stat_unchecked(&fscache_n_acquires_nobufs);
+ 			_leave(" = NULL");
+ 			return NULL;
+ 		}
+ 	}
+ 
+-	fscache_stat(&fscache_n_acquires_ok);
++	fscache_stat_unchecked(&fscache_n_acquires_ok);
+ 	_leave(" = %p", cookie);
+ 	return cookie;
+ }
+@@ -168,7 +168,7 @@ static int fscache_acquire_non_index_coo
+ 	cache = fscache_select_cache_for_object(cookie->parent);
+ 	if (!cache) {
+ 		up_read(&fscache_addremove_sem);
+-		fscache_stat(&fscache_n_acquires_no_cache);
++		fscache_stat_unchecked(&fscache_n_acquires_no_cache);
+ 		_leave(" = -ENOMEDIUM [no cache]");
+ 		return -ENOMEDIUM;
+ 	}
+@@ -256,12 +256,12 @@ static int fscache_alloc_object(struct f
+ 	object = cache->ops->alloc_object(cache, cookie);
+ 	fscache_stat_d(&fscache_n_cop_alloc_object);
+ 	if (IS_ERR(object)) {
+-		fscache_stat(&fscache_n_object_no_alloc);
++		fscache_stat_unchecked(&fscache_n_object_no_alloc);
+ 		ret = PTR_ERR(object);
+ 		goto error;
+ 	}
+ 
+-	fscache_stat(&fscache_n_object_alloc);
++	fscache_stat_unchecked(&fscache_n_object_alloc);
+ 
+ 	object->debug_id = atomic_inc_return(&fscache_object_debug_id);
+ 
+@@ -377,10 +377,10 @@ void __fscache_update_cookie(struct fsca
+ 	struct fscache_object *object;
+ 	struct hlist_node *_p;
+ 
+-	fscache_stat(&fscache_n_updates);
++	fscache_stat_unchecked(&fscache_n_updates);
+ 
+ 	if (!cookie) {
+-		fscache_stat(&fscache_n_updates_null);
++		fscache_stat_unchecked(&fscache_n_updates_null);
+ 		_leave(" [no cookie]");
+ 		return;
+ 	}
+@@ -414,12 +414,12 @@ void __fscache_relinquish_cookie(struct 
+ 	struct fscache_object *object;
+ 	unsigned long event;
+ 
+-	fscache_stat(&fscache_n_relinquishes);
++	fscache_stat_unchecked(&fscache_n_relinquishes);
+ 	if (retire)
+-		fscache_stat(&fscache_n_relinquishes_retire);
++		fscache_stat_unchecked(&fscache_n_relinquishes_retire);
+ 
+ 	if (!cookie) {
+-		fscache_stat(&fscache_n_relinquishes_null);
++		fscache_stat_unchecked(&fscache_n_relinquishes_null);
+ 		_leave(" [no cookie]");
+ 		return;
+ 	}
+@@ -435,7 +435,7 @@ void __fscache_relinquish_cookie(struct 
+ 
+ 	/* wait for the cookie to finish being instantiated (or to fail) */
+ 	if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
+-		fscache_stat(&fscache_n_relinquishes_waitcrt);
++		fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
+ 		wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
+ 			    fscache_wait_bit, TASK_UNINTERRUPTIBLE);
+ 	}
+diff -urNp linux-2.6.38.7/fs/fscache/internal.h linux-2.6.38.7/fs/fscache/internal.h
+--- linux-2.6.38.7/fs/fscache/internal.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/internal.h	2011-05-02 19:07:09.000000000 -0400
+@@ -144,94 +144,94 @@ extern void fscache_proc_cleanup(void);
+ extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
+ extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
+ 
+-extern atomic_t fscache_n_op_pend;
+-extern atomic_t fscache_n_op_run;
+-extern atomic_t fscache_n_op_enqueue;
+-extern atomic_t fscache_n_op_deferred_release;
+-extern atomic_t fscache_n_op_release;
+-extern atomic_t fscache_n_op_gc;
+-extern atomic_t fscache_n_op_cancelled;
+-extern atomic_t fscache_n_op_rejected;
+-
+-extern atomic_t fscache_n_attr_changed;
+-extern atomic_t fscache_n_attr_changed_ok;
+-extern atomic_t fscache_n_attr_changed_nobufs;
+-extern atomic_t fscache_n_attr_changed_nomem;
+-extern atomic_t fscache_n_attr_changed_calls;
+-
+-extern atomic_t fscache_n_allocs;
+-extern atomic_t fscache_n_allocs_ok;
+-extern atomic_t fscache_n_allocs_wait;
+-extern atomic_t fscache_n_allocs_nobufs;
+-extern atomic_t fscache_n_allocs_intr;
+-extern atomic_t fscache_n_allocs_object_dead;
+-extern atomic_t fscache_n_alloc_ops;
+-extern atomic_t fscache_n_alloc_op_waits;
+-
+-extern atomic_t fscache_n_retrievals;
+-extern atomic_t fscache_n_retrievals_ok;
+-extern atomic_t fscache_n_retrievals_wait;
+-extern atomic_t fscache_n_retrievals_nodata;
+-extern atomic_t fscache_n_retrievals_nobufs;
+-extern atomic_t fscache_n_retrievals_intr;
+-extern atomic_t fscache_n_retrievals_nomem;
+-extern atomic_t fscache_n_retrievals_object_dead;
+-extern atomic_t fscache_n_retrieval_ops;
+-extern atomic_t fscache_n_retrieval_op_waits;
+-
+-extern atomic_t fscache_n_stores;
+-extern atomic_t fscache_n_stores_ok;
+-extern atomic_t fscache_n_stores_again;
+-extern atomic_t fscache_n_stores_nobufs;
+-extern atomic_t fscache_n_stores_oom;
+-extern atomic_t fscache_n_store_ops;
+-extern atomic_t fscache_n_store_calls;
+-extern atomic_t fscache_n_store_pages;
+-extern atomic_t fscache_n_store_radix_deletes;
+-extern atomic_t fscache_n_store_pages_over_limit;
+-
+-extern atomic_t fscache_n_store_vmscan_not_storing;
+-extern atomic_t fscache_n_store_vmscan_gone;
+-extern atomic_t fscache_n_store_vmscan_busy;
+-extern atomic_t fscache_n_store_vmscan_cancelled;
+-
+-extern atomic_t fscache_n_marks;
+-extern atomic_t fscache_n_uncaches;
+-
+-extern atomic_t fscache_n_acquires;
+-extern atomic_t fscache_n_acquires_null;
+-extern atomic_t fscache_n_acquires_no_cache;
+-extern atomic_t fscache_n_acquires_ok;
+-extern atomic_t fscache_n_acquires_nobufs;
+-extern atomic_t fscache_n_acquires_oom;
+-
+-extern atomic_t fscache_n_updates;
+-extern atomic_t fscache_n_updates_null;
+-extern atomic_t fscache_n_updates_run;
+-
+-extern atomic_t fscache_n_relinquishes;
+-extern atomic_t fscache_n_relinquishes_null;
+-extern atomic_t fscache_n_relinquishes_waitcrt;
+-extern atomic_t fscache_n_relinquishes_retire;
+-
+-extern atomic_t fscache_n_cookie_index;
+-extern atomic_t fscache_n_cookie_data;
+-extern atomic_t fscache_n_cookie_special;
+-
+-extern atomic_t fscache_n_object_alloc;
+-extern atomic_t fscache_n_object_no_alloc;
+-extern atomic_t fscache_n_object_lookups;
+-extern atomic_t fscache_n_object_lookups_negative;
+-extern atomic_t fscache_n_object_lookups_positive;
+-extern atomic_t fscache_n_object_lookups_timed_out;
+-extern atomic_t fscache_n_object_created;
+-extern atomic_t fscache_n_object_avail;
+-extern atomic_t fscache_n_object_dead;
+-
+-extern atomic_t fscache_n_checkaux_none;
+-extern atomic_t fscache_n_checkaux_okay;
+-extern atomic_t fscache_n_checkaux_update;
+-extern atomic_t fscache_n_checkaux_obsolete;
++extern atomic_unchecked_t fscache_n_op_pend;
++extern atomic_unchecked_t fscache_n_op_run;
++extern atomic_unchecked_t fscache_n_op_enqueue;
++extern atomic_unchecked_t fscache_n_op_deferred_release;
++extern atomic_unchecked_t fscache_n_op_release;
++extern atomic_unchecked_t fscache_n_op_gc;
++extern atomic_unchecked_t fscache_n_op_cancelled;
++extern atomic_unchecked_t fscache_n_op_rejected;
++
++extern atomic_unchecked_t fscache_n_attr_changed;
++extern atomic_unchecked_t fscache_n_attr_changed_ok;
++extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
++extern atomic_unchecked_t fscache_n_attr_changed_nomem;
++extern atomic_unchecked_t fscache_n_attr_changed_calls;
++
++extern atomic_unchecked_t fscache_n_allocs;
++extern atomic_unchecked_t fscache_n_allocs_ok;
++extern atomic_unchecked_t fscache_n_allocs_wait;
++extern atomic_unchecked_t fscache_n_allocs_nobufs;
++extern atomic_unchecked_t fscache_n_allocs_intr;
++extern atomic_unchecked_t fscache_n_allocs_object_dead;
++extern atomic_unchecked_t fscache_n_alloc_ops;
++extern atomic_unchecked_t fscache_n_alloc_op_waits;
++
++extern atomic_unchecked_t fscache_n_retrievals;
++extern atomic_unchecked_t fscache_n_retrievals_ok;
++extern atomic_unchecked_t fscache_n_retrievals_wait;
++extern atomic_unchecked_t fscache_n_retrievals_nodata;
++extern atomic_unchecked_t fscache_n_retrievals_nobufs;
++extern atomic_unchecked_t fscache_n_retrievals_intr;
++extern atomic_unchecked_t fscache_n_retrievals_nomem;
++extern atomic_unchecked_t fscache_n_retrievals_object_dead;
++extern atomic_unchecked_t fscache_n_retrieval_ops;
++extern atomic_unchecked_t fscache_n_retrieval_op_waits;
++
++extern atomic_unchecked_t fscache_n_stores;
++extern atomic_unchecked_t fscache_n_stores_ok;
++extern atomic_unchecked_t fscache_n_stores_again;
++extern atomic_unchecked_t fscache_n_stores_nobufs;
++extern atomic_unchecked_t fscache_n_stores_oom;
++extern atomic_unchecked_t fscache_n_store_ops;
++extern atomic_unchecked_t fscache_n_store_calls;
++extern atomic_unchecked_t fscache_n_store_pages;
++extern atomic_unchecked_t fscache_n_store_radix_deletes;
++extern atomic_unchecked_t fscache_n_store_pages_over_limit;
++
++extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
++extern atomic_unchecked_t fscache_n_store_vmscan_gone;
++extern atomic_unchecked_t fscache_n_store_vmscan_busy;
++extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
++
++extern atomic_unchecked_t fscache_n_marks;
++extern atomic_unchecked_t fscache_n_uncaches;
++
++extern atomic_unchecked_t fscache_n_acquires;
++extern atomic_unchecked_t fscache_n_acquires_null;
++extern atomic_unchecked_t fscache_n_acquires_no_cache;
++extern atomic_unchecked_t fscache_n_acquires_ok;
++extern atomic_unchecked_t fscache_n_acquires_nobufs;
++extern atomic_unchecked_t fscache_n_acquires_oom;
++
++extern atomic_unchecked_t fscache_n_updates;
++extern atomic_unchecked_t fscache_n_updates_null;
++extern atomic_unchecked_t fscache_n_updates_run;
++
++extern atomic_unchecked_t fscache_n_relinquishes;
++extern atomic_unchecked_t fscache_n_relinquishes_null;
++extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
++extern atomic_unchecked_t fscache_n_relinquishes_retire;
++
++extern atomic_unchecked_t fscache_n_cookie_index;
++extern atomic_unchecked_t fscache_n_cookie_data;
++extern atomic_unchecked_t fscache_n_cookie_special;
++
++extern atomic_unchecked_t fscache_n_object_alloc;
++extern atomic_unchecked_t fscache_n_object_no_alloc;
++extern atomic_unchecked_t fscache_n_object_lookups;
++extern atomic_unchecked_t fscache_n_object_lookups_negative;
++extern atomic_unchecked_t fscache_n_object_lookups_positive;
++extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
++extern atomic_unchecked_t fscache_n_object_created;
++extern atomic_unchecked_t fscache_n_object_avail;
++extern atomic_unchecked_t fscache_n_object_dead;
++
++extern atomic_unchecked_t fscache_n_checkaux_none;
++extern atomic_unchecked_t fscache_n_checkaux_okay;
++extern atomic_unchecked_t fscache_n_checkaux_update;
++extern atomic_unchecked_t fscache_n_checkaux_obsolete;
+ 
+ extern atomic_t fscache_n_cop_alloc_object;
+ extern atomic_t fscache_n_cop_lookup_object;
+@@ -255,6 +255,11 @@ static inline void fscache_stat(atomic_t
+ 	atomic_inc(stat);
+ }
+ 
++static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
++{
++	atomic_inc_unchecked(stat);
++}
++
+ static inline void fscache_stat_d(atomic_t *stat)
+ {
+ 	atomic_dec(stat);
+@@ -267,6 +272,7 @@ extern const struct file_operations fsca
+ 
+ #define __fscache_stat(stat) (NULL)
+ #define fscache_stat(stat) do {} while (0)
++#define fscache_stat_unchecked(stat) do {} while (0)
+ #define fscache_stat_d(stat) do {} while (0)
+ #endif
+ 
+diff -urNp linux-2.6.38.7/fs/fscache/object.c linux-2.6.38.7/fs/fscache/object.c
+--- linux-2.6.38.7/fs/fscache/object.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/object.c	2011-04-28 19:57:25.000000000 -0400
+@@ -128,7 +128,7 @@ static void fscache_object_state_machine
+ 		/* update the object metadata on disk */
+ 	case FSCACHE_OBJECT_UPDATING:
+ 		clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
+-		fscache_stat(&fscache_n_updates_run);
++		fscache_stat_unchecked(&fscache_n_updates_run);
+ 		fscache_stat(&fscache_n_cop_update_object);
+ 		object->cache->ops->update_object(object);
+ 		fscache_stat_d(&fscache_n_cop_update_object);
+@@ -217,7 +217,7 @@ static void fscache_object_state_machine
+ 		spin_lock(&object->lock);
+ 		object->state = FSCACHE_OBJECT_DEAD;
+ 		spin_unlock(&object->lock);
+-		fscache_stat(&fscache_n_object_dead);
++		fscache_stat_unchecked(&fscache_n_object_dead);
+ 		goto terminal_transit;
+ 
+ 		/* handle the parent cache of this object being withdrawn from
+@@ -232,7 +232,7 @@ static void fscache_object_state_machine
+ 		spin_lock(&object->lock);
+ 		object->state = FSCACHE_OBJECT_DEAD;
+ 		spin_unlock(&object->lock);
+-		fscache_stat(&fscache_n_object_dead);
++		fscache_stat_unchecked(&fscache_n_object_dead);
+ 		goto terminal_transit;
+ 
+ 		/* complain about the object being woken up once it is
+@@ -461,7 +461,7 @@ static void fscache_lookup_object(struct
+ 	       parent->cookie->def->name, cookie->def->name,
+ 	       object->cache->tag->name);
+ 
+-	fscache_stat(&fscache_n_object_lookups);
++	fscache_stat_unchecked(&fscache_n_object_lookups);
+ 	fscache_stat(&fscache_n_cop_lookup_object);
+ 	ret = object->cache->ops->lookup_object(object);
+ 	fscache_stat_d(&fscache_n_cop_lookup_object);
+@@ -472,7 +472,7 @@ static void fscache_lookup_object(struct
+ 	if (ret == -ETIMEDOUT) {
+ 		/* probably stuck behind another object, so move this one to
+ 		 * the back of the queue */
+-		fscache_stat(&fscache_n_object_lookups_timed_out);
++		fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
+ 		set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+ 	}
+ 
+@@ -495,7 +495,7 @@ void fscache_object_lookup_negative(stru
+ 
+ 	spin_lock(&object->lock);
+ 	if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
+-		fscache_stat(&fscache_n_object_lookups_negative);
++		fscache_stat_unchecked(&fscache_n_object_lookups_negative);
+ 
+ 		/* transit here to allow write requests to begin stacking up
+ 		 * and read requests to begin returning ENODATA */
+@@ -541,7 +541,7 @@ void fscache_obtained_object(struct fsca
+ 	 * result, in which case there may be data available */
+ 	spin_lock(&object->lock);
+ 	if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
+-		fscache_stat(&fscache_n_object_lookups_positive);
++		fscache_stat_unchecked(&fscache_n_object_lookups_positive);
+ 
+ 		clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
+ 
+@@ -555,7 +555,7 @@ void fscache_obtained_object(struct fsca
+ 		set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
+ 	} else {
+ 		ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
+-		fscache_stat(&fscache_n_object_created);
++		fscache_stat_unchecked(&fscache_n_object_created);
+ 
+ 		object->state = FSCACHE_OBJECT_AVAILABLE;
+ 		spin_unlock(&object->lock);
+@@ -602,7 +602,7 @@ static void fscache_object_available(str
+ 	fscache_enqueue_dependents(object);
+ 
+ 	fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
+-	fscache_stat(&fscache_n_object_avail);
++	fscache_stat_unchecked(&fscache_n_object_avail);
+ 
+ 	_leave("");
+ }
+@@ -861,7 +861,7 @@ enum fscache_checkaux fscache_check_aux(
+ 	enum fscache_checkaux result;
+ 
+ 	if (!object->cookie->def->check_aux) {
+-		fscache_stat(&fscache_n_checkaux_none);
++		fscache_stat_unchecked(&fscache_n_checkaux_none);
+ 		return FSCACHE_CHECKAUX_OKAY;
+ 	}
+ 
+@@ -870,17 +870,17 @@ enum fscache_checkaux fscache_check_aux(
+ 	switch (result) {
+ 		/* entry okay as is */
+ 	case FSCACHE_CHECKAUX_OKAY:
+-		fscache_stat(&fscache_n_checkaux_okay);
++		fscache_stat_unchecked(&fscache_n_checkaux_okay);
+ 		break;
+ 
+ 		/* entry requires update */
+ 	case FSCACHE_CHECKAUX_NEEDS_UPDATE:
+-		fscache_stat(&fscache_n_checkaux_update);
++		fscache_stat_unchecked(&fscache_n_checkaux_update);
+ 		break;
+ 
+ 		/* entry requires deletion */
+ 	case FSCACHE_CHECKAUX_OBSOLETE:
+-		fscache_stat(&fscache_n_checkaux_obsolete);
++		fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
+ 		break;
+ 
+ 	default:
+diff -urNp linux-2.6.38.7/fs/fscache/operation.c linux-2.6.38.7/fs/fscache/operation.c
+--- linux-2.6.38.7/fs/fscache/operation.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/operation.c	2011-04-28 19:57:25.000000000 -0400
+@@ -17,7 +17,7 @@
+ #include <linux/slab.h>
+ #include "internal.h"
+ 
+-atomic_t fscache_op_debug_id;
++atomic_unchecked_t fscache_op_debug_id;
+ EXPORT_SYMBOL(fscache_op_debug_id);
+ 
+ /**
+@@ -40,7 +40,7 @@ void fscache_enqueue_operation(struct fs
+ 	ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
+ 	ASSERTCMP(atomic_read(&op->usage), >, 0);
+ 
+-	fscache_stat(&fscache_n_op_enqueue);
++	fscache_stat_unchecked(&fscache_n_op_enqueue);
+ 	switch (op->flags & FSCACHE_OP_TYPE) {
+ 	case FSCACHE_OP_ASYNC:
+ 		_debug("queue async");
+@@ -73,7 +73,7 @@ static void fscache_run_op(struct fscach
+ 		wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
+ 	if (op->processor)
+ 		fscache_enqueue_operation(op);
+-	fscache_stat(&fscache_n_op_run);
++	fscache_stat_unchecked(&fscache_n_op_run);
+ }
+ 
+ /*
+@@ -104,11 +104,11 @@ int fscache_submit_exclusive_op(struct f
+ 		if (object->n_ops > 1) {
+ 			atomic_inc(&op->usage);
+ 			list_add_tail(&op->pend_link, &object->pending_ops);
+-			fscache_stat(&fscache_n_op_pend);
++			fscache_stat_unchecked(&fscache_n_op_pend);
+ 		} else if (!list_empty(&object->pending_ops)) {
+ 			atomic_inc(&op->usage);
+ 			list_add_tail(&op->pend_link, &object->pending_ops);
+-			fscache_stat(&fscache_n_op_pend);
++			fscache_stat_unchecked(&fscache_n_op_pend);
+ 			fscache_start_operations(object);
+ 		} else {
+ 			ASSERTCMP(object->n_in_progress, ==, 0);
+@@ -124,7 +124,7 @@ int fscache_submit_exclusive_op(struct f
+ 		object->n_exclusive++;	/* reads and writes must wait */
+ 		atomic_inc(&op->usage);
+ 		list_add_tail(&op->pend_link, &object->pending_ops);
+-		fscache_stat(&fscache_n_op_pend);
++		fscache_stat_unchecked(&fscache_n_op_pend);
+ 		ret = 0;
+ 	} else {
+ 		/* not allowed to submit ops in any other state */
+@@ -211,11 +211,11 @@ int fscache_submit_op(struct fscache_obj
+ 		if (object->n_exclusive > 0) {
+ 			atomic_inc(&op->usage);
+ 			list_add_tail(&op->pend_link, &object->pending_ops);
+-			fscache_stat(&fscache_n_op_pend);
++			fscache_stat_unchecked(&fscache_n_op_pend);
+ 		} else if (!list_empty(&object->pending_ops)) {
+ 			atomic_inc(&op->usage);
+ 			list_add_tail(&op->pend_link, &object->pending_ops);
+-			fscache_stat(&fscache_n_op_pend);
++			fscache_stat_unchecked(&fscache_n_op_pend);
+ 			fscache_start_operations(object);
+ 		} else {
+ 			ASSERTCMP(object->n_exclusive, ==, 0);
+@@ -227,12 +227,12 @@ int fscache_submit_op(struct fscache_obj
+ 		object->n_ops++;
+ 		atomic_inc(&op->usage);
+ 		list_add_tail(&op->pend_link, &object->pending_ops);
+-		fscache_stat(&fscache_n_op_pend);
++		fscache_stat_unchecked(&fscache_n_op_pend);
+ 		ret = 0;
+ 	} else if (object->state == FSCACHE_OBJECT_DYING ||
+ 		   object->state == FSCACHE_OBJECT_LC_DYING ||
+ 		   object->state == FSCACHE_OBJECT_WITHDRAWING) {
+-		fscache_stat(&fscache_n_op_rejected);
++		fscache_stat_unchecked(&fscache_n_op_rejected);
+ 		ret = -ENOBUFS;
+ 	} else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
+ 		fscache_report_unexpected_submission(object, op, ostate);
+@@ -302,7 +302,7 @@ int fscache_cancel_op(struct fscache_ope
+ 
+ 	ret = -EBUSY;
+ 	if (!list_empty(&op->pend_link)) {
+-		fscache_stat(&fscache_n_op_cancelled);
++		fscache_stat_unchecked(&fscache_n_op_cancelled);
+ 		list_del_init(&op->pend_link);
+ 		object->n_ops--;
+ 		if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
+@@ -341,7 +341,7 @@ void fscache_put_operation(struct fscach
+ 	if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
+ 		BUG();
+ 
+-	fscache_stat(&fscache_n_op_release);
++	fscache_stat_unchecked(&fscache_n_op_release);
+ 
+ 	if (op->release) {
+ 		op->release(op);
+@@ -358,7 +358,7 @@ void fscache_put_operation(struct fscach
+ 	 * lock, and defer it otherwise */
+ 	if (!spin_trylock(&object->lock)) {
+ 		_debug("defer put");
+-		fscache_stat(&fscache_n_op_deferred_release);
++		fscache_stat_unchecked(&fscache_n_op_deferred_release);
+ 
+ 		cache = object->cache;
+ 		spin_lock(&cache->op_gc_list_lock);
+@@ -420,7 +420,7 @@ void fscache_operation_gc(struct work_st
+ 
+ 		_debug("GC DEFERRED REL OBJ%x OP%x",
+ 		       object->debug_id, op->debug_id);
+-		fscache_stat(&fscache_n_op_gc);
++		fscache_stat_unchecked(&fscache_n_op_gc);
+ 
+ 		ASSERTCMP(atomic_read(&op->usage), ==, 0);
+ 
+diff -urNp linux-2.6.38.7/fs/fscache/page.c linux-2.6.38.7/fs/fscache/page.c
+--- linux-2.6.38.7/fs/fscache/page.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/page.c	2011-04-28 19:57:25.000000000 -0400
+@@ -60,7 +60,7 @@ bool __fscache_maybe_release_page(struct
+ 	val = radix_tree_lookup(&cookie->stores, page->index);
+ 	if (!val) {
+ 		rcu_read_unlock();
+-		fscache_stat(&fscache_n_store_vmscan_not_storing);
++		fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
+ 		__fscache_uncache_page(cookie, page);
+ 		return true;
+ 	}
+@@ -90,11 +90,11 @@ bool __fscache_maybe_release_page(struct
+ 	spin_unlock(&cookie->stores_lock);
+ 
+ 	if (xpage) {
+-		fscache_stat(&fscache_n_store_vmscan_cancelled);
+-		fscache_stat(&fscache_n_store_radix_deletes);
++		fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
++		fscache_stat_unchecked(&fscache_n_store_radix_deletes);
+ 		ASSERTCMP(xpage, ==, page);
+ 	} else {
+-		fscache_stat(&fscache_n_store_vmscan_gone);
++		fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
+ 	}
+ 
+ 	wake_up_bit(&cookie->flags, 0);
+@@ -107,7 +107,7 @@ page_busy:
+ 	/* we might want to wait here, but that could deadlock the allocator as
+ 	 * the work threads writing to the cache may all end up sleeping
+ 	 * on memory allocation */
+-	fscache_stat(&fscache_n_store_vmscan_busy);
++	fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
+ 	return false;
+ }
+ EXPORT_SYMBOL(__fscache_maybe_release_page);
+@@ -131,7 +131,7 @@ static void fscache_end_page_write(struc
+ 				     FSCACHE_COOKIE_STORING_TAG);
+ 		if (!radix_tree_tag_get(&cookie->stores, page->index,
+ 					FSCACHE_COOKIE_PENDING_TAG)) {
+-			fscache_stat(&fscache_n_store_radix_deletes);
++			fscache_stat_unchecked(&fscache_n_store_radix_deletes);
+ 			xpage = radix_tree_delete(&cookie->stores, page->index);
+ 		}
+ 		spin_unlock(&cookie->stores_lock);
+@@ -152,7 +152,7 @@ static void fscache_attr_changed_op(stru
+ 
+ 	_enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
+ 
+-	fscache_stat(&fscache_n_attr_changed_calls);
++	fscache_stat_unchecked(&fscache_n_attr_changed_calls);
+ 
+ 	if (fscache_object_is_active(object)) {
+ 		fscache_set_op_state(op, "CallFS");
+@@ -179,11 +179,11 @@ int __fscache_attr_changed(struct fscach
+ 
+ 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+ 
+-	fscache_stat(&fscache_n_attr_changed);
++	fscache_stat_unchecked(&fscache_n_attr_changed);
+ 
+ 	op = kzalloc(sizeof(*op), GFP_KERNEL);
+ 	if (!op) {
+-		fscache_stat(&fscache_n_attr_changed_nomem);
++		fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
+ 		_leave(" = -ENOMEM");
+ 		return -ENOMEM;
+ 	}
+@@ -202,7 +202,7 @@ int __fscache_attr_changed(struct fscach
+ 	if (fscache_submit_exclusive_op(object, op) < 0)
+ 		goto nobufs;
+ 	spin_unlock(&cookie->lock);
+-	fscache_stat(&fscache_n_attr_changed_ok);
++	fscache_stat_unchecked(&fscache_n_attr_changed_ok);
+ 	fscache_put_operation(op);
+ 	_leave(" = 0");
+ 	return 0;
+@@ -210,7 +210,7 @@ int __fscache_attr_changed(struct fscach
+ nobufs:
+ 	spin_unlock(&cookie->lock);
+ 	kfree(op);
+-	fscache_stat(&fscache_n_attr_changed_nobufs);
++	fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
+ 	_leave(" = %d", -ENOBUFS);
+ 	return -ENOBUFS;
+ }
+@@ -246,7 +246,7 @@ static struct fscache_retrieval *fscache
+ 	/* allocate a retrieval operation and attempt to submit it */
+ 	op = kzalloc(sizeof(*op), GFP_NOIO);
+ 	if (!op) {
+-		fscache_stat(&fscache_n_retrievals_nomem);
++		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ 		return NULL;
+ 	}
+ 
+@@ -275,13 +275,13 @@ static int fscache_wait_for_deferred_loo
+ 		return 0;
+ 	}
+ 
+-	fscache_stat(&fscache_n_retrievals_wait);
++	fscache_stat_unchecked(&fscache_n_retrievals_wait);
+ 
+ 	jif = jiffies;
+ 	if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
+ 			fscache_wait_bit_interruptible,
+ 			TASK_INTERRUPTIBLE) != 0) {
+-		fscache_stat(&fscache_n_retrievals_intr);
++		fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ 		_leave(" = -ERESTARTSYS");
+ 		return -ERESTARTSYS;
+ 	}
+@@ -299,8 +299,8 @@ static int fscache_wait_for_deferred_loo
+  */
+ static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
+ 						 struct fscache_retrieval *op,
+-						 atomic_t *stat_op_waits,
+-						 atomic_t *stat_object_dead)
++						 atomic_unchecked_t *stat_op_waits,
++						 atomic_unchecked_t *stat_object_dead)
+ {
+ 	int ret;
+ 
+@@ -308,7 +308,7 @@ static int fscache_wait_for_retrieval_ac
+ 		goto check_if_dead;
+ 
+ 	_debug(">>> WT");
+-	fscache_stat(stat_op_waits);
++	fscache_stat_unchecked(stat_op_waits);
+ 	if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
+ 			fscache_wait_bit_interruptible,
+ 			TASK_INTERRUPTIBLE) < 0) {
+@@ -325,7 +325,7 @@ static int fscache_wait_for_retrieval_ac
+ 
+ check_if_dead:
+ 	if (unlikely(fscache_object_is_dead(object))) {
+-		fscache_stat(stat_object_dead);
++		fscache_stat_unchecked(stat_object_dead);
+ 		return -ENOBUFS;
+ 	}
+ 	return 0;
+@@ -352,7 +352,7 @@ int __fscache_read_or_alloc_page(struct 
+ 
+ 	_enter("%p,%p,,,", cookie, page);
+ 
+-	fscache_stat(&fscache_n_retrievals);
++	fscache_stat_unchecked(&fscache_n_retrievals);
+ 
+ 	if (hlist_empty(&cookie->backing_objects))
+ 		goto nobufs;
+@@ -386,7 +386,7 @@ int __fscache_read_or_alloc_page(struct 
+ 		goto nobufs_unlock;
+ 	spin_unlock(&cookie->lock);
+ 
+-	fscache_stat(&fscache_n_retrieval_ops);
++	fscache_stat_unchecked(&fscache_n_retrieval_ops);
+ 
+ 	/* pin the netfs read context in case we need to do the actual netfs
+ 	 * read because we've encountered a cache read failure */
+@@ -416,15 +416,15 @@ int __fscache_read_or_alloc_page(struct 
+ 
+ error:
+ 	if (ret == -ENOMEM)
+-		fscache_stat(&fscache_n_retrievals_nomem);
++		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ 	else if (ret == -ERESTARTSYS)
+-		fscache_stat(&fscache_n_retrievals_intr);
++		fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ 	else if (ret == -ENODATA)
+-		fscache_stat(&fscache_n_retrievals_nodata);
++		fscache_stat_unchecked(&fscache_n_retrievals_nodata);
+ 	else if (ret < 0)
+-		fscache_stat(&fscache_n_retrievals_nobufs);
++		fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ 	else
+-		fscache_stat(&fscache_n_retrievals_ok);
++		fscache_stat_unchecked(&fscache_n_retrievals_ok);
+ 
+ 	fscache_put_retrieval(op);
+ 	_leave(" = %d", ret);
+@@ -434,7 +434,7 @@ nobufs_unlock:
+ 	spin_unlock(&cookie->lock);
+ 	kfree(op);
+ nobufs:
+-	fscache_stat(&fscache_n_retrievals_nobufs);
++	fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ 	_leave(" = -ENOBUFS");
+ 	return -ENOBUFS;
+ }
+@@ -472,7 +472,7 @@ int __fscache_read_or_alloc_pages(struct
+ 
+ 	_enter("%p,,%d,,,", cookie, *nr_pages);
+ 
+-	fscache_stat(&fscache_n_retrievals);
++	fscache_stat_unchecked(&fscache_n_retrievals);
+ 
+ 	if (hlist_empty(&cookie->backing_objects))
+ 		goto nobufs;
+@@ -503,7 +503,7 @@ int __fscache_read_or_alloc_pages(struct
+ 		goto nobufs_unlock;
+ 	spin_unlock(&cookie->lock);
+ 
+-	fscache_stat(&fscache_n_retrieval_ops);
++	fscache_stat_unchecked(&fscache_n_retrieval_ops);
+ 
+ 	/* pin the netfs read context in case we need to do the actual netfs
+ 	 * read because we've encountered a cache read failure */
+@@ -533,15 +533,15 @@ int __fscache_read_or_alloc_pages(struct
+ 
+ error:
+ 	if (ret == -ENOMEM)
+-		fscache_stat(&fscache_n_retrievals_nomem);
++		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
+ 	else if (ret == -ERESTARTSYS)
+-		fscache_stat(&fscache_n_retrievals_intr);
++		fscache_stat_unchecked(&fscache_n_retrievals_intr);
+ 	else if (ret == -ENODATA)
+-		fscache_stat(&fscache_n_retrievals_nodata);
++		fscache_stat_unchecked(&fscache_n_retrievals_nodata);
+ 	else if (ret < 0)
+-		fscache_stat(&fscache_n_retrievals_nobufs);
++		fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ 	else
+-		fscache_stat(&fscache_n_retrievals_ok);
++		fscache_stat_unchecked(&fscache_n_retrievals_ok);
+ 
+ 	fscache_put_retrieval(op);
+ 	_leave(" = %d", ret);
+@@ -551,7 +551,7 @@ nobufs_unlock:
+ 	spin_unlock(&cookie->lock);
+ 	kfree(op);
+ nobufs:
+-	fscache_stat(&fscache_n_retrievals_nobufs);
++	fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
+ 	_leave(" = -ENOBUFS");
+ 	return -ENOBUFS;
+ }
+@@ -575,7 +575,7 @@ int __fscache_alloc_page(struct fscache_
+ 
+ 	_enter("%p,%p,,,", cookie, page);
+ 
+-	fscache_stat(&fscache_n_allocs);
++	fscache_stat_unchecked(&fscache_n_allocs);
+ 
+ 	if (hlist_empty(&cookie->backing_objects))
+ 		goto nobufs;
+@@ -602,7 +602,7 @@ int __fscache_alloc_page(struct fscache_
+ 		goto nobufs_unlock;
+ 	spin_unlock(&cookie->lock);
+ 
+-	fscache_stat(&fscache_n_alloc_ops);
++	fscache_stat_unchecked(&fscache_n_alloc_ops);
+ 
+ 	ret = fscache_wait_for_retrieval_activation(
+ 		object, op,
+@@ -618,11 +618,11 @@ int __fscache_alloc_page(struct fscache_
+ 
+ error:
+ 	if (ret == -ERESTARTSYS)
+-		fscache_stat(&fscache_n_allocs_intr);
++		fscache_stat_unchecked(&fscache_n_allocs_intr);
+ 	else if (ret < 0)
+-		fscache_stat(&fscache_n_allocs_nobufs);
++		fscache_stat_unchecked(&fscache_n_allocs_nobufs);
+ 	else
+-		fscache_stat(&fscache_n_allocs_ok);
++		fscache_stat_unchecked(&fscache_n_allocs_ok);
+ 
+ 	fscache_put_retrieval(op);
+ 	_leave(" = %d", ret);
+@@ -632,7 +632,7 @@ nobufs_unlock:
+ 	spin_unlock(&cookie->lock);
+ 	kfree(op);
+ nobufs:
+-	fscache_stat(&fscache_n_allocs_nobufs);
++	fscache_stat_unchecked(&fscache_n_allocs_nobufs);
+ 	_leave(" = -ENOBUFS");
+ 	return -ENOBUFS;
+ }
+@@ -675,7 +675,7 @@ static void fscache_write_op(struct fsca
+ 
+ 	spin_lock(&cookie->stores_lock);
+ 
+-	fscache_stat(&fscache_n_store_calls);
++	fscache_stat_unchecked(&fscache_n_store_calls);
+ 
+ 	/* find a page to store */
+ 	page = NULL;
+@@ -686,7 +686,7 @@ static void fscache_write_op(struct fsca
+ 	page = results[0];
+ 	_debug("gang %d [%lx]", n, page->index);
+ 	if (page->index > op->store_limit) {
+-		fscache_stat(&fscache_n_store_pages_over_limit);
++		fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
+ 		goto superseded;
+ 	}
+ 
+@@ -699,7 +699,7 @@ static void fscache_write_op(struct fsca
+ 	spin_unlock(&object->lock);
+ 
+ 	fscache_set_op_state(&op->op, "Store");
+-	fscache_stat(&fscache_n_store_pages);
++	fscache_stat_unchecked(&fscache_n_store_pages);
+ 	fscache_stat(&fscache_n_cop_write_page);
+ 	ret = object->cache->ops->write_page(op, page);
+ 	fscache_stat_d(&fscache_n_cop_write_page);
+@@ -769,7 +769,7 @@ int __fscache_write_page(struct fscache_
+ 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+ 	ASSERT(PageFsCache(page));
+ 
+-	fscache_stat(&fscache_n_stores);
++	fscache_stat_unchecked(&fscache_n_stores);
+ 
+ 	op = kzalloc(sizeof(*op), GFP_NOIO);
+ 	if (!op)
+@@ -821,7 +821,7 @@ int __fscache_write_page(struct fscache_
+ 	spin_unlock(&cookie->stores_lock);
+ 	spin_unlock(&object->lock);
+ 
+-	op->op.debug_id	= atomic_inc_return(&fscache_op_debug_id);
++	op->op.debug_id	= atomic_inc_return_unchecked(&fscache_op_debug_id);
+ 	op->store_limit = object->store_limit;
+ 
+ 	if (fscache_submit_op(object, &op->op) < 0)
+@@ -829,8 +829,8 @@ int __fscache_write_page(struct fscache_
+ 
+ 	spin_unlock(&cookie->lock);
+ 	radix_tree_preload_end();
+-	fscache_stat(&fscache_n_store_ops);
+-	fscache_stat(&fscache_n_stores_ok);
++	fscache_stat_unchecked(&fscache_n_store_ops);
++	fscache_stat_unchecked(&fscache_n_stores_ok);
+ 
+ 	/* the work queue now carries its own ref on the object */
+ 	fscache_put_operation(&op->op);
+@@ -838,14 +838,14 @@ int __fscache_write_page(struct fscache_
+ 	return 0;
+ 
+ already_queued:
+-	fscache_stat(&fscache_n_stores_again);
++	fscache_stat_unchecked(&fscache_n_stores_again);
+ already_pending:
+ 	spin_unlock(&cookie->stores_lock);
+ 	spin_unlock(&object->lock);
+ 	spin_unlock(&cookie->lock);
+ 	radix_tree_preload_end();
+ 	kfree(op);
+-	fscache_stat(&fscache_n_stores_ok);
++	fscache_stat_unchecked(&fscache_n_stores_ok);
+ 	_leave(" = 0");
+ 	return 0;
+ 
+@@ -864,14 +864,14 @@ nobufs:
+ 	spin_unlock(&cookie->lock);
+ 	radix_tree_preload_end();
+ 	kfree(op);
+-	fscache_stat(&fscache_n_stores_nobufs);
++	fscache_stat_unchecked(&fscache_n_stores_nobufs);
+ 	_leave(" = -ENOBUFS");
+ 	return -ENOBUFS;
+ 
+ nomem_free:
+ 	kfree(op);
+ nomem:
+-	fscache_stat(&fscache_n_stores_oom);
++	fscache_stat_unchecked(&fscache_n_stores_oom);
+ 	_leave(" = -ENOMEM");
+ 	return -ENOMEM;
+ }
+@@ -889,7 +889,7 @@ void __fscache_uncache_page(struct fscac
+ 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
+ 	ASSERTCMP(page, !=, NULL);
+ 
+-	fscache_stat(&fscache_n_uncaches);
++	fscache_stat_unchecked(&fscache_n_uncaches);
+ 
+ 	/* cache withdrawal may beat us to it */
+ 	if (!PageFsCache(page))
+@@ -942,7 +942,7 @@ void fscache_mark_pages_cached(struct fs
+ 	unsigned long loop;
+ 
+ #ifdef CONFIG_FSCACHE_STATS
+-	atomic_add(pagevec->nr, &fscache_n_marks);
++	atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
+ #endif
+ 
+ 	for (loop = 0; loop < pagevec->nr; loop++) {
+diff -urNp linux-2.6.38.7/fs/fscache/stats.c linux-2.6.38.7/fs/fscache/stats.c
+--- linux-2.6.38.7/fs/fscache/stats.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fscache/stats.c	2011-04-28 19:57:25.000000000 -0400
+@@ -18,95 +18,95 @@
+ /*
+  * operation counters
+  */
+-atomic_t fscache_n_op_pend;
+-atomic_t fscache_n_op_run;
+-atomic_t fscache_n_op_enqueue;
+-atomic_t fscache_n_op_requeue;
+-atomic_t fscache_n_op_deferred_release;
+-atomic_t fscache_n_op_release;
+-atomic_t fscache_n_op_gc;
+-atomic_t fscache_n_op_cancelled;
+-atomic_t fscache_n_op_rejected;
+-
+-atomic_t fscache_n_attr_changed;
+-atomic_t fscache_n_attr_changed_ok;
+-atomic_t fscache_n_attr_changed_nobufs;
+-atomic_t fscache_n_attr_changed_nomem;
+-atomic_t fscache_n_attr_changed_calls;
+-
+-atomic_t fscache_n_allocs;
+-atomic_t fscache_n_allocs_ok;
+-atomic_t fscache_n_allocs_wait;
+-atomic_t fscache_n_allocs_nobufs;
+-atomic_t fscache_n_allocs_intr;
+-atomic_t fscache_n_allocs_object_dead;
+-atomic_t fscache_n_alloc_ops;
+-atomic_t fscache_n_alloc_op_waits;
+-
+-atomic_t fscache_n_retrievals;
+-atomic_t fscache_n_retrievals_ok;
+-atomic_t fscache_n_retrievals_wait;
+-atomic_t fscache_n_retrievals_nodata;
+-atomic_t fscache_n_retrievals_nobufs;
+-atomic_t fscache_n_retrievals_intr;
+-atomic_t fscache_n_retrievals_nomem;
+-atomic_t fscache_n_retrievals_object_dead;
+-atomic_t fscache_n_retrieval_ops;
+-atomic_t fscache_n_retrieval_op_waits;
+-
+-atomic_t fscache_n_stores;
+-atomic_t fscache_n_stores_ok;
+-atomic_t fscache_n_stores_again;
+-atomic_t fscache_n_stores_nobufs;
+-atomic_t fscache_n_stores_oom;
+-atomic_t fscache_n_store_ops;
+-atomic_t fscache_n_store_calls;
+-atomic_t fscache_n_store_pages;
+-atomic_t fscache_n_store_radix_deletes;
+-atomic_t fscache_n_store_pages_over_limit;
+-
+-atomic_t fscache_n_store_vmscan_not_storing;
+-atomic_t fscache_n_store_vmscan_gone;
+-atomic_t fscache_n_store_vmscan_busy;
+-atomic_t fscache_n_store_vmscan_cancelled;
+-
+-atomic_t fscache_n_marks;
+-atomic_t fscache_n_uncaches;
+-
+-atomic_t fscache_n_acquires;
+-atomic_t fscache_n_acquires_null;
+-atomic_t fscache_n_acquires_no_cache;
+-atomic_t fscache_n_acquires_ok;
+-atomic_t fscache_n_acquires_nobufs;
+-atomic_t fscache_n_acquires_oom;
+-
+-atomic_t fscache_n_updates;
+-atomic_t fscache_n_updates_null;
+-atomic_t fscache_n_updates_run;
+-
+-atomic_t fscache_n_relinquishes;
+-atomic_t fscache_n_relinquishes_null;
+-atomic_t fscache_n_relinquishes_waitcrt;
+-atomic_t fscache_n_relinquishes_retire;
+-
+-atomic_t fscache_n_cookie_index;
+-atomic_t fscache_n_cookie_data;
+-atomic_t fscache_n_cookie_special;
+-
+-atomic_t fscache_n_object_alloc;
+-atomic_t fscache_n_object_no_alloc;
+-atomic_t fscache_n_object_lookups;
+-atomic_t fscache_n_object_lookups_negative;
+-atomic_t fscache_n_object_lookups_positive;
+-atomic_t fscache_n_object_lookups_timed_out;
+-atomic_t fscache_n_object_created;
+-atomic_t fscache_n_object_avail;
+-atomic_t fscache_n_object_dead;
+-
+-atomic_t fscache_n_checkaux_none;
+-atomic_t fscache_n_checkaux_okay;
+-atomic_t fscache_n_checkaux_update;
+-atomic_t fscache_n_checkaux_obsolete;
++atomic_unchecked_t fscache_n_op_pend;
++atomic_unchecked_t fscache_n_op_run;
++atomic_unchecked_t fscache_n_op_enqueue;
++atomic_unchecked_t fscache_n_op_requeue;
++atomic_unchecked_t fscache_n_op_deferred_release;
++atomic_unchecked_t fscache_n_op_release;
++atomic_unchecked_t fscache_n_op_gc;
++atomic_unchecked_t fscache_n_op_cancelled;
++atomic_unchecked_t fscache_n_op_rejected;
++
++atomic_unchecked_t fscache_n_attr_changed;
++atomic_unchecked_t fscache_n_attr_changed_ok;
++atomic_unchecked_t fscache_n_attr_changed_nobufs;
++atomic_unchecked_t fscache_n_attr_changed_nomem;
++atomic_unchecked_t fscache_n_attr_changed_calls;
++
++atomic_unchecked_t fscache_n_allocs;
++atomic_unchecked_t fscache_n_allocs_ok;
++atomic_unchecked_t fscache_n_allocs_wait;
++atomic_unchecked_t fscache_n_allocs_nobufs;
++atomic_unchecked_t fscache_n_allocs_intr;
++atomic_unchecked_t fscache_n_allocs_object_dead;
++atomic_unchecked_t fscache_n_alloc_ops;
++atomic_unchecked_t fscache_n_alloc_op_waits;
++
++atomic_unchecked_t fscache_n_retrievals;
++atomic_unchecked_t fscache_n_retrievals_ok;
++atomic_unchecked_t fscache_n_retrievals_wait;
++atomic_unchecked_t fscache_n_retrievals_nodata;
++atomic_unchecked_t fscache_n_retrievals_nobufs;
++atomic_unchecked_t fscache_n_retrievals_intr;
++atomic_unchecked_t fscache_n_retrievals_nomem;
++atomic_unchecked_t fscache_n_retrievals_object_dead;
++atomic_unchecked_t fscache_n_retrieval_ops;
++atomic_unchecked_t fscache_n_retrieval_op_waits;
++
++atomic_unchecked_t fscache_n_stores;
++atomic_unchecked_t fscache_n_stores_ok;
++atomic_unchecked_t fscache_n_stores_again;
++atomic_unchecked_t fscache_n_stores_nobufs;
++atomic_unchecked_t fscache_n_stores_oom;
++atomic_unchecked_t fscache_n_store_ops;
++atomic_unchecked_t fscache_n_store_calls;
++atomic_unchecked_t fscache_n_store_pages;
++atomic_unchecked_t fscache_n_store_radix_deletes;
++atomic_unchecked_t fscache_n_store_pages_over_limit;
++
++atomic_unchecked_t fscache_n_store_vmscan_not_storing;
++atomic_unchecked_t fscache_n_store_vmscan_gone;
++atomic_unchecked_t fscache_n_store_vmscan_busy;
++atomic_unchecked_t fscache_n_store_vmscan_cancelled;
++
++atomic_unchecked_t fscache_n_marks;
++atomic_unchecked_t fscache_n_uncaches;
++
++atomic_unchecked_t fscache_n_acquires;
++atomic_unchecked_t fscache_n_acquires_null;
++atomic_unchecked_t fscache_n_acquires_no_cache;
++atomic_unchecked_t fscache_n_acquires_ok;
++atomic_unchecked_t fscache_n_acquires_nobufs;
++atomic_unchecked_t fscache_n_acquires_oom;
++
++atomic_unchecked_t fscache_n_updates;
++atomic_unchecked_t fscache_n_updates_null;
++atomic_unchecked_t fscache_n_updates_run;
++
++atomic_unchecked_t fscache_n_relinquishes;
++atomic_unchecked_t fscache_n_relinquishes_null;
++atomic_unchecked_t fscache_n_relinquishes_waitcrt;
++atomic_unchecked_t fscache_n_relinquishes_retire;
++
++atomic_unchecked_t fscache_n_cookie_index;
++atomic_unchecked_t fscache_n_cookie_data;
++atomic_unchecked_t fscache_n_cookie_special;
++
++atomic_unchecked_t fscache_n_object_alloc;
++atomic_unchecked_t fscache_n_object_no_alloc;
++atomic_unchecked_t fscache_n_object_lookups;
++atomic_unchecked_t fscache_n_object_lookups_negative;
++atomic_unchecked_t fscache_n_object_lookups_positive;
++atomic_unchecked_t fscache_n_object_lookups_timed_out;
++atomic_unchecked_t fscache_n_object_created;
++atomic_unchecked_t fscache_n_object_avail;
++atomic_unchecked_t fscache_n_object_dead;
++
++atomic_unchecked_t fscache_n_checkaux_none;
++atomic_unchecked_t fscache_n_checkaux_okay;
++atomic_unchecked_t fscache_n_checkaux_update;
++atomic_unchecked_t fscache_n_checkaux_obsolete;
+ 
+ atomic_t fscache_n_cop_alloc_object;
+ atomic_t fscache_n_cop_lookup_object;
+@@ -133,113 +133,113 @@ static int fscache_stats_show(struct seq
+ 	seq_puts(m, "FS-Cache statistics\n");
+ 
+ 	seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
+-		   atomic_read(&fscache_n_cookie_index),
+-		   atomic_read(&fscache_n_cookie_data),
+-		   atomic_read(&fscache_n_cookie_special));
++		   atomic_read_unchecked(&fscache_n_cookie_index),
++		   atomic_read_unchecked(&fscache_n_cookie_data),
++		   atomic_read_unchecked(&fscache_n_cookie_special));
+ 
+ 	seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
+-		   atomic_read(&fscache_n_object_alloc),
+-		   atomic_read(&fscache_n_object_no_alloc),
+-		   atomic_read(&fscache_n_object_avail),
+-		   atomic_read(&fscache_n_object_dead));
++		   atomic_read_unchecked(&fscache_n_object_alloc),
++		   atomic_read_unchecked(&fscache_n_object_no_alloc),
++		   atomic_read_unchecked(&fscache_n_object_avail),
++		   atomic_read_unchecked(&fscache_n_object_dead));
+ 	seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
+-		   atomic_read(&fscache_n_checkaux_none),
+-		   atomic_read(&fscache_n_checkaux_okay),
+-		   atomic_read(&fscache_n_checkaux_update),
+-		   atomic_read(&fscache_n_checkaux_obsolete));
++		   atomic_read_unchecked(&fscache_n_checkaux_none),
++		   atomic_read_unchecked(&fscache_n_checkaux_okay),
++		   atomic_read_unchecked(&fscache_n_checkaux_update),
++		   atomic_read_unchecked(&fscache_n_checkaux_obsolete));
+ 
+ 	seq_printf(m, "Pages  : mrk=%u unc=%u\n",
+-		   atomic_read(&fscache_n_marks),
+-		   atomic_read(&fscache_n_uncaches));
++		   atomic_read_unchecked(&fscache_n_marks),
++		   atomic_read_unchecked(&fscache_n_uncaches));
+ 
+ 	seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
+ 		   " oom=%u\n",
+-		   atomic_read(&fscache_n_acquires),
+-		   atomic_read(&fscache_n_acquires_null),
+-		   atomic_read(&fscache_n_acquires_no_cache),
+-		   atomic_read(&fscache_n_acquires_ok),
+-		   atomic_read(&fscache_n_acquires_nobufs),
+-		   atomic_read(&fscache_n_acquires_oom));
++		   atomic_read_unchecked(&fscache_n_acquires),
++		   atomic_read_unchecked(&fscache_n_acquires_null),
++		   atomic_read_unchecked(&fscache_n_acquires_no_cache),
++		   atomic_read_unchecked(&fscache_n_acquires_ok),
++		   atomic_read_unchecked(&fscache_n_acquires_nobufs),
++		   atomic_read_unchecked(&fscache_n_acquires_oom));
+ 
+ 	seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
+-		   atomic_read(&fscache_n_object_lookups),
+-		   atomic_read(&fscache_n_object_lookups_negative),
+-		   atomic_read(&fscache_n_object_lookups_positive),
+-		   atomic_read(&fscache_n_object_created),
+-		   atomic_read(&fscache_n_object_lookups_timed_out));
++		   atomic_read_unchecked(&fscache_n_object_lookups),
++		   atomic_read_unchecked(&fscache_n_object_lookups_negative),
++		   atomic_read_unchecked(&fscache_n_object_lookups_positive),
++		   atomic_read_unchecked(&fscache_n_object_created),
++		   atomic_read_unchecked(&fscache_n_object_lookups_timed_out));
+ 
+ 	seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
+-		   atomic_read(&fscache_n_updates),
+-		   atomic_read(&fscache_n_updates_null),
+-		   atomic_read(&fscache_n_updates_run));
++		   atomic_read_unchecked(&fscache_n_updates),
++		   atomic_read_unchecked(&fscache_n_updates_null),
++		   atomic_read_unchecked(&fscache_n_updates_run));
+ 
+ 	seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
+-		   atomic_read(&fscache_n_relinquishes),
+-		   atomic_read(&fscache_n_relinquishes_null),
+-		   atomic_read(&fscache_n_relinquishes_waitcrt),
+-		   atomic_read(&fscache_n_relinquishes_retire));
++		   atomic_read_unchecked(&fscache_n_relinquishes),
++		   atomic_read_unchecked(&fscache_n_relinquishes_null),
++		   atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
++		   atomic_read_unchecked(&fscache_n_relinquishes_retire));
+ 
+ 	seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
+-		   atomic_read(&fscache_n_attr_changed),
+-		   atomic_read(&fscache_n_attr_changed_ok),
+-		   atomic_read(&fscache_n_attr_changed_nobufs),
+-		   atomic_read(&fscache_n_attr_changed_nomem),
+-		   atomic_read(&fscache_n_attr_changed_calls));
++		   atomic_read_unchecked(&fscache_n_attr_changed),
++		   atomic_read_unchecked(&fscache_n_attr_changed_ok),
++		   atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
++		   atomic_read_unchecked(&fscache_n_attr_changed_nomem),
++		   atomic_read_unchecked(&fscache_n_attr_changed_calls));
+ 
+ 	seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
+-		   atomic_read(&fscache_n_allocs),
+-		   atomic_read(&fscache_n_allocs_ok),
+-		   atomic_read(&fscache_n_allocs_wait),
+-		   atomic_read(&fscache_n_allocs_nobufs),
+-		   atomic_read(&fscache_n_allocs_intr));
++		   atomic_read_unchecked(&fscache_n_allocs),
++		   atomic_read_unchecked(&fscache_n_allocs_ok),
++		   atomic_read_unchecked(&fscache_n_allocs_wait),
++		   atomic_read_unchecked(&fscache_n_allocs_nobufs),
++		   atomic_read_unchecked(&fscache_n_allocs_intr));
+ 	seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
+-		   atomic_read(&fscache_n_alloc_ops),
+-		   atomic_read(&fscache_n_alloc_op_waits),
+-		   atomic_read(&fscache_n_allocs_object_dead));
++		   atomic_read_unchecked(&fscache_n_alloc_ops),
++		   atomic_read_unchecked(&fscache_n_alloc_op_waits),
++		   atomic_read_unchecked(&fscache_n_allocs_object_dead));
+ 
+ 	seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
+ 		   " int=%u oom=%u\n",
+-		   atomic_read(&fscache_n_retrievals),
+-		   atomic_read(&fscache_n_retrievals_ok),
+-		   atomic_read(&fscache_n_retrievals_wait),
+-		   atomic_read(&fscache_n_retrievals_nodata),
+-		   atomic_read(&fscache_n_retrievals_nobufs),
+-		   atomic_read(&fscache_n_retrievals_intr),
+-		   atomic_read(&fscache_n_retrievals_nomem));
++		   atomic_read_unchecked(&fscache_n_retrievals),
++		   atomic_read_unchecked(&fscache_n_retrievals_ok),
++		   atomic_read_unchecked(&fscache_n_retrievals_wait),
++		   atomic_read_unchecked(&fscache_n_retrievals_nodata),
++		   atomic_read_unchecked(&fscache_n_retrievals_nobufs),
++		   atomic_read_unchecked(&fscache_n_retrievals_intr),
++		   atomic_read_unchecked(&fscache_n_retrievals_nomem));
+ 	seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
+-		   atomic_read(&fscache_n_retrieval_ops),
+-		   atomic_read(&fscache_n_retrieval_op_waits),
+-		   atomic_read(&fscache_n_retrievals_object_dead));
++		   atomic_read_unchecked(&fscache_n_retrieval_ops),
++		   atomic_read_unchecked(&fscache_n_retrieval_op_waits),
++		   atomic_read_unchecked(&fscache_n_retrievals_object_dead));
+ 
+ 	seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
+-		   atomic_read(&fscache_n_stores),
+-		   atomic_read(&fscache_n_stores_ok),
+-		   atomic_read(&fscache_n_stores_again),
+-		   atomic_read(&fscache_n_stores_nobufs),
+-		   atomic_read(&fscache_n_stores_oom));
++		   atomic_read_unchecked(&fscache_n_stores),
++		   atomic_read_unchecked(&fscache_n_stores_ok),
++		   atomic_read_unchecked(&fscache_n_stores_again),
++		   atomic_read_unchecked(&fscache_n_stores_nobufs),
++		   atomic_read_unchecked(&fscache_n_stores_oom));
+ 	seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
+-		   atomic_read(&fscache_n_store_ops),
+-		   atomic_read(&fscache_n_store_calls),
+-		   atomic_read(&fscache_n_store_pages),
+-		   atomic_read(&fscache_n_store_radix_deletes),
+-		   atomic_read(&fscache_n_store_pages_over_limit));
++		   atomic_read_unchecked(&fscache_n_store_ops),
++		   atomic_read_unchecked(&fscache_n_store_calls),
++		   atomic_read_unchecked(&fscache_n_store_pages),
++		   atomic_read_unchecked(&fscache_n_store_radix_deletes),
++		   atomic_read_unchecked(&fscache_n_store_pages_over_limit));
+ 
+ 	seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
+-		   atomic_read(&fscache_n_store_vmscan_not_storing),
+-		   atomic_read(&fscache_n_store_vmscan_gone),
+-		   atomic_read(&fscache_n_store_vmscan_busy),
+-		   atomic_read(&fscache_n_store_vmscan_cancelled));
++		   atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
++		   atomic_read_unchecked(&fscache_n_store_vmscan_gone),
++		   atomic_read_unchecked(&fscache_n_store_vmscan_busy),
++		   atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
+ 
+ 	seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
+-		   atomic_read(&fscache_n_op_pend),
+-		   atomic_read(&fscache_n_op_run),
+-		   atomic_read(&fscache_n_op_enqueue),
+-		   atomic_read(&fscache_n_op_cancelled),
+-		   atomic_read(&fscache_n_op_rejected));
++		   atomic_read_unchecked(&fscache_n_op_pend),
++		   atomic_read_unchecked(&fscache_n_op_run),
++		   atomic_read_unchecked(&fscache_n_op_enqueue),
++		   atomic_read_unchecked(&fscache_n_op_cancelled),
++		   atomic_read_unchecked(&fscache_n_op_rejected));
+ 	seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
+-		   atomic_read(&fscache_n_op_deferred_release),
+-		   atomic_read(&fscache_n_op_release),
+-		   atomic_read(&fscache_n_op_gc));
++		   atomic_read_unchecked(&fscache_n_op_deferred_release),
++		   atomic_read_unchecked(&fscache_n_op_release),
++		   atomic_read_unchecked(&fscache_n_op_gc));
+ 
+ 	seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
+ 		   atomic_read(&fscache_n_cop_alloc_object),
+diff -urNp linux-2.6.38.7/fs/fs_struct.c linux-2.6.38.7/fs/fs_struct.c
+--- linux-2.6.38.7/fs/fs_struct.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fs_struct.c	2011-04-28 19:34:15.000000000 -0400
 @@ -4,6 +4,7 @@
  #include <linux/path.h>
  #include <linux/slab.h>
@@ -31575,21 +39604,9 @@ diff -urNp linux-2.6.38.2/fs/fs_struct.c linux-2.6.38.2/fs/fs_struct.c
  		spin_unlock(&fs->lock);
  
  		task_unlock(current);
-diff -urNp linux-2.6.38.2/fs/fuse/control.c linux-2.6.38.2/fs/fuse/control.c
---- linux-2.6.38.2/fs/fuse/control.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fuse/control.c	2011-03-21 18:31:35.000000000 -0400
-@@ -298,7 +298,7 @@ void fuse_ctl_remove_conn(struct fuse_co
- 
- static int fuse_ctl_fill_super(struct super_block *sb, void *data, int silent)
- {
--	struct tree_descr empty_descr = {""};
-+	struct tree_descr empty_descr = {"", NULL, 0};
- 	struct fuse_conn *fc;
- 	int err;
- 
-diff -urNp linux-2.6.38.2/fs/fuse/cuse.c linux-2.6.38.2/fs/fuse/cuse.c
---- linux-2.6.38.2/fs/fuse/cuse.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fuse/cuse.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fuse/cuse.c linux-2.6.38.7/fs/fuse/cuse.c
+--- linux-2.6.38.7/fs/fuse/cuse.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fuse/cuse.c	2011-04-28 19:34:15.000000000 -0400
 @@ -530,8 +530,18 @@ static int cuse_channel_release(struct i
  	return rc;
  }
@@ -31624,9 +39641,9 @@ diff -urNp linux-2.6.38.2/fs/fuse/cuse.c linux-2.6.38.2/fs/fuse/cuse.c
  	cuse_class = class_create(THIS_MODULE, "cuse");
  	if (IS_ERR(cuse_class))
  		return PTR_ERR(cuse_class);
-diff -urNp linux-2.6.38.2/fs/fuse/dev.c linux-2.6.38.2/fs/fuse/dev.c
---- linux-2.6.38.2/fs/fuse/dev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fuse/dev.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fuse/dev.c linux-2.6.38.7/fs/fuse/dev.c
+--- linux-2.6.38.7/fs/fuse/dev.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fuse/dev.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1183,7 +1183,7 @@ static ssize_t fuse_dev_do_read(struct f
  	return err;
  }
@@ -31708,9 +39725,9 @@ diff -urNp linux-2.6.38.2/fs/fuse/dev.c linux-2.6.38.2/fs/fuse/dev.c
  const struct file_operations fuse_dev_operations = {
  	.owner		= THIS_MODULE,
  	.llseek		= no_llseek,
-diff -urNp linux-2.6.38.2/fs/fuse/dir.c linux-2.6.38.2/fs/fuse/dir.c
---- linux-2.6.38.2/fs/fuse/dir.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fuse/dir.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fuse/dir.c linux-2.6.38.7/fs/fuse/dir.c
+--- linux-2.6.38.7/fs/fuse/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fuse/dir.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1133,7 +1133,7 @@ static char *read_link(struct dentry *de
  	return link;
  }
@@ -31720,9 +39737,9 @@ diff -urNp linux-2.6.38.2/fs/fuse/dir.c linux-2.6.38.2/fs/fuse/dir.c
  {
  	if (!IS_ERR(link))
  		free_page((unsigned long) link);
-diff -urNp linux-2.6.38.2/fs/fuse/fuse_i.h linux-2.6.38.2/fs/fuse/fuse_i.h
---- linux-2.6.38.2/fs/fuse/fuse_i.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/fuse/fuse_i.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/fuse/fuse_i.h linux-2.6.38.7/fs/fuse/fuse_i.h
+--- linux-2.6.38.7/fs/fuse/fuse_i.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/fuse/fuse_i.h	2011-04-28 19:34:15.000000000 -0400
 @@ -541,6 +541,16 @@ extern const struct file_operations fuse
  
  extern const struct dentry_operations fuse_dentry_operations;
@@ -31740,69 +39757,126 @@ diff -urNp linux-2.6.38.2/fs/fuse/fuse_i.h linux-2.6.38.2/fs/fuse/fuse_i.h
  /**
   * Inode to nodeid comparison.
   */
-diff -urNp linux-2.6.38.2/fs/hfs/inode.c linux-2.6.38.2/fs/hfs/inode.c
---- linux-2.6.38.2/fs/hfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/hfs/inode.c	2011-03-21 18:31:35.000000000 -0400
-@@ -447,7 +447,7 @@ int hfs_write_inode(struct inode *inode,
- 
- 	if (S_ISDIR(main_inode->i_mode)) {
- 		if (fd.entrylength < sizeof(struct hfs_cat_dir))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_dir));
- 		if (rec.type != HFS_CDR_DIR ||
-@@ -468,7 +468,7 @@ int hfs_write_inode(struct inode *inode,
- 				sizeof(struct hfs_cat_file));
- 	} else {
- 		if (fd.entrylength < sizeof(struct hfs_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &rec, fd.entryoffset,
- 			   sizeof(struct hfs_cat_file));
- 		if (rec.type != HFS_CDR_FIL ||
-diff -urNp linux-2.6.38.2/fs/hfsplus/inode.c linux-2.6.38.2/fs/hfsplus/inode.c
---- linux-2.6.38.2/fs/hfsplus/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/hfsplus/inode.c	2011-03-21 18:31:35.000000000 -0400
-@@ -498,7 +498,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		hfsplus_get_perms(inode, &folder->permissions, 1);
-@@ -515,7 +515,7 @@ int hfsplus_cat_read_inode(struct inode 
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd->entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd->bnode, &entry, fd->entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 
-@@ -572,7 +572,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_folder *folder = &entry.folder;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_folder))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_folder));
- 		/* simple node checks? */
-@@ -594,7 +594,7 @@ int hfsplus_cat_write_inode(struct inode
- 		struct hfsplus_cat_file *file = &entry.file;
- 
- 		if (fd.entrylength < sizeof(struct hfsplus_cat_file))
--			/* panic? */;
-+			{/* panic? */}
- 		hfs_bnode_read(fd.bnode, &entry, fd.entryoffset,
- 					sizeof(struct hfsplus_cat_file));
- 		hfsplus_inode_write_fork(inode, &file->data_fork);
-diff -urNp linux-2.6.38.2/fs/hugetlbfs/inode.c linux-2.6.38.2/fs/hugetlbfs/inode.c
---- linux-2.6.38.2/fs/hugetlbfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/hugetlbfs/inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/gfs2/ops_inode.c linux-2.6.38.7/fs/gfs2/ops_inode.c
+--- linux-2.6.38.7/fs/gfs2/ops_inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/gfs2/ops_inode.c	2011-05-16 21:47:08.000000000 -0400
+@@ -740,6 +740,8 @@ static int gfs2_rename(struct inode *odi
+ 	unsigned int x;
+ 	int error;
+ 
++	pax_track_stack();
++
+ 	if (ndentry->d_inode) {
+ 		nip = GFS2_I(ndentry->d_inode);
+ 		if (ip == nip)
+@@ -1019,7 +1021,7 @@ out:
+ 
+ static void gfs2_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
+ {
+-	char *s = nd_get_link(nd);
++	const char *s = nd_get_link(nd);
+ 	if (!IS_ERR(s))
+ 		kfree(s);
+ }
+diff -urNp linux-2.6.38.7/fs/hfsplus/catalog.c linux-2.6.38.7/fs/hfsplus/catalog.c
+--- linux-2.6.38.7/fs/hfsplus/catalog.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hfsplus/catalog.c	2011-05-16 21:47:08.000000000 -0400
+@@ -179,6 +179,8 @@ int hfsplus_find_cat(struct super_block 
+ 	int err;
+ 	u16 type;
+ 
++	pax_track_stack();
++
+ 	hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
+ 	err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
+ 	if (err)
+@@ -210,6 +212,8 @@ int hfsplus_create_cat(u32 cnid, struct 
+ 	int entry_size;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n",
+ 		str->name, cnid, inode->i_nlink);
+ 	hfs_find_init(HFSPLUS_SB(sb)->cat_tree, &fd);
+@@ -349,6 +353,8 @@ int hfsplus_rename_cat(u32 cnid,
+ 	int entry_size, type;
+ 	int err = 0;
+ 
++	pax_track_stack();
++
+ 	dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n",
+ 		cnid, src_dir->i_ino, src_name->name,
+ 		dst_dir->i_ino, dst_name->name);
+diff -urNp linux-2.6.38.7/fs/hfsplus/dir.c linux-2.6.38.7/fs/hfsplus/dir.c
+--- linux-2.6.38.7/fs/hfsplus/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hfsplus/dir.c	2011-05-16 21:47:08.000000000 -0400
+@@ -129,6 +129,8 @@ static int hfsplus_readdir(struct file *
+ 	struct hfsplus_readdir_data *rd;
+ 	u16 type;
+ 
++	pax_track_stack();
++
+ 	if (filp->f_pos >= inode->i_size)
+ 		return 0;
+ 
+diff -urNp linux-2.6.38.7/fs/hfsplus/inode.c linux-2.6.38.7/fs/hfsplus/inode.c
+--- linux-2.6.38.7/fs/hfsplus/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hfsplus/inode.c	2011-05-16 21:47:08.000000000 -0400
+@@ -491,6 +491,8 @@ int hfsplus_cat_read_inode(struct inode 
+ 	int res = 0;
+ 	u16 type;
+ 
++	pax_track_stack();
++
+ 	type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
+ 
+ 	HFSPLUS_I(inode)->linkid = 0;
+@@ -554,6 +556,8 @@ int hfsplus_cat_write_inode(struct inode
+ 	struct hfs_find_data fd;
+ 	hfsplus_cat_entry entry;
+ 
++	pax_track_stack();
++
+ 	if (HFSPLUS_IS_RSRC(inode))
+ 		main_inode = HFSPLUS_I(inode)->rsrc_inode;
+ 
+diff -urNp linux-2.6.38.7/fs/hfsplus/ioctl.c linux-2.6.38.7/fs/hfsplus/ioctl.c
+--- linux-2.6.38.7/fs/hfsplus/ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hfsplus/ioctl.c	2011-05-16 21:47:08.000000000 -0400
+@@ -122,6 +122,8 @@ int hfsplus_setxattr(struct dentry *dent
+ 	struct hfsplus_cat_file *file;
+ 	int res;
+ 
++	pax_track_stack();
++
+ 	if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
+ 		return -EOPNOTSUPP;
+ 
+@@ -166,6 +168,8 @@ ssize_t hfsplus_getxattr(struct dentry *
+ 	struct hfsplus_cat_file *file;
+ 	ssize_t res = 0;
+ 
++	pax_track_stack();
++
+ 	if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
+ 		return -EOPNOTSUPP;
+ 
+diff -urNp linux-2.6.38.7/fs/hfsplus/super.c linux-2.6.38.7/fs/hfsplus/super.c
+--- linux-2.6.38.7/fs/hfsplus/super.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hfsplus/super.c	2011-05-16 21:47:08.000000000 -0400
+@@ -340,6 +340,8 @@ static int hfsplus_fill_super(struct sup
+ 	struct nls_table *nls = NULL;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	err = -EINVAL;
+ 	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
+ 	if (!sbi)
+diff -urNp linux-2.6.38.7/fs/hugetlbfs/inode.c linux-2.6.38.7/fs/hugetlbfs/inode.c
+--- linux-2.6.38.7/fs/hugetlbfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/hugetlbfs/inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -915,7 +915,7 @@ static struct file_system_type hugetlbfs
  	.kill_sb	= kill_litter_super,
  };
@@ -31812,113 +39886,68 @@ diff -urNp linux-2.6.38.2/fs/hugetlbfs/inode.c linux-2.6.38.2/fs/hugetlbfs/inode
  
  static int can_do_hugetlb_shm(void)
  {
-diff -urNp linux-2.6.38.2/fs/jffs2/debug.h linux-2.6.38.2/fs/jffs2/debug.h
---- linux-2.6.38.2/fs/jffs2/debug.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/jffs2/debug.h	2011-03-21 18:31:35.000000000 -0400
-@@ -53,13 +53,13 @@
- #if CONFIG_JFFS2_FS_DEBUG > 0
- #define D1(x) x
- #else
--#define D1(x)
-+#define D1(x) do {} while (0);
- #endif
+diff -urNp linux-2.6.38.7/fs/inode.c linux-2.6.38.7/fs/inode.c
+--- linux-2.6.38.7/fs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/inode.c	2011-04-28 19:34:15.000000000 -0400
+@@ -801,8 +801,8 @@ unsigned int get_next_ino(void)
  
- #if CONFIG_JFFS2_FS_DEBUG > 1
- #define D2(x) x
- #else
--#define D2(x)
-+#define D2(x) do {} while (0);
- #endif
+ #ifdef CONFIG_SMP
+ 	if (unlikely((res & (LAST_INO_BATCH-1)) == 0)) {
+-		static atomic_t shared_last_ino;
+-		int next = atomic_add_return(LAST_INO_BATCH, &shared_last_ino);
++		static atomic_unchecked_t shared_last_ino;
++		int next = atomic_add_return_unchecked(LAST_INO_BATCH, &shared_last_ino);
  
- /* The prefixes of JFFS2 messages */
-@@ -115,73 +115,73 @@
- #ifdef JFFS2_DBG_READINODE_MESSAGES
- #define dbg_readinode(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode(fmt, ...)
-+#define dbg_readinode(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_READINODE2_MESSAGES
- #define dbg_readinode2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_readinode2(fmt, ...)
-+#define dbg_readinode2(fmt, ...)	do {} while (0)
- #endif
+ 		res = next - LAST_INO_BATCH;
+ 	}
+diff -urNp linux-2.6.38.7/fs/jbd/checkpoint.c linux-2.6.38.7/fs/jbd/checkpoint.c
+--- linux-2.6.38.7/fs/jbd/checkpoint.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jbd/checkpoint.c	2011-05-16 21:47:08.000000000 -0400
+@@ -350,6 +350,8 @@ int log_do_checkpoint(journal_t *journal
+ 	tid_t this_tid;
+ 	int result;
  
- /* Fragtree build debugging messages */
- #ifdef JFFS2_DBG_FRAGTREE_MESSAGES
- #define dbg_fragtree(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree(fmt, ...)
-+#define dbg_fragtree(fmt, ...)	do {} while (0)
- #endif
- #ifdef JFFS2_DBG_FRAGTREE2_MESSAGES
- #define dbg_fragtree2(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fragtree2(fmt, ...)
-+#define dbg_fragtree2(fmt, ...)	do {} while (0)
- #endif
++	pax_track_stack();
++
+ 	jbd_debug(1, "Start checkpoint\n");
  
- /* Directory entry list manilulation debugging messages */
- #ifdef JFFS2_DBG_DENTLIST_MESSAGES
- #define dbg_dentlist(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_dentlist(fmt, ...)
-+#define dbg_dentlist(fmt, ...)	do {} while (0)
- #endif
+ 	/*
+diff -urNp linux-2.6.38.7/fs/jffs2/compr_rtime.c linux-2.6.38.7/fs/jffs2/compr_rtime.c
+--- linux-2.6.38.7/fs/jffs2/compr_rtime.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jffs2/compr_rtime.c	2011-05-16 21:47:08.000000000 -0400
+@@ -37,6 +37,8 @@ static int jffs2_rtime_compress(unsigned
+ 	int outpos = 0;
+ 	int pos=0;
  
- /* Print the messages about manipulating node_refs */
- #ifdef JFFS2_DBG_NODEREF_MESSAGES
- #define dbg_noderef(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_noderef(fmt, ...)
-+#define dbg_noderef(fmt, ...)	do {} while (0)
- #endif
++	pax_track_stack();
++
+ 	memset(positions,0,sizeof(positions));
  
- /* Manipulations with the list of inodes (JFFS2 inocache) */
- #ifdef JFFS2_DBG_INOCACHE_MESSAGES
- #define dbg_inocache(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_inocache(fmt, ...)
-+#define dbg_inocache(fmt, ...)	do {} while (0)
- #endif
+ 	while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
+@@ -78,6 +80,8 @@ static int jffs2_rtime_decompress(unsign
+ 	int outpos = 0;
+ 	int pos=0;
  
- /* Summary debugging messages */
- #ifdef JFFS2_DBG_SUMMARY_MESSAGES
- #define dbg_summary(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_summary(fmt, ...)
-+#define dbg_summary(fmt, ...)	do {} while (0)
- #endif
++	pax_track_stack();
++
+ 	memset(positions,0,sizeof(positions));
  
- /* File system build messages */
- #ifdef JFFS2_DBG_FSBUILD_MESSAGES
- #define dbg_fsbuild(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_fsbuild(fmt, ...)
-+#define dbg_fsbuild(fmt, ...)	do {} while (0)
- #endif
+ 	while (outpos<destlen) {
+diff -urNp linux-2.6.38.7/fs/jffs2/compr_rubin.c linux-2.6.38.7/fs/jffs2/compr_rubin.c
+--- linux-2.6.38.7/fs/jffs2/compr_rubin.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jffs2/compr_rubin.c	2011-05-16 21:47:08.000000000 -0400
+@@ -314,6 +314,8 @@ static int jffs2_dynrubin_compress(unsig
+ 	int ret;
+ 	uint32_t mysrclen, mydstlen;
  
- /* Watch the object allocations */
- #ifdef JFFS2_DBG_MEMALLOC_MESSAGES
- #define dbg_memalloc(fmt, ...)	JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_memalloc(fmt, ...)
-+#define dbg_memalloc(fmt, ...)	do {} while (0)
- #endif
++	pax_track_stack();
++
+ 	mysrclen = *sourcelen;
+ 	mydstlen = *dstlen - 8;
  
- /* Watch the XATTR subsystem */
- #ifdef JFFS2_DBG_XATTR_MESSAGES
- #define dbg_xattr(fmt, ...)  JFFS2_DEBUG(fmt, ##__VA_ARGS__)
- #else
--#define dbg_xattr(fmt, ...)
-+#define dbg_xattr(fmt, ...)	do {} while (0)
- #endif 
- 
- /* "Sanity" checks */
-diff -urNp linux-2.6.38.2/fs/jffs2/erase.c linux-2.6.38.2/fs/jffs2/erase.c
---- linux-2.6.38.2/fs/jffs2/erase.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/jffs2/erase.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/jffs2/erase.c linux-2.6.38.7/fs/jffs2/erase.c
+--- linux-2.6.38.7/fs/jffs2/erase.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jffs2/erase.c	2011-04-28 19:34:15.000000000 -0400
 @@ -439,7 +439,8 @@ static void jffs2_mark_erased_block(stru
  		struct jffs2_unknown_node marker = {
  			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
@@ -31929,40 +39958,9 @@ diff -urNp linux-2.6.38.2/fs/jffs2/erase.c linux-2.6.38.2/fs/jffs2/erase.c
  		};
  
  		jffs2_prealloc_raw_node_refs(c, jeb, 1);
-diff -urNp linux-2.6.38.2/fs/jffs2/summary.h linux-2.6.38.2/fs/jffs2/summary.h
---- linux-2.6.38.2/fs/jffs2/summary.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/jffs2/summary.h	2011-03-21 18:31:35.000000000 -0400
-@@ -194,18 +194,18 @@ int jffs2_sum_scan_sumnode(struct jffs2_
- 
- #define jffs2_sum_active() (0)
- #define jffs2_sum_init(a) (0)
--#define jffs2_sum_exit(a)
--#define jffs2_sum_disable_collecting(a)
-+#define jffs2_sum_exit(a) do {} while (0)
-+#define jffs2_sum_disable_collecting(a) do {} while (0)
- #define jffs2_sum_is_disabled(a) (0)
--#define jffs2_sum_reset_collected(a)
-+#define jffs2_sum_reset_collected(a) do {} while (0)
- #define jffs2_sum_add_kvec(a,b,c,d) (0)
--#define jffs2_sum_move_collected(a,b)
-+#define jffs2_sum_move_collected(a,b) do {} while (0)
- #define jffs2_sum_write_sumnode(a) (0)
--#define jffs2_sum_add_padding_mem(a,b)
--#define jffs2_sum_add_inode_mem(a,b,c)
--#define jffs2_sum_add_dirent_mem(a,b,c)
--#define jffs2_sum_add_xattr_mem(a,b,c)
--#define jffs2_sum_add_xref_mem(a,b,c)
-+#define jffs2_sum_add_padding_mem(a,b) do {} while (0)
-+#define jffs2_sum_add_inode_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_dirent_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xattr_mem(a,b,c) do {} while (0)
-+#define jffs2_sum_add_xref_mem(a,b,c) do {} while (0)
- #define jffs2_sum_scan_sumnode(a,b,c,d,e) (0)
- 
- #endif /* CONFIG_JFFS2_SUMMARY */
-diff -urNp linux-2.6.38.2/fs/jffs2/wbuf.c linux-2.6.38.2/fs/jffs2/wbuf.c
---- linux-2.6.38.2/fs/jffs2/wbuf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/jffs2/wbuf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/jffs2/wbuf.c linux-2.6.38.7/fs/jffs2/wbuf.c
+--- linux-2.6.38.7/fs/jffs2/wbuf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jffs2/wbuf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1012,7 +1012,8 @@ static const struct jffs2_unknown_node o
  {
  	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
@@ -31973,9 +39971,21 @@ diff -urNp linux-2.6.38.2/fs/jffs2/wbuf.c linux-2.6.38.2/fs/jffs2/wbuf.c
  };
  
  /*
-diff -urNp linux-2.6.38.2/fs/Kconfig.binfmt linux-2.6.38.2/fs/Kconfig.binfmt
---- linux-2.6.38.2/fs/Kconfig.binfmt	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/Kconfig.binfmt	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/jffs2/xattr.c linux-2.6.38.7/fs/jffs2/xattr.c
+--- linux-2.6.38.7/fs/jffs2/xattr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/jffs2/xattr.c	2011-05-16 21:47:08.000000000 -0400
+@@ -773,6 +773,8 @@ void jffs2_build_xattr_subsystem(struct 
+ 
+ 	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
+ 
++	pax_track_stack();
++
+ 	/* Phase.1 : Merge same xref */
+ 	for (i=0; i < XREF_TMPHASH_SIZE; i++)
+ 		xref_tmphash[i] = NULL;
+diff -urNp linux-2.6.38.7/fs/Kconfig.binfmt linux-2.6.38.7/fs/Kconfig.binfmt
+--- linux-2.6.38.7/fs/Kconfig.binfmt	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/Kconfig.binfmt	2011-04-28 19:34:15.000000000 -0400
 @@ -86,7 +86,7 @@ config HAVE_AOUT
  
  config BINFMT_AOUT
@@ -31985,9 +39995,62 @@ diff -urNp linux-2.6.38.2/fs/Kconfig.binfmt linux-2.6.38.2/fs/Kconfig.binfmt
  	---help---
  	  A.out (Assembler.OUTput) is a set of formats for libraries and
  	  executables used in the earliest versions of UNIX.  Linux used
-diff -urNp linux-2.6.38.2/fs/lockd/svc.c linux-2.6.38.2/fs/lockd/svc.c
---- linux-2.6.38.2/fs/lockd/svc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/lockd/svc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/libfs.c linux-2.6.38.7/fs/libfs.c
+--- linux-2.6.38.7/fs/libfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/libfs.c	2011-05-11 18:34:57.000000000 -0400
+@@ -163,6 +163,9 @@ int dcache_readdir(struct file * filp, v
+ 
+ 			for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
+ 				struct dentry *next;
++				char d_name[sizeof(next->d_iname)];
++				const unsigned char *name;
++
+ 				next = list_entry(p, struct dentry, d_u.d_child);
+ 				spin_lock_nested(&next->d_lock, DENTRY_D_LOCK_NESTED);
+ 				if (!simple_positive(next)) {
+@@ -172,7 +175,12 @@ int dcache_readdir(struct file * filp, v
+ 
+ 				spin_unlock(&next->d_lock);
+ 				spin_unlock(&dentry->d_lock);
+-				if (filldir(dirent, next->d_name.name, 
++				name = next->d_name.name;
++				if (name == next->d_iname) {
++					memcpy(d_name, name, next->d_name.len);
++					name = d_name;
++				}
++				if (filldir(dirent, name, 
+ 					    next->d_name.len, filp->f_pos, 
+ 					    next->d_inode->i_ino, 
+ 					    dt_type(next->d_inode)) < 0)
+diff -urNp linux-2.6.38.7/fs/lockd/clntproc.c linux-2.6.38.7/fs/lockd/clntproc.c
+--- linux-2.6.38.7/fs/lockd/clntproc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/lockd/clntproc.c	2011-05-16 21:47:08.000000000 -0400
+@@ -36,11 +36,11 @@ static const struct rpc_call_ops nlmclnt
+ /*
+  * Cookie counter for NLM requests
+  */
+-static atomic_t	nlm_cookie = ATOMIC_INIT(0x1234);
++static atomic_unchecked_t	nlm_cookie = ATOMIC_INIT(0x1234);
+ 
+ void nlmclnt_next_cookie(struct nlm_cookie *c)
+ {
+-	u32	cookie = atomic_inc_return(&nlm_cookie);
++	u32	cookie = atomic_inc_return_unchecked(&nlm_cookie);
+ 
+ 	memcpy(c->data, &cookie, 4);
+ 	c->len=4;
+@@ -620,6 +620,8 @@ nlmclnt_reclaim(struct nlm_host *host, s
+ 	struct nlm_rqst reqst, *req;
+ 	int		status;
+ 
++	pax_track_stack();
++
+ 	req = &reqst;
+ 	memset(req, 0, sizeof(*req));
+ 	locks_init_lock(&req->a_args.lock.fl);
+diff -urNp linux-2.6.38.7/fs/lockd/svc.c linux-2.6.38.7/fs/lockd/svc.c
+--- linux-2.6.38.7/fs/lockd/svc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/lockd/svc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -41,7 +41,7 @@
  
  static struct svc_program	nlmsvc_program;
@@ -31997,9 +40060,9 @@ diff -urNp linux-2.6.38.2/fs/lockd/svc.c linux-2.6.38.2/fs/lockd/svc.c
  EXPORT_SYMBOL_GPL(nlmsvc_ops);
  
  static DEFINE_MUTEX(nlmsvc_mutex);
-diff -urNp linux-2.6.38.2/fs/locks.c linux-2.6.38.2/fs/locks.c
---- linux-2.6.38.2/fs/locks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/locks.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/locks.c linux-2.6.38.7/fs/locks.c
+--- linux-2.6.38.7/fs/locks.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/locks.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2044,16 +2044,16 @@ void locks_remove_flock(struct file *fil
  		return;
  
@@ -32021,50 +40084,80 @@ diff -urNp linux-2.6.38.2/fs/locks.c linux-2.6.38.2/fs/locks.c
  	}
  
  	lock_flocks();
-diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
---- linux-2.6.38.2/fs/namei.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/namei.c	2011-03-28 16:59:25.000000000 -0400
-@@ -226,14 +226,6 @@ int generic_permission(struct inode *ino
+diff -urNp linux-2.6.38.7/fs/logfs/super.c linux-2.6.38.7/fs/logfs/super.c
+--- linux-2.6.38.7/fs/logfs/super.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/logfs/super.c	2011-05-16 21:47:08.000000000 -0400
+@@ -266,6 +266,8 @@ static int logfs_recover_sb(struct super
+ 	struct logfs_disk_super _ds1, *ds1 = &_ds1;
+ 	int err, valid0, valid1;
+ 
++	pax_track_stack();
++
+ 	/* read first superblock */
+ 	err = wbuf_read(sb, super->s_sb_ofs[0], sizeof(*ds0), ds0);
+ 	if (err)
+diff -urNp linux-2.6.38.7/fs/namei.c linux-2.6.38.7/fs/namei.c
+--- linux-2.6.38.7/fs/namei.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/fs/namei.c	2011-05-22 16:14:10.000000000 -0400
+@@ -226,20 +226,30 @@ int generic_permission(struct inode *ino
  		return ret;
  
  	/*
 -	 * Read/write DACs are always overridable.
 -	 * Executable DACs are overridable if at least one exec bit is set.
--	 */
++	 * Searching includes executable on directories, else just read.
+ 	 */
 -	if (!(mask & MAY_EXEC) || execute_ok(inode))
 -		if (capable(CAP_DAC_OVERRIDE))
--			return 0;
--
--	/*
- 	 * Searching includes executable on directories, else just read.
- 	 */
- 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
-@@ -241,6 +233,14 @@ int generic_permission(struct inode *ino
- 		if (capable(CAP_DAC_READ_SEARCH))
++	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
++	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))) {
++#ifdef CONFIG_GRKERNSEC
++		if (flags & IPERM_FLAG_RCU)
++			return -ECHILD;
++#endif
++		if (capable(CAP_DAC_READ_SEARCH))
  			return 0;
++	}
  
-+	/*
+ 	/*
+-	 * Searching includes executable on directories, else just read.
 +	 * Read/write DACs are always overridable.
 +	 * Executable DACs are overridable if at least one exec bit is set.
-+	 */
-+	if (!(mask & MAY_EXEC) || execute_ok(inode))
+ 	 */
+-	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
+-	if (mask == MAY_READ || (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE)))
+-		if (capable(CAP_DAC_READ_SEARCH))
++	if (!(mask & MAY_EXEC) || execute_ok(inode)) {
++#ifdef CONFIG_GRKERNSEC
++		if (flags & IPERM_FLAG_RCU)
++			return -ECHILD;
++#endif
 +		if (capable(CAP_DAC_OVERRIDE))
-+			return 0;
-+
+ 			return 0;
++	}
+ 
  	return -EACCES;
  }
- 
-@@ -687,7 +687,8 @@ static inline int exec_permission(struct
+@@ -687,8 +697,17 @@ static inline int exec_permission(struct
  	if (ret == -ECHILD)
  		return ret;
  
 -	if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
-+	if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
++	if (capable_nolog(CAP_DAC_OVERRIDE))
++		goto ok;
++	else {
++#ifdef CONFIG_GRKERNSEC
++		if (flags & IPERM_FLAG_RCU)
++			return -ECHILD;
++#endif
++		if (capable(CAP_DAC_READ_SEARCH) ||
 +			capable(CAP_DAC_OVERRIDE))
  		goto ok;
++	}
  
  	return ret;
-@@ -775,7 +776,7 @@ __do_follow_link(const struct path *link
+ ok:
+@@ -776,7 +795,7 @@ __do_follow_link(const struct path *link
  	*p = dentry->d_inode->i_op->follow_link(dentry, nd);
  	error = PTR_ERR(*p);
  	if (!IS_ERR(*p)) {
@@ -32073,7 +40166,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  		error = 0;
  		if (s)
  			error = __vfs_follow_link(nd, s);
-@@ -814,6 +815,13 @@ static inline int do_follow_link(struct 
+@@ -815,6 +834,13 @@ static inline int do_follow_link(struct 
  	err = security_inode_follow_link(path->dentry, nd);
  	if (err)
  		goto loop;
@@ -32087,7 +40180,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	current->link_count++;
  	current->total_link_count++;
  	nd->depth++;
-@@ -1505,13 +1513,36 @@ return_reval:
+@@ -1506,13 +1532,36 @@ return_reval:
  return_base:
  		if (nameidata_drop_rcu_last_maybe(nd))
  			return -ECHILD;
@@ -32124,7 +40217,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  		path_put(&nd->path);
  return_err:
  	return err;
-@@ -1738,6 +1769,9 @@ static int do_path_lookup(int dfd, const
+@@ -1739,6 +1788,9 @@ static int do_path_lookup(int dfd, const
  	}
  
  	if (likely(!retval)) {
@@ -32134,7 +40227,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  		if (unlikely(!audit_dummy_context())) {
  			if (nd->path.dentry && nd->inode)
  				audit_inode(name, nd->path.dentry);
-@@ -2078,6 +2112,30 @@ int vfs_create(struct inode *dir, struct
+@@ -2079,6 +2131,30 @@ int vfs_create(struct inode *dir, struct
  	return error;
  }
  
@@ -32165,7 +40258,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  int may_open(struct path *path, int acc_mode, int flag)
  {
  	struct dentry *dentry = path->dentry;
-@@ -2126,7 +2184,27 @@ int may_open(struct path *path, int acc_
+@@ -2127,7 +2203,27 @@ int may_open(struct path *path, int acc_
  	/*
  	 * Ensure there are no outstanding leases on the file.
  	 */
@@ -32194,7 +40287,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  }
  
  static int handle_truncate(struct file *filp)
-@@ -2161,6 +2239,12 @@ static int __open_namei_create(struct na
+@@ -2162,6 +2258,12 @@ static int __open_namei_create(struct na
  {
  	int error;
  	struct dentry *dir = nd->path.dentry;
@@ -32207,7 +40300,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  
  	if (!IS_POSIXACL(dir->d_inode))
  		mode &= ~current_umask();
-@@ -2168,6 +2252,8 @@ static int __open_namei_create(struct na
+@@ -2169,6 +2271,8 @@ static int __open_namei_create(struct na
  	if (error)
  		goto out_unlock;
  	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
@@ -32216,7 +40309,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  out_unlock:
  	mutex_unlock(&dir->d_inode->i_mutex);
  	dput(nd->path.dentry);
-@@ -2179,30 +2265,6 @@ out_unlock:
+@@ -2180,30 +2284,6 @@ out_unlock:
  	return may_open(&nd->path, 0, open_flag & ~O_TRUNC);
  }
  
@@ -32247,7 +40340,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  static int open_will_truncate(int flag, struct inode *inode)
  {
  	/*
-@@ -2273,6 +2335,7 @@ static struct file *do_last(struct namei
+@@ -2274,6 +2354,7 @@ static struct file *do_last(struct namei
  			    int mode, const char *pathname)
  {
  	struct dentry *dir = nd->path.dentry;
@@ -32255,7 +40348,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	struct file *filp;
  	int error = -EISDIR;
  
-@@ -2351,6 +2414,14 @@ static struct file *do_last(struct namei
+@@ -2352,6 +2433,14 @@ static struct file *do_last(struct namei
  	/*
  	 * It already exists.
  	 */
@@ -32270,7 +40363,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	mutex_unlock(&dir->d_inode->i_mutex);
  	audit_inode(pathname, path->dentry);
  
-@@ -2534,6 +2605,11 @@ reval:
+@@ -2535,6 +2624,11 @@ reval:
  		error = security_inode_follow_link(link.dentry, &nd);
  		if (error)
  			goto exit_dput;
@@ -32282,7 +40375,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  		error = __do_follow_link(&link, &nd, &cookie);
  		if (unlikely(error)) {
  			if (!IS_ERR(cookie) && linki->i_op->put_link)
-@@ -2704,6 +2780,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+@@ -2705,6 +2799,17 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
  	error = may_mknod(mode);
  	if (error)
  		goto out_dput;
@@ -32300,7 +40393,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto out_dput;
-@@ -2724,6 +2811,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
+@@ -2725,6 +2830,9 @@ SYSCALL_DEFINE4(mknodat, int, dfd, const
  	}
  out_drop_write:
  	mnt_drop_write(nd.path.mnt);
@@ -32310,7 +40403,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  out_dput:
  	dput(dentry);
  out_unlock:
-@@ -2776,6 +2866,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+@@ -2777,6 +2885,11 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
  	if (IS_ERR(dentry))
  		goto out_unlock;
  
@@ -32322,7 +40415,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	if (!IS_POSIXACL(nd.path.dentry->d_inode))
  		mode &= ~current_umask();
  	error = mnt_want_write(nd.path.mnt);
-@@ -2787,6 +2882,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
+@@ -2788,6 +2901,10 @@ SYSCALL_DEFINE3(mkdirat, int, dfd, const
  	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
  out_drop_write:
  	mnt_drop_write(nd.path.mnt);
@@ -32333,7 +40426,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  out_dput:
  	dput(dentry);
  out_unlock:
-@@ -2866,6 +2965,8 @@ static long do_rmdir(int dfd, const char
+@@ -2867,6 +2984,8 @@ static long do_rmdir(int dfd, const char
  	char * name;
  	struct dentry *dentry;
  	struct nameidata nd;
@@ -32342,7 +40435,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2890,6 +2991,19 @@ static long do_rmdir(int dfd, const char
+@@ -2891,6 +3010,19 @@ static long do_rmdir(int dfd, const char
  	error = PTR_ERR(dentry);
  	if (IS_ERR(dentry))
  		goto exit2;
@@ -32362,7 +40455,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto exit3;
-@@ -2897,6 +3011,8 @@ static long do_rmdir(int dfd, const char
+@@ -2898,6 +3030,8 @@ static long do_rmdir(int dfd, const char
  	if (error)
  		goto exit4;
  	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
@@ -32371,7 +40464,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  exit4:
  	mnt_drop_write(nd.path.mnt);
  exit3:
-@@ -2959,6 +3075,8 @@ static long do_unlinkat(int dfd, const c
+@@ -2960,6 +3094,8 @@ static long do_unlinkat(int dfd, const c
  	struct dentry *dentry;
  	struct nameidata nd;
  	struct inode *inode = NULL;
@@ -32380,7 +40473,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  
  	error = user_path_parent(dfd, pathname, &nd, &name);
  	if (error)
-@@ -2978,8 +3096,17 @@ static long do_unlinkat(int dfd, const c
+@@ -2979,8 +3115,17 @@ static long do_unlinkat(int dfd, const c
  		if (nd.last.name[nd.last.len])
  			goto slashes;
  		inode = dentry->d_inode;
@@ -32399,7 +40492,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  		error = mnt_want_write(nd.path.mnt);
  		if (error)
  			goto exit2;
-@@ -2987,6 +3114,8 @@ static long do_unlinkat(int dfd, const c
+@@ -2988,6 +3133,8 @@ static long do_unlinkat(int dfd, const c
  		if (error)
  			goto exit3;
  		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
@@ -32408,7 +40501,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  exit3:
  		mnt_drop_write(nd.path.mnt);
  	exit2:
-@@ -3064,6 +3193,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
+@@ -3065,6 +3212,11 @@ SYSCALL_DEFINE3(symlinkat, const char __
  	if (IS_ERR(dentry))
  		goto out_unlock;
  
@@ -32420,7 +40513,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto out_dput;
-@@ -3071,6 +3205,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
+@@ -3072,6 +3224,8 @@ SYSCALL_DEFINE3(symlinkat, const char __
  	if (error)
  		goto out_drop_write;
  	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
@@ -32429,7 +40522,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  out_drop_write:
  	mnt_drop_write(nd.path.mnt);
  out_dput:
-@@ -3163,6 +3299,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+@@ -3164,6 +3318,20 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
  	error = PTR_ERR(new_dentry);
  	if (IS_ERR(new_dentry))
  		goto out_unlock;
@@ -32450,7 +40543,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	error = mnt_want_write(nd.path.mnt);
  	if (error)
  		goto out_dput;
-@@ -3170,6 +3320,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
+@@ -3171,6 +3339,8 @@ SYSCALL_DEFINE5(linkat, int, olddfd, con
  	if (error)
  		goto out_drop_write;
  	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
@@ -32459,7 +40552,16 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  out_drop_write:
  	mnt_drop_write(nd.path.mnt);
  out_dput:
-@@ -3403,6 +3555,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+@@ -3348,6 +3518,8 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+ 	char *to;
+ 	int error;
+ 
++	pax_track_stack();
++
+ 	error = user_path_parent(olddfd, oldname, &oldnd, &from);
+ 	if (error)
+ 		goto exit;
+@@ -3404,6 +3576,12 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
  	if (new_dentry == trap)
  		goto exit5;
  
@@ -32472,7 +40574,7 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  	error = mnt_want_write(oldnd.path.mnt);
  	if (error)
  		goto exit5;
-@@ -3412,6 +3570,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
+@@ -3413,6 +3591,9 @@ SYSCALL_DEFINE4(renameat, int, olddfd, c
  		goto exit6;
  	error = vfs_rename(old_dir->d_inode, old_dentry,
  				   new_dir->d_inode, new_dentry);
@@ -32482,9 +40584,34 @@ diff -urNp linux-2.6.38.2/fs/namei.c linux-2.6.38.2/fs/namei.c
  exit6:
  	mnt_drop_write(oldnd.path.mnt);
  exit5:
-diff -urNp linux-2.6.38.2/fs/namespace.c linux-2.6.38.2/fs/namespace.c
---- linux-2.6.38.2/fs/namespace.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/fs/namespace.c	2011-03-28 17:42:53.000000000 -0400
+@@ -3438,6 +3619,8 @@ SYSCALL_DEFINE2(rename, const char __use
+ 
+ int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
+ {
++	char tmpbuf[64];
++	const char *newlink;
+ 	int len;
+ 
+ 	len = PTR_ERR(link);
+@@ -3447,7 +3630,14 @@ int vfs_readlink(struct dentry *dentry, 
+ 	len = strlen(link);
+ 	if (len > (unsigned) buflen)
+ 		len = buflen;
+-	if (copy_to_user(buffer, link, len))
++
++	if (len < sizeof(tmpbuf)) {
++		memcpy(tmpbuf, link, len);
++		newlink = tmpbuf;
++	} else
++		newlink = link;
++
++	if (copy_to_user(buffer, newlink, len))
+ 		len = -EFAULT;
+ out:
+ 	return len;
+diff -urNp linux-2.6.38.7/fs/namespace.c linux-2.6.38.7/fs/namespace.c
+--- linux-2.6.38.7/fs/namespace.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/fs/namespace.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1285,6 +1285,9 @@ static int do_umount(struct vfsmount *mn
  		if (!(sb->s_flags & MS_RDONLY))
  			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
@@ -32545,9 +40672,69 @@ diff -urNp linux-2.6.38.2/fs/namespace.c linux-2.6.38.2/fs/namespace.c
  	get_fs_root(current->fs, &root);
  	down_write(&namespace_sem);
  	mutex_lock(&old.dentry->d_inode->i_mutex);
-diff -urNp linux-2.6.38.2/fs/nfs/inode.c linux-2.6.38.2/fs/nfs/inode.c
---- linux-2.6.38.2/fs/nfs/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nfs/inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ncpfs/dir.c linux-2.6.38.7/fs/ncpfs/dir.c
+--- linux-2.6.38.7/fs/ncpfs/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ncpfs/dir.c	2011-05-16 21:47:09.000000000 -0400
+@@ -299,6 +299,8 @@ ncp_lookup_validate(struct dentry *dentr
+ 	int res, val = 0, len;
+ 	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
++	pax_track_stack();
++
+ 	if (dentry == dentry->d_sb->s_root)
+ 		return 1;
+ 
+@@ -844,6 +846,8 @@ static struct dentry *ncp_lookup(struct 
+ 	int error, res, len;
+ 	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
++	pax_track_stack();
++
+ 	error = -EIO;
+ 	if (!ncp_conn_valid(server))
+ 		goto finished;
+@@ -931,6 +935,8 @@ int ncp_create_new(struct inode *dir, st
+ 	PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name, mode);
+ 
++	pax_track_stack();
++
+ 	ncp_age_dentry(server, dentry);
+ 	len = sizeof(__name);
+ 	error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
+@@ -992,6 +998,8 @@ static int ncp_mkdir(struct inode *dir, 
+ 	int error, len;
+ 	__u8 __name[NCP_MAXPATHLEN + 1];
+ 
++	pax_track_stack();
++
+ 	DPRINTK("ncp_mkdir: making %s/%s\n",
+ 		dentry->d_parent->d_name.name, dentry->d_name.name);
+ 
+@@ -1135,6 +1143,8 @@ static int ncp_rename(struct inode *old_
+ 	int old_len, new_len;
+ 	__u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
+ 
++	pax_track_stack();
++
+ 	DPRINTK("ncp_rename: %s/%s to %s/%s\n",
+ 		old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
+ 		new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
+diff -urNp linux-2.6.38.7/fs/ncpfs/inode.c linux-2.6.38.7/fs/ncpfs/inode.c
+--- linux-2.6.38.7/fs/ncpfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ncpfs/inode.c	2011-05-16 21:47:09.000000000 -0400
+@@ -461,6 +461,8 @@ static int ncp_fill_super(struct super_b
+ #endif
+ 	struct ncp_entry_info finfo;
+ 
++	pax_track_stack();
++
+ 	data.wdog_pid = NULL;
+ 	server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
+ 	if (!server)
+diff -urNp linux-2.6.38.7/fs/nfs/inode.c linux-2.6.38.7/fs/nfs/inode.c
+--- linux-2.6.38.7/fs/nfs/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/nfs/inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -998,16 +998,16 @@ static int nfs_size_need_update(const st
  	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
  }
@@ -32568,283 +40755,10 @@ diff -urNp linux-2.6.38.2/fs/nfs/inode.c linux-2.6.38.2/fs/nfs/inode.c
  }
  
  void nfs_fattr_init(struct nfs_fattr *fattr)
-diff -urNp linux-2.6.38.2/fs/nfs/nfs4proc.c linux-2.6.38.2/fs/nfs/nfs4proc.c
---- linux-2.6.38.2/fs/nfs/nfs4proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nfs/nfs4proc.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1198,7 +1198,7 @@ static int _nfs4_do_open_reclaim(struct 
- static int nfs4_do_open_reclaim(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_do_open_reclaim(ctx, state);
-@@ -1240,7 +1240,7 @@ static int _nfs4_open_delegation_recall(
- 
- int nfs4_open_delegation_recall(struct nfs_open_context *ctx, struct nfs4_state *state, const nfs4_stateid *stateid)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs_server *server = NFS_SERVER(state->inode);
- 	int err;
- 	do {
-@@ -1615,7 +1615,7 @@ static int _nfs4_open_expired(struct nfs
- static int nfs4_do_open_expired(struct nfs_open_context *ctx, struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -1730,7 +1730,7 @@ out_err:
- 
- static struct nfs4_state *nfs4_do_open(struct inode *dir, struct path *path, fmode_t fmode, int flags, struct iattr *sattr, struct rpc_cred *cred)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	struct nfs4_state *res;
- 	int status;
- 
-@@ -1821,7 +1821,7 @@ static int nfs4_do_setattr(struct inode 
- 			   struct nfs4_state *state)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2111,7 +2111,7 @@ static int _nfs4_server_capabilities(str
- 
- int nfs4_server_capabilities(struct nfs_server *server, struct nfs_fh *fhandle)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2145,7 +2145,7 @@ static int _nfs4_lookup_root(struct nfs_
- static int nfs4_lookup_root(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_fsinfo *info)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2233,7 +2233,7 @@ static int _nfs4_proc_getattr(struct nfs
- 
- static int nfs4_proc_getattr(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -2321,7 +2321,7 @@ static int nfs4_proc_lookupfh(struct nfs
- 			      struct qstr *name, struct nfs_fh *fhandle,
- 			      struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_lookupfh(server, dirfh, name, fhandle, fattr);
-@@ -2350,7 +2350,7 @@ static int _nfs4_proc_lookup(struct inod
- 
- static int nfs4_proc_lookup(struct inode *dir, struct qstr *name, struct nfs_fh *fhandle, struct nfs_fattr *fattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2417,7 +2417,7 @@ static int _nfs4_proc_access(struct inod
- 
- static int nfs4_proc_access(struct inode *inode, struct nfs_access_entry *entry)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2473,7 +2473,7 @@ static int _nfs4_proc_readlink(struct in
- static int nfs4_proc_readlink(struct inode *inode, struct page *page,
- 		unsigned int pgbase, unsigned int pglen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2568,7 +2568,7 @@ out:
- 
- static int nfs4_proc_remove(struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2673,7 +2673,7 @@ out:
- static int nfs4_proc_rename(struct inode *old_dir, struct qstr *old_name,
- 		struct inode *new_dir, struct qstr *new_name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(old_dir),
-@@ -2722,7 +2722,7 @@ out:
- 
- static int nfs4_proc_link(struct inode *inode, struct inode *dir, struct qstr *name)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -2814,7 +2814,7 @@ out:
- static int nfs4_proc_symlink(struct inode *dir, struct dentry *dentry,
- 		struct page *page, unsigned int len, struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dir),
-@@ -2845,7 +2845,7 @@ out:
- static int nfs4_proc_mkdir(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	sattr->ia_mode &= ~current_umask();
-@@ -2899,7 +2899,7 @@ static int _nfs4_proc_readdir(struct den
- static int nfs4_proc_readdir(struct dentry *dentry, struct rpc_cred *cred,
- 		u64 cookie, struct page **pages, unsigned int count, int plus)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(dentry->d_inode),
-@@ -2947,7 +2947,7 @@ out:
- static int nfs4_proc_mknod(struct inode *dir, struct dentry *dentry,
- 		struct iattr *sattr, dev_t rdev)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	sattr->ia_mode &= ~current_umask();
-@@ -2981,7 +2981,7 @@ static int _nfs4_proc_statfs(struct nfs_
- 
- static int nfs4_proc_statfs(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsstat *fsstat)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(server,
-@@ -3012,7 +3012,7 @@ static int _nfs4_do_fsinfo(struct nfs_se
- 
- static int nfs4_do_fsinfo(struct nfs_server *server, struct nfs_fh *fhandle, struct nfs_fsinfo *fsinfo)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -3058,7 +3058,7 @@ static int _nfs4_proc_pathconf(struct nf
- static int nfs4_proc_pathconf(struct nfs_server *server, struct nfs_fh *fhandle,
- 		struct nfs_pathconf *pathconf)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -3404,7 +3404,7 @@ out_free:
- 
- static ssize_t nfs4_get_acl_uncached(struct inode *inode, void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	ssize_t ret;
- 	do {
- 		ret = __nfs4_get_acl_uncached(inode, buf, buflen);
-@@ -3479,7 +3479,7 @@ static int __nfs4_proc_set_acl(struct in
- 
- static int nfs4_proc_set_acl(struct inode *inode, const void *buf, size_t buflen)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = nfs4_handle_exception(NFS_SERVER(inode),
-@@ -3760,7 +3760,7 @@ out:
- int nfs4_proc_delegreturn(struct inode *inode, struct rpc_cred *cred, const nfs4_stateid *stateid, int issync)
- {
- 	struct nfs_server *server = NFS_SERVER(inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 	do {
- 		err = _nfs4_proc_delegreturn(inode, cred, stateid, issync);
-@@ -3834,7 +3834,7 @@ out:
- 
- static int nfs4_proc_getlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4239,7 +4239,7 @@ static int _nfs4_do_setlk(struct nfs4_st
- static int nfs4_lock_reclaim(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4257,7 +4257,7 @@ static int nfs4_lock_reclaim(struct nfs4
- static int nfs4_lock_expired(struct nfs4_state *state, struct file_lock *request)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, request);
-@@ -4321,7 +4321,7 @@ out:
- 
- static int nfs4_proc_setlk(struct nfs4_state *state, int cmd, struct file_lock *request)
- {
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	do {
-@@ -4381,7 +4381,7 @@ nfs4_proc_lock(struct file *filp, int cm
- int nfs4_lock_delegation_recall(struct nfs4_state *state, struct file_lock *fl)
- {
- 	struct nfs_server *server = NFS_SERVER(state->inode);
--	struct nfs4_exception exception = { };
-+	struct nfs4_exception exception = {0, 0};
- 	int err;
- 
- 	err = nfs4_set_lock_state(state, fl);
-diff -urNp linux-2.6.38.2/fs/nfsd/lockd.c linux-2.6.38.2/fs/nfsd/lockd.c
---- linux-2.6.38.2/fs/nfsd/lockd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nfsd/lockd.c	2011-03-21 18:31:35.000000000 -0400
-@@ -61,7 +61,7 @@ nlm_fclose(struct file *filp)
+diff -urNp linux-2.6.38.7/fs/nfsd/lockd.c linux-2.6.38.7/fs/nfsd/lockd.c
+--- linux-2.6.38.7/fs/nfsd/lockd.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/fs/nfsd/lockd.c	2011-04-28 19:34:15.000000000 -0400
+@@ -60,7 +60,7 @@ nlm_fclose(struct file *filp)
  	fput(filp);
  }
  
@@ -32853,9 +40767,33 @@ diff -urNp linux-2.6.38.2/fs/nfsd/lockd.c linux-2.6.38.2/fs/nfsd/lockd.c
  	.fopen		= nlm_fopen,		/* open file for locking */
  	.fclose		= nlm_fclose,		/* close file */
  };
-diff -urNp linux-2.6.38.2/fs/nfsd/nfsctl.c linux-2.6.38.2/fs/nfsd/nfsctl.c
---- linux-2.6.38.2/fs/nfsd/nfsctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nfsd/nfsctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/nfsd/nfs4state.c linux-2.6.38.7/fs/nfsd/nfs4state.c
+--- linux-2.6.38.7/fs/nfsd/nfs4state.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/fs/nfsd/nfs4state.c	2011-05-16 21:47:09.000000000 -0400
+@@ -3783,6 +3783,8 @@ nfsd4_lock(struct svc_rqst *rqstp, struc
+ 	unsigned int strhashval;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
+ 		(long long) lock->lk_offset,
+ 		(long long) lock->lk_length);
+diff -urNp linux-2.6.38.7/fs/nfsd/nfs4xdr.c linux-2.6.38.7/fs/nfsd/nfs4xdr.c
+--- linux-2.6.38.7/fs/nfsd/nfs4xdr.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/fs/nfsd/nfs4xdr.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1793,6 +1793,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, s
+ 		.dentry	= dentry,
+ 	};
+ 
++	pax_track_stack();
++
+ 	BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
+ 	BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
+ 	BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
+diff -urNp linux-2.6.38.7/fs/nfsd/nfsctl.c linux-2.6.38.7/fs/nfsd/nfsctl.c
+--- linux-2.6.38.7/fs/nfsd/nfsctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/nfsd/nfsctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -180,7 +180,7 @@ static int export_features_open(struct i
  	return single_open(file, export_features_show, NULL);
  }
@@ -32865,9 +40803,9 @@ diff -urNp linux-2.6.38.2/fs/nfsd/nfsctl.c linux-2.6.38.2/fs/nfsd/nfsctl.c
  	.open		= export_features_open,
  	.read		= seq_read,
  	.llseek		= seq_lseek,
-diff -urNp linux-2.6.38.2/fs/nfsd/vfs.c linux-2.6.38.2/fs/nfsd/vfs.c
---- linux-2.6.38.2/fs/nfsd/vfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nfsd/vfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/nfsd/vfs.c linux-2.6.38.7/fs/nfsd/vfs.c
+--- linux-2.6.38.7/fs/nfsd/vfs.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/fs/nfsd/vfs.c	2011-05-10 22:08:57.000000000 -0400
 @@ -898,7 +898,7 @@ nfsd_vfs_read(struct svc_rqst *rqstp, st
  	} else {
  		oldfs = get_fs();
@@ -32886,7 +40824,7 @@ diff -urNp linux-2.6.38.2/fs/nfsd/vfs.c linux-2.6.38.2/fs/nfsd/vfs.c
  	set_fs(oldfs);
  	if (host_err < 0)
  		goto out_nfserr;
-@@ -1518,7 +1518,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
+@@ -1525,7 +1525,7 @@ nfsd_readlink(struct svc_rqst *rqstp, st
  	 */
  
  	oldfs = get_fs(); set_fs(KERNEL_DS);
@@ -32895,21 +40833,42 @@ diff -urNp linux-2.6.38.2/fs/nfsd/vfs.c linux-2.6.38.2/fs/nfsd/vfs.c
  	set_fs(oldfs);
  
  	if (host_err < 0)
-diff -urNp linux-2.6.38.2/fs/nls/nls_base.c linux-2.6.38.2/fs/nls/nls_base.c
---- linux-2.6.38.2/fs/nls/nls_base.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/nls/nls_base.c	2011-03-21 18:31:35.000000000 -0400
-@@ -41,7 +41,7 @@ static const struct utf8_table utf8_tabl
-     {0xF8,  0xF0,   3*6,    0x1FFFFF,       0x10000,   /* 4 byte sequence */},
-     {0xFC,  0xF8,   4*6,    0x3FFFFFF,      0x200000,  /* 5 byte sequence */},
-     {0xFE,  0xFC,   5*6,    0x7FFFFFFF,     0x4000000, /* 6 byte sequence */},
--    {0,						       /* end of table    */}
-+    {0, 0, 0, 0, 0,				       /* end of table    */}
- };
- 
- #define UNICODE_MAX	0x0010ffff
-diff -urNp linux-2.6.38.2/fs/ntfs/dir.c linux-2.6.38.2/fs/ntfs/dir.c
---- linux-2.6.38.2/fs/ntfs/dir.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ntfs/dir.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/notify/dnotify/dnotify.c linux-2.6.38.7/fs/notify/dnotify/dnotify.c
+--- linux-2.6.38.7/fs/notify/dnotify/dnotify.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/notify/dnotify/dnotify.c	2011-04-28 19:34:15.000000000 -0400
+@@ -151,7 +151,7 @@ static void dnotify_free_mark(struct fsn
+ 	kmem_cache_free(dnotify_mark_cache, dn_mark);
+ }
+ 
+-static struct fsnotify_ops dnotify_fsnotify_ops = {
++static const struct fsnotify_ops dnotify_fsnotify_ops = {
+ 	.handle_event = dnotify_handle_event,
+ 	.should_send_event = dnotify_should_send_event,
+ 	.free_group_priv = NULL,
+diff -urNp linux-2.6.38.7/fs/notify/notification.c linux-2.6.38.7/fs/notify/notification.c
+--- linux-2.6.38.7/fs/notify/notification.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/notify/notification.c	2011-04-28 19:57:25.000000000 -0400
+@@ -57,7 +57,7 @@ static struct kmem_cache *fsnotify_event
+  * get set to 0 so it will never get 'freed'
+  */
+ static struct fsnotify_event *q_overflow_event;
+-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
++static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
+ 
+ /**
+  * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
+@@ -65,7 +65,7 @@ static atomic_t fsnotify_sync_cookie = A
+  */
+ u32 fsnotify_get_cookie(void)
+ {
+-	return atomic_inc_return(&fsnotify_sync_cookie);
++	return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
+ }
+ EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
+ 
+diff -urNp linux-2.6.38.7/fs/ntfs/dir.c linux-2.6.38.7/fs/ntfs/dir.c
+--- linux-2.6.38.7/fs/ntfs/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ntfs/dir.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1329,7 +1329,7 @@ find_next_index_buffer:
  	ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
  			~(s64)(ndir->itype.index.block_size - 1)));
@@ -32919,9 +40878,9 @@ diff -urNp linux-2.6.38.2/fs/ntfs/dir.c linux-2.6.38.2/fs/ntfs/dir.c
  		ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
  				"inode 0x%lx or driver bug.", vdir->i_ino);
  		goto err_out;
-diff -urNp linux-2.6.38.2/fs/ntfs/file.c linux-2.6.38.2/fs/ntfs/file.c
---- linux-2.6.38.2/fs/ntfs/file.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ntfs/file.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ntfs/file.c linux-2.6.38.7/fs/ntfs/file.c
+--- linux-2.6.38.7/fs/ntfs/file.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ntfs/file.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2222,6 +2222,6 @@ const struct inode_operations ntfs_file_
  #endif /* NTFS_RW */
  };
@@ -32931,9 +40890,9 @@ diff -urNp linux-2.6.38.2/fs/ntfs/file.c linux-2.6.38.2/fs/ntfs/file.c
  
 -const struct inode_operations ntfs_empty_inode_ops = {};
 +const struct inode_operations ntfs_empty_inode_ops __read_only;
-diff -urNp linux-2.6.38.2/fs/ocfs2/localalloc.c linux-2.6.38.2/fs/ocfs2/localalloc.c
---- linux-2.6.38.2/fs/ocfs2/localalloc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ocfs2/localalloc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ocfs2/localalloc.c linux-2.6.38.7/fs/ocfs2/localalloc.c
+--- linux-2.6.38.7/fs/ocfs2/localalloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/localalloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1307,7 +1307,7 @@ static int ocfs2_local_alloc_slide_windo
  		goto bail;
  	}
@@ -32943,9 +40902,21 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/localalloc.c linux-2.6.38.2/fs/ocfs2/localall
  
  bail:
  	if (handle)
-diff -urNp linux-2.6.38.2/fs/ocfs2/ocfs2.h linux-2.6.38.2/fs/ocfs2/ocfs2.h
---- linux-2.6.38.2/fs/ocfs2/ocfs2.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ocfs2/ocfs2.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ocfs2/namei.c linux-2.6.38.7/fs/ocfs2/namei.c
+--- linux-2.6.38.7/fs/ocfs2/namei.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/namei.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1064,6 +1064,8 @@ static int ocfs2_rename(struct inode *ol
+ 	struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
+ 	struct ocfs2_dir_lookup_result target_insert = { NULL, };
+ 
++	pax_track_stack();
++
+ 	/* At some point it might be nice to break this function up a
+ 	 * bit. */
+ 
+diff -urNp linux-2.6.38.7/fs/ocfs2/ocfs2.h linux-2.6.38.7/fs/ocfs2/ocfs2.h
+--- linux-2.6.38.7/fs/ocfs2/ocfs2.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/ocfs2.h	2011-04-28 19:34:15.000000000 -0400
 @@ -230,11 +230,11 @@ enum ocfs2_vol_state
  
  struct ocfs2_alloc_stats
@@ -32963,9 +40934,9 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/ocfs2.h linux-2.6.38.2/fs/ocfs2/ocfs2.h
  };
  
  enum ocfs2_local_alloc_state
-diff -urNp linux-2.6.38.2/fs/ocfs2/suballoc.c linux-2.6.38.2/fs/ocfs2/suballoc.c
---- linux-2.6.38.2/fs/ocfs2/suballoc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ocfs2/suballoc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ocfs2/suballoc.c linux-2.6.38.7/fs/ocfs2/suballoc.c
+--- linux-2.6.38.7/fs/ocfs2/suballoc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/suballoc.c	2011-05-11 18:34:57.000000000 -0400
 @@ -877,7 +877,7 @@ static int ocfs2_reserve_suballoc_bits(s
  				mlog_errno(status);
  			goto bail;
@@ -32984,6 +40955,15 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/suballoc.c linux-2.6.38.2/fs/ocfs2/suballoc.c
  
  	*suballoc_loc = res.sr_bg_blkno;
  	*suballoc_bit_start = res.sr_bit_offset;
+@@ -2175,7 +2175,7 @@ int ocfs2_claim_new_inode_at_loc(handle_
+ 	mlog(0, "Allocated %u bits from suballocator %llu\n", res->sr_bits,
+ 	     (unsigned long long)di_blkno);
+ 
+-	atomic_inc(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
++	atomic_inc_unchecked(&OCFS2_SB(ac->ac_inode->i_sb)->alloc_stats.bg_allocs);
+ 
+ 	BUG_ON(res->sr_bits != 1);
+ 
 @@ -2219,7 +2219,7 @@ int ocfs2_claim_new_inode(handle_t *hand
  		mlog_errno(status);
  		goto bail;
@@ -33011,9 +40991,9 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/suballoc.c linux-2.6.38.2/fs/ocfs2/suballoc.c
  			*num_clusters = res.sr_bits;
  		}
  	}
-diff -urNp linux-2.6.38.2/fs/ocfs2/super.c linux-2.6.38.2/fs/ocfs2/super.c
---- linux-2.6.38.2/fs/ocfs2/super.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ocfs2/super.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ocfs2/super.c linux-2.6.38.7/fs/ocfs2/super.c
+--- linux-2.6.38.7/fs/ocfs2/super.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/super.c	2011-04-28 19:34:15.000000000 -0400
 @@ -297,11 +297,11 @@ static int ocfs2_osb_dump(struct ocfs2_s
  			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
  			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
@@ -33048,9 +41028,9 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/super.c linux-2.6.38.2/fs/ocfs2/super.c
  
  	/* Copy the blockcheck stats from the superblock probe */
  	osb->osb_ecc_stats = *stats;
-diff -urNp linux-2.6.38.2/fs/ocfs2/symlink.c linux-2.6.38.2/fs/ocfs2/symlink.c
---- linux-2.6.38.2/fs/ocfs2/symlink.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ocfs2/symlink.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/ocfs2/symlink.c linux-2.6.38.7/fs/ocfs2/symlink.c
+--- linux-2.6.38.7/fs/ocfs2/symlink.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/ocfs2/symlink.c	2011-04-28 19:34:15.000000000 -0400
 @@ -148,7 +148,7 @@ bail:
  
  static void ocfs2_fast_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
@@ -33060,9 +41040,9 @@ diff -urNp linux-2.6.38.2/fs/ocfs2/symlink.c linux-2.6.38.2/fs/ocfs2/symlink.c
  	if (!IS_ERR(link))
  		kfree(link);
  }
-diff -urNp linux-2.6.38.2/fs/open.c linux-2.6.38.2/fs/open.c
---- linux-2.6.38.2/fs/open.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/open.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/open.c linux-2.6.38.7/fs/open.c
+--- linux-2.6.38.7/fs/open.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/open.c	2011-04-28 19:34:15.000000000 -0400
 @@ -112,6 +112,10 @@ static long do_sys_truncate(const char _
  	error = locks_verify_truncate(inode, NULL, length);
  	if (!error)
@@ -33200,10 +41180,18 @@ diff -urNp linux-2.6.38.2/fs/open.c linux-2.6.38.2/fs/open.c
  			if (IS_ERR(f)) {
  				put_unused_fd(fd);
  				fd = PTR_ERR(f);
-diff -urNp linux-2.6.38.2/fs/partitions/ldm.c linux-2.6.38.2/fs/partitions/ldm.c
---- linux-2.6.38.2/fs/partitions/ldm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/partitions/ldm.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1313,7 +1313,7 @@ static bool ldm_frag_add (const u8 *data
+diff -urNp linux-2.6.38.7/fs/partitions/ldm.c linux-2.6.38.7/fs/partitions/ldm.c
+--- linux-2.6.38.7/fs/partitions/ldm.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/fs/partitions/ldm.c	2011-04-28 19:34:15.000000000 -0400
+@@ -1311,6 +1311,7 @@ static bool ldm_frag_add (const u8 *data
+ 		ldm_error ("A VBLK claims to have %d parts.", num);
+ 		return false;
+ 	}
++
+ 	if (rec >= num) {
+ 		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
+ 		return false;
+@@ -1322,7 +1323,7 @@ static bool ldm_frag_add (const u8 *data
  			goto found;
  	}
  
@@ -33212,9 +41200,9 @@ diff -urNp linux-2.6.38.2/fs/partitions/ldm.c linux-2.6.38.2/fs/partitions/ldm.c
  	if (!f) {
  		ldm_crit ("Out of memory.");
  		return false;
-diff -urNp linux-2.6.38.2/fs/pipe.c linux-2.6.38.2/fs/pipe.c
---- linux-2.6.38.2/fs/pipe.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/pipe.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/pipe.c linux-2.6.38.7/fs/pipe.c
+--- linux-2.6.38.7/fs/pipe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/pipe.c	2011-04-28 19:34:15.000000000 -0400
 @@ -420,9 +420,9 @@ redo:
  		}
  		if (bufs)	/* More to do? */
@@ -33338,9 +41326,9 @@ diff -urNp linux-2.6.38.2/fs/pipe.c linux-2.6.38.2/fs/pipe.c
  	inode->i_fop = &rdwr_pipefifo_fops;
  
  	/*
-diff -urNp linux-2.6.38.2/fs/proc/array.c linux-2.6.38.2/fs/proc/array.c
---- linux-2.6.38.2/fs/proc/array.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/array.c	2011-03-28 17:48:30.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/array.c linux-2.6.38.7/fs/proc/array.c
+--- linux-2.6.38.7/fs/proc/array.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/fs/proc/array.c	2011-05-16 21:47:08.000000000 -0400
 @@ -60,6 +60,7 @@
  #include <linux/tty.h>
  #include <linux/string.h>
@@ -33396,7 +41384,20 @@ diff -urNp linux-2.6.38.2/fs/proc/array.c linux-2.6.38.2/fs/proc/array.c
  static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
  			struct pid *pid, struct task_struct *task, int whole)
  {
-@@ -449,6 +480,19 @@ static int do_task_stat(struct seq_file 
+@@ -375,9 +406,11 @@ static int do_task_stat(struct seq_file 
+ 	cputime_t cutime, cstime, utime, stime;
+ 	cputime_t cgtime, gtime;
+ 	unsigned long rsslim = 0;
+-	char tcomm[sizeof(task->comm)];
++	char tcomm[sizeof(task->comm)] = { 0 };
+ 	unsigned long flags;
+ 
++	pax_track_stack();
++
+ 	state = *get_task_state(task);
+ 	vsize = eip = esp = 0;
+ 	permitted = ptrace_may_access(task, PTRACE_MODE_READ);
+@@ -449,6 +482,19 @@ static int do_task_stat(struct seq_file 
  		gtime = task->gtime;
  	}
  
@@ -33416,7 +41417,7 @@ diff -urNp linux-2.6.38.2/fs/proc/array.c linux-2.6.38.2/fs/proc/array.c
  	/* scale priority and nice values from timeslices to -20..20 */
  	/* to make it look like a "normal" Unix priority/nice value  */
  	priority = task_prio(task);
-@@ -489,9 +533,15 @@ static int do_task_stat(struct seq_file 
+@@ -489,9 +535,15 @@ static int do_task_stat(struct seq_file 
  		vsize,
  		mm ? get_mm_rss(mm) : 0,
  		rsslim,
@@ -33432,7 +41433,7 @@ diff -urNp linux-2.6.38.2/fs/proc/array.c linux-2.6.38.2/fs/proc/array.c
  		esp,
  		eip,
  		/* The signal information here is obsolete.
-@@ -544,3 +594,10 @@ int proc_pid_statm(struct seq_file *m, s
+@@ -544,3 +596,18 @@ int proc_pid_statm(struct seq_file *m, s
  
  	return 0;
  }
@@ -33440,12 +41441,20 @@ diff -urNp linux-2.6.38.2/fs/proc/array.c linux-2.6.38.2/fs/proc/array.c
 +#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
 +int proc_pid_ipaddr(struct task_struct *task, char *buffer)
 +{
-+	return sprintf(buffer, "%pI4\n", &task->signal->curr_ip);
++	u32 curr_ip = 0;
++	unsigned long flags;
++
++	if (lock_task_sighand(task, &flags)) {
++		curr_ip = task->signal->curr_ip;
++		unlock_task_sighand(task, &flags);
++	}
++
++	return sprintf(buffer, "%pI4\n", &curr_ip);
 +}
 +#endif
-diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
---- linux-2.6.38.2/fs/proc/base.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/base.c	2011-03-26 11:59:10.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/base.c linux-2.6.38.7/fs/proc/base.c
+--- linux-2.6.38.7/fs/proc/base.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/fs/proc/base.c	2011-04-28 19:34:15.000000000 -0400
 @@ -104,6 +104,22 @@ struct pid_entry {
  	union proc_op op;
  };
@@ -33813,8 +41822,8 @@ diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
  	return result;
 @@ -3068,6 +3191,11 @@ int proc_pid_readdir(struct file * filp,
  {
- 	unsigned int nr = filp->f_pos - FIRST_PROCESS_ENTRY;
- 	struct task_struct *reaper = get_proc_task(filp->f_path.dentry->d_inode);
+ 	unsigned int nr;
+ 	struct task_struct *reaper;
 +#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
 +	const struct cred *tmpcred = current_cred();
 +	const struct cred *itercred;
@@ -33823,7 +41832,7 @@ diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
  	struct tgid_iter iter;
  	struct pid_namespace *ns;
  
-@@ -3086,8 +3214,27 @@ int proc_pid_readdir(struct file * filp,
+@@ -3091,8 +3219,27 @@ int proc_pid_readdir(struct file * filp,
  	for (iter = next_tgid(ns, iter);
  	     iter.task;
  	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
@@ -33852,7 +41861,7 @@ diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
  			put_task_struct(iter.task);
  			goto out;
  		}
-@@ -3114,7 +3261,7 @@ static const struct pid_entry tid_base_s
+@@ -3119,7 +3266,7 @@ static const struct pid_entry tid_base_s
  	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
  #endif
  	REG("comm",      S_IRUGO|S_IWUSR, proc_pid_set_comm_operations),
@@ -33861,7 +41870,7 @@ diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
  	INF("syscall",   S_IRUSR, proc_pid_syscall),
  #endif
  	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
-@@ -3138,10 +3285,10 @@ static const struct pid_entry tid_base_s
+@@ -3143,10 +3290,10 @@ static const struct pid_entry tid_base_s
  #ifdef CONFIG_SECURITY
  	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
  #endif
@@ -33874,9 +41883,9 @@ diff -urNp linux-2.6.38.2/fs/proc/base.c linux-2.6.38.2/fs/proc/base.c
  	ONE("stack",      S_IRUSR, proc_pid_stack),
  #endif
  #ifdef CONFIG_SCHEDSTATS
-diff -urNp linux-2.6.38.2/fs/proc/cmdline.c linux-2.6.38.2/fs/proc/cmdline.c
---- linux-2.6.38.2/fs/proc/cmdline.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/cmdline.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/cmdline.c linux-2.6.38.7/fs/proc/cmdline.c
+--- linux-2.6.38.7/fs/proc/cmdline.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/cmdline.c	2011-04-28 19:34:15.000000000 -0400
 @@ -23,7 +23,11 @@ static const struct file_operations cmdl
  
  static int __init proc_cmdline_init(void)
@@ -33889,9 +41898,9 @@ diff -urNp linux-2.6.38.2/fs/proc/cmdline.c linux-2.6.38.2/fs/proc/cmdline.c
  	return 0;
  }
  module_init(proc_cmdline_init);
-diff -urNp linux-2.6.38.2/fs/proc/devices.c linux-2.6.38.2/fs/proc/devices.c
---- linux-2.6.38.2/fs/proc/devices.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/devices.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/devices.c linux-2.6.38.7/fs/proc/devices.c
+--- linux-2.6.38.7/fs/proc/devices.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/devices.c	2011-04-28 19:34:15.000000000 -0400
 @@ -64,7 +64,11 @@ static const struct file_operations proc
  
  static int __init proc_devices_init(void)
@@ -33904,9 +41913,9 @@ diff -urNp linux-2.6.38.2/fs/proc/devices.c linux-2.6.38.2/fs/proc/devices.c
  	return 0;
  }
  module_init(proc_devices_init);
-diff -urNp linux-2.6.38.2/fs/proc/inode.c linux-2.6.38.2/fs/proc/inode.c
---- linux-2.6.38.2/fs/proc/inode.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/inode.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/inode.c linux-2.6.38.7/fs/proc/inode.c
+--- linux-2.6.38.7/fs/proc/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/inode.c	2011-04-28 19:34:15.000000000 -0400
 @@ -435,7 +435,11 @@ struct inode *proc_get_inode(struct supe
  		if (de->mode) {
  			inode->i_mode = de->mode;
@@ -33919,9 +41928,9 @@ diff -urNp linux-2.6.38.2/fs/proc/inode.c linux-2.6.38.2/fs/proc/inode.c
  		}
  		if (de->size)
  			inode->i_size = de->size;
-diff -urNp linux-2.6.38.2/fs/proc/internal.h linux-2.6.38.2/fs/proc/internal.h
---- linux-2.6.38.2/fs/proc/internal.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/internal.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/internal.h linux-2.6.38.7/fs/proc/internal.h
+--- linux-2.6.38.7/fs/proc/internal.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/internal.h	2011-04-28 19:34:15.000000000 -0400
 @@ -51,6 +51,9 @@ extern int proc_pid_status(struct seq_fi
  				struct pid *pid, struct task_struct *task);
  extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
@@ -33932,9 +41941,9 @@ diff -urNp linux-2.6.38.2/fs/proc/internal.h linux-2.6.38.2/fs/proc/internal.h
  extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
  
  extern const struct file_operations proc_maps_operations;
-diff -urNp linux-2.6.38.2/fs/proc/Kconfig linux-2.6.38.2/fs/proc/Kconfig
---- linux-2.6.38.2/fs/proc/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/Kconfig linux-2.6.38.7/fs/proc/Kconfig
+--- linux-2.6.38.7/fs/proc/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/Kconfig	2011-04-28 19:34:15.000000000 -0400
 @@ -30,12 +30,12 @@ config PROC_FS
  
  config PROC_KCORE
@@ -33962,10 +41971,19 @@ diff -urNp linux-2.6.38.2/fs/proc/Kconfig linux-2.6.38.2/fs/proc/Kconfig
  	bool "Enable /proc page monitoring" if EXPERT
   	help
  	  Various /proc files exist to monitor process memory utilization:
-diff -urNp linux-2.6.38.2/fs/proc/kcore.c linux-2.6.38.2/fs/proc/kcore.c
---- linux-2.6.38.2/fs/proc/kcore.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/kcore.c	2011-03-21 18:31:35.000000000 -0400
-@@ -478,9 +478,10 @@ read_kcore(struct file *file, char __use
+diff -urNp linux-2.6.38.7/fs/proc/kcore.c linux-2.6.38.7/fs/proc/kcore.c
+--- linux-2.6.38.7/fs/proc/kcore.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/kcore.c	2011-05-16 21:47:08.000000000 -0400
+@@ -321,6 +321,8 @@ static void elf_kcore_store_hdr(char *bu
+ 	off_t offset = 0;
+ 	struct kcore_list *m;
+ 
++	pax_track_stack();
++
+ 	/* setup ELF header */
+ 	elf = (struct elfhdr *) bufp;
+ 	bufp += sizeof(struct elfhdr);
+@@ -478,9 +480,10 @@ read_kcore(struct file *file, char __use
  	 * the addresses in the elf_phdr on our list.
  	 */
  	start = kc_offset_to_vaddr(*fpos - elf_buflen);
@@ -33978,7 +41996,7 @@ diff -urNp linux-2.6.38.2/fs/proc/kcore.c linux-2.6.38.2/fs/proc/kcore.c
  	while (buflen) {
  		struct kcore_list *m;
  
-@@ -509,20 +510,23 @@ read_kcore(struct file *file, char __use
+@@ -509,20 +512,23 @@ read_kcore(struct file *file, char __use
  			kfree(elf_buf);
  		} else {
  			if (kern_addr_valid(start)) {
@@ -34013,7 +42031,7 @@ diff -urNp linux-2.6.38.2/fs/proc/kcore.c linux-2.6.38.2/fs/proc/kcore.c
  			} else {
  				if (clear_user(buffer, tsz))
  					return -EFAULT;
-@@ -542,6 +546,9 @@ read_kcore(struct file *file, char __use
+@@ -542,6 +548,9 @@ read_kcore(struct file *file, char __use
  
  static int open_kcore(struct inode *inode, struct file *filp)
  {
@@ -34023,10 +42041,19 @@ diff -urNp linux-2.6.38.2/fs/proc/kcore.c linux-2.6.38.2/fs/proc/kcore.c
  	if (!capable(CAP_SYS_RAWIO))
  		return -EPERM;
  	if (kcore_need_update)
-diff -urNp linux-2.6.38.2/fs/proc/meminfo.c linux-2.6.38.2/fs/proc/meminfo.c
---- linux-2.6.38.2/fs/proc/meminfo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/meminfo.c	2011-03-21 18:31:35.000000000 -0400
-@@ -157,7 +157,7 @@ static int meminfo_proc_show(struct seq_
+diff -urNp linux-2.6.38.7/fs/proc/meminfo.c linux-2.6.38.7/fs/proc/meminfo.c
+--- linux-2.6.38.7/fs/proc/meminfo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/meminfo.c	2011-05-16 21:47:08.000000000 -0400
+@@ -29,6 +29,8 @@ static int meminfo_proc_show(struct seq_
+ 	unsigned long pages[NR_LRU_LISTS];
+ 	int lru;
+ 
++	pax_track_stack();
++
+ /*
+  * display in kilobytes.
+  */
+@@ -157,7 +159,7 @@ static int meminfo_proc_show(struct seq_
  		vmi.used >> 10,
  		vmi.largest_chunk >> 10
  #ifdef CONFIG_MEMORY_FAILURE
@@ -34035,9 +42062,9 @@ diff -urNp linux-2.6.38.2/fs/proc/meminfo.c linux-2.6.38.2/fs/proc/meminfo.c
  #endif
  #ifdef CONFIG_TRANSPARENT_HUGEPAGE
  		,K(global_page_state(NR_ANON_TRANSPARENT_HUGEPAGES) *
-diff -urNp linux-2.6.38.2/fs/proc/nommu.c linux-2.6.38.2/fs/proc/nommu.c
---- linux-2.6.38.2/fs/proc/nommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/nommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/nommu.c linux-2.6.38.7/fs/proc/nommu.c
+--- linux-2.6.38.7/fs/proc/nommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/nommu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -66,7 +66,7 @@ static int nommu_region_show(struct seq_
  		if (len < 1)
  			len = 1;
@@ -34047,9 +42074,9 @@ diff -urNp linux-2.6.38.2/fs/proc/nommu.c linux-2.6.38.2/fs/proc/nommu.c
  	}
  
  	seq_putc(m, '\n');
-diff -urNp linux-2.6.38.2/fs/proc/proc_net.c linux-2.6.38.2/fs/proc/proc_net.c
---- linux-2.6.38.2/fs/proc/proc_net.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/proc_net.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/proc_net.c linux-2.6.38.7/fs/proc/proc_net.c
+--- linux-2.6.38.7/fs/proc/proc_net.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/proc_net.c	2011-04-28 19:34:15.000000000 -0400
 @@ -105,6 +105,17 @@ static struct net *get_proc_task_net(str
  	struct task_struct *task;
  	struct nsproxy *ns;
@@ -34068,9 +42095,9 @@ diff -urNp linux-2.6.38.2/fs/proc/proc_net.c linux-2.6.38.2/fs/proc/proc_net.c
  
  	rcu_read_lock();
  	task = pid_task(proc_pid(dir), PIDTYPE_PID);
-diff -urNp linux-2.6.38.2/fs/proc/proc_sysctl.c linux-2.6.38.2/fs/proc/proc_sysctl.c
---- linux-2.6.38.2/fs/proc/proc_sysctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/proc_sysctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/proc_sysctl.c linux-2.6.38.7/fs/proc/proc_sysctl.c
+--- linux-2.6.38.7/fs/proc/proc_sysctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/proc_sysctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -8,6 +8,8 @@
  #include <linux/namei.h>
  #include "internal.h"
@@ -34110,9 +42137,9 @@ diff -urNp linux-2.6.38.2/fs/proc/proc_sysctl.c linux-2.6.38.2/fs/proc/proc_sysc
  	generic_fillattr(inode, stat);
  	if (table)
  		stat->mode = (stat->mode & S_IFMT) | table->mode;
-diff -urNp linux-2.6.38.2/fs/proc/root.c linux-2.6.38.2/fs/proc/root.c
---- linux-2.6.38.2/fs/proc/root.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/root.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/root.c linux-2.6.38.7/fs/proc/root.c
+--- linux-2.6.38.7/fs/proc/root.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/root.c	2011-04-28 19:34:15.000000000 -0400
 @@ -132,7 +132,15 @@ void __init proc_root_init(void)
  #ifdef CONFIG_PROC_DEVICETREE
  	proc_device_tree_init();
@@ -34129,9 +42156,9 @@ diff -urNp linux-2.6.38.2/fs/proc/root.c linux-2.6.38.2/fs/proc/root.c
  	proc_sys_init();
  }
  
-diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
---- linux-2.6.38.2/fs/proc/task_mmu.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/task_mmu.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/task_mmu.c linux-2.6.38.7/fs/proc/task_mmu.c
+--- linux-2.6.38.7/fs/proc/task_mmu.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/fs/proc/task_mmu.c	2011-05-22 23:06:04.000000000 -0400
 @@ -49,8 +49,13 @@ void task_mem(struct seq_file *m, struct
  		"VmExe:\t%8lu kB\n"
  		"VmLib:\t%8lu kB\n"
@@ -34163,7 +42190,17 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  }
  
  unsigned long task_vsize(struct mm_struct *mm)
-@@ -204,6 +215,12 @@ static int do_maps_open(struct inode *in
+@@ -180,7 +191,8 @@ static void m_stop(struct seq_file *m, v
+ 	struct proc_maps_private *priv = m->private;
+ 	struct vm_area_struct *vma = v;
+ 
+-	vma_stop(priv, vma);
++	if (!IS_ERR(vma))
++		vma_stop(priv, vma);
+ 	if (priv->task)
+ 		put_task_struct(priv->task);
+ }
+@@ -204,6 +216,12 @@ static int do_maps_open(struct inode *in
  	return ret;
  }
  
@@ -34176,32 +42213,35 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
  {
  	struct mm_struct *mm = vma->vm_mm;
-@@ -211,7 +228,6 @@ static void show_map_vma(struct seq_file
+@@ -211,7 +229,6 @@ static void show_map_vma(struct seq_file
  	int flags = vma->vm_flags;
  	unsigned long ino = 0;
  	unsigned long long pgoff = 0;
--	unsigned long start;
+-	unsigned long start, end;
  	dev_t dev = 0;
  	int len;
  
-@@ -222,20 +238,23 @@ static void show_map_vma(struct seq_file
+@@ -222,22 +239,23 @@ static void show_map_vma(struct seq_file
  		pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
  	}
  
 -	/* We don't show the stack guard page in /proc/maps */
 -	start = vma->vm_start;
--	if (vma->vm_flags & VM_GROWSDOWN)
--		if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
--			start += PAGE_SIZE;
+-	if (stack_guard_page_start(vma, start))
+-		start += PAGE_SIZE;
+-	end = vma->vm_end;
+-	if (stack_guard_page_end(vma, end))
+-		end -= PAGE_SIZE;
 -
  	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
 -			start,
+-			end,
 +#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
 +			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
 +			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
 +#else
 +			vma->vm_start,
- 			vma->vm_end,
++			vma->vm_end,
 +#endif
  			flags & VM_READ ? 'r' : '-',
  			flags & VM_WRITE ? 'w' : '-',
@@ -34215,7 +42255,7 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  			MAJOR(dev), MINOR(dev), ino, &len);
  
  	/*
-@@ -244,16 +263,16 @@ static void show_map_vma(struct seq_file
+@@ -246,16 +264,16 @@ static void show_map_vma(struct seq_file
  	 */
  	if (file) {
  		pad_len_spaces(m, len);
@@ -34237,7 +42277,7 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  					name = "[stack]";
  				}
  			} else {
-@@ -399,11 +418,16 @@ static int show_smap(struct seq_file *m,
+@@ -401,11 +419,16 @@ static int show_smap(struct seq_file *m,
  	};
  
  	memset(&mss, 0, sizeof mss);
@@ -34259,7 +42299,7 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  	show_map_vma(m, vma);
  
  	seq_printf(m,
-@@ -420,7 +444,11 @@ static int show_smap(struct seq_file *m,
+@@ -422,7 +445,11 @@ static int show_smap(struct seq_file *m,
  		   "KernelPageSize: %8lu kB\n"
  		   "MMUPageSize:    %8lu kB\n"
  		   "Locked:         %8lu kB\n",
@@ -34271,9 +42311,9 @@ diff -urNp linux-2.6.38.2/fs/proc/task_mmu.c linux-2.6.38.2/fs/proc/task_mmu.c
  		   mss.resident >> 10,
  		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
  		   mss.shared_clean  >> 10,
-diff -urNp linux-2.6.38.2/fs/proc/task_nommu.c linux-2.6.38.2/fs/proc/task_nommu.c
---- linux-2.6.38.2/fs/proc/task_nommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/proc/task_nommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/proc/task_nommu.c linux-2.6.38.7/fs/proc/task_nommu.c
+--- linux-2.6.38.7/fs/proc/task_nommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/proc/task_nommu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -51,7 +51,7 @@ void task_mem(struct seq_file *m, struct
  	else
  		bytes += kobjsize(mm);
@@ -34292,9 +42332,30 @@ diff -urNp linux-2.6.38.2/fs/proc/task_nommu.c linux-2.6.38.2/fs/proc/task_nommu
  	} else if (mm) {
  		if (vma->vm_start <= mm->start_stack &&
  			vma->vm_end >= mm->start_stack) {
-diff -urNp linux-2.6.38.2/fs/readdir.c linux-2.6.38.2/fs/readdir.c
---- linux-2.6.38.2/fs/readdir.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/readdir.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/quota/netlink.c linux-2.6.38.7/fs/quota/netlink.c
+--- linux-2.6.38.7/fs/quota/netlink.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/quota/netlink.c	2011-04-28 19:57:25.000000000 -0400
+@@ -33,7 +33,7 @@ static struct genl_family quota_genl_fam
+ void quota_send_warning(short type, unsigned int id, dev_t dev,
+ 			const char warntype)
+ {
+-	static atomic_t seq;
++	static atomic_unchecked_t seq;
+ 	struct sk_buff *skb;
+ 	void *msg_head;
+ 	int ret;
+@@ -49,7 +49,7 @@ void quota_send_warning(short type, unsi
+ 		  "VFS: Not enough memory to send quota warning.\n");
+ 		return;
+ 	}
+-	msg_head = genlmsg_put(skb, 0, atomic_add_return(1, &seq),
++	msg_head = genlmsg_put(skb, 0, atomic_add_return_unchecked(1, &seq),
+ 			&quota_genl_family, 0, QUOTA_NL_C_WARNING);
+ 	if (!msg_head) {
+ 		printk(KERN_ERR
+diff -urNp linux-2.6.38.7/fs/readdir.c linux-2.6.38.7/fs/readdir.c
+--- linux-2.6.38.7/fs/readdir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/readdir.c	2011-04-28 19:34:15.000000000 -0400
 @@ -17,6 +17,7 @@
  #include <linux/security.h>
  #include <linux/syscalls.h>
@@ -34384,9 +42445,21 @@ diff -urNp linux-2.6.38.2/fs/readdir.c linux-2.6.38.2/fs/readdir.c
  	buf.count = count;
  	buf.error = 0;
  
-diff -urNp linux-2.6.38.2/fs/reiserfs/do_balan.c linux-2.6.38.2/fs/reiserfs/do_balan.c
---- linux-2.6.38.2/fs/reiserfs/do_balan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/reiserfs/do_balan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/reiserfs/dir.c linux-2.6.38.7/fs/reiserfs/dir.c
+--- linux-2.6.38.7/fs/reiserfs/dir.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/dir.c	2011-05-16 21:47:09.000000000 -0400
+@@ -66,6 +66,8 @@ int reiserfs_readdir_dentry(struct dentr
+ 	struct reiserfs_dir_entry de;
+ 	int ret = 0;
+ 
++	pax_track_stack();
++
+ 	reiserfs_write_lock(inode->i_sb);
+ 
+ 	reiserfs_check_lock_depth(inode->i_sb, "readdir");
+diff -urNp linux-2.6.38.7/fs/reiserfs/do_balan.c linux-2.6.38.7/fs/reiserfs/do_balan.c
+--- linux-2.6.38.7/fs/reiserfs/do_balan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/do_balan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2051,7 +2051,7 @@ void do_balance(struct tree_balance *tb,
  		return;
  	}
@@ -34396,9 +42469,9 @@ diff -urNp linux-2.6.38.2/fs/reiserfs/do_balan.c linux-2.6.38.2/fs/reiserfs/do_b
  	do_balance_starts(tb);
  
  	/* balance leaf returns 0 except if combining L R and S into
-diff -urNp linux-2.6.38.2/fs/reiserfs/item_ops.c linux-2.6.38.2/fs/reiserfs/item_ops.c
---- linux-2.6.38.2/fs/reiserfs/item_ops.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/reiserfs/item_ops.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/reiserfs/item_ops.c linux-2.6.38.7/fs/reiserfs/item_ops.c
+--- linux-2.6.38.7/fs/reiserfs/item_ops.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/item_ops.c	2011-04-28 19:34:15.000000000 -0400
 @@ -102,7 +102,7 @@ static void sd_print_vi(struct virtual_i
  			 vi->vi_index, vi->vi_type, vi->vi_ih);
  }
@@ -34453,9 +42526,33 @@ diff -urNp linux-2.6.38.2/fs/reiserfs/item_ops.c linux-2.6.38.2/fs/reiserfs/item
  	&stat_data_ops,
  	&indirect_ops,
  	&direct_ops,
-diff -urNp linux-2.6.38.2/fs/reiserfs/procfs.c linux-2.6.38.2/fs/reiserfs/procfs.c
---- linux-2.6.38.2/fs/reiserfs/procfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/reiserfs/procfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/reiserfs/journal.c linux-2.6.38.7/fs/reiserfs/journal.c
+--- linux-2.6.38.7/fs/reiserfs/journal.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/journal.c	2011-05-16 21:47:09.000000000 -0400
+@@ -2299,6 +2299,8 @@ static struct buffer_head *reiserfs_brea
+ 	struct buffer_head *bh;
+ 	int i, j;
+ 
++	pax_track_stack();
++
+ 	bh = __getblk(dev, block, bufsize);
+ 	if (buffer_uptodate(bh))
+ 		return (bh);
+diff -urNp linux-2.6.38.7/fs/reiserfs/namei.c linux-2.6.38.7/fs/reiserfs/namei.c
+--- linux-2.6.38.7/fs/reiserfs/namei.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/namei.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1228,6 +1228,8 @@ static int reiserfs_rename(struct inode 
+ 	unsigned long savelink = 1;
+ 	struct timespec ctime;
+ 
++	pax_track_stack();
++
+ 	/* three balancings: (1) old name removal, (2) new name insertion
+ 	   and (3) maybe "save" link insertion
+ 	   stat data updates: (1) old directory,
+diff -urNp linux-2.6.38.7/fs/reiserfs/procfs.c linux-2.6.38.7/fs/reiserfs/procfs.c
+--- linux-2.6.38.7/fs/reiserfs/procfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/procfs.c	2011-05-16 21:47:08.000000000 -0400
 @@ -113,7 +113,7 @@ static int show_super(struct seq_file *m
  		   "SMALL_TAILS " : "NO_TAILS ",
  		   replay_only(sb) ? "REPLAY_ONLY " : "",
@@ -34465,9 +42562,78 @@ diff -urNp linux-2.6.38.2/fs/reiserfs/procfs.c linux-2.6.38.2/fs/reiserfs/procfs
  		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
  		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
  		   SF(s_good_search_by_key_reada), SF(s_bmaps),
-diff -urNp linux-2.6.38.2/fs/select.c linux-2.6.38.2/fs/select.c
---- linux-2.6.38.2/fs/select.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/select.c	2011-03-21 18:31:35.000000000 -0400
+@@ -299,6 +299,8 @@ static int show_journal(struct seq_file 
+ 	struct journal_params *jp = &rs->s_v1.s_journal;
+ 	char b[BDEVNAME_SIZE];
+ 
++	pax_track_stack();
++
+ 	seq_printf(m,		/* on-disk fields */
+ 		   "jp_journal_1st_block: \t%i\n"
+ 		   "jp_journal_dev: \t%s[%x]\n"
+diff -urNp linux-2.6.38.7/fs/reiserfs/stree.c linux-2.6.38.7/fs/reiserfs/stree.c
+--- linux-2.6.38.7/fs/reiserfs/stree.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/stree.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1196,6 +1196,8 @@ int reiserfs_delete_item(struct reiserfs
+ 	int iter = 0;
+ #endif
+ 
++	pax_track_stack();
++
+ 	BUG_ON(!th->t_trans_id);
+ 
+ 	init_tb_struct(th, &s_del_balance, sb, path,
+@@ -1333,6 +1335,8 @@ void reiserfs_delete_solid_item(struct r
+ 	int retval;
+ 	int quota_cut_bytes = 0;
+ 
++	pax_track_stack();
++
+ 	BUG_ON(!th->t_trans_id);
+ 
+ 	le_key2cpu_key(&cpu_key, key);
+@@ -1562,6 +1566,8 @@ int reiserfs_cut_from_item(struct reiser
+ 	int quota_cut_bytes;
+ 	loff_t tail_pos = 0;
+ 
++	pax_track_stack();
++
+ 	BUG_ON(!th->t_trans_id);
+ 
+ 	init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
+@@ -1957,6 +1963,8 @@ int reiserfs_paste_into_item(struct reis
+ 	int retval;
+ 	int fs_gen;
+ 
++	pax_track_stack();
++
+ 	BUG_ON(!th->t_trans_id);
+ 
+ 	fs_gen = get_generation(inode->i_sb);
+@@ -2045,6 +2053,8 @@ int reiserfs_insert_item(struct reiserfs
+ 	int fs_gen = 0;
+ 	int quota_bytes = 0;
+ 
++	pax_track_stack();
++
+ 	BUG_ON(!th->t_trans_id);
+ 
+ 	if (inode) {		/* Do we count quotas for item? */
+diff -urNp linux-2.6.38.7/fs/reiserfs/super.c linux-2.6.38.7/fs/reiserfs/super.c
+--- linux-2.6.38.7/fs/reiserfs/super.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/reiserfs/super.c	2011-05-16 21:47:09.000000000 -0400
+@@ -927,6 +927,8 @@ static int reiserfs_parse_options(struct
+ 		{.option_name = NULL}
+ 	};
+ 
++	pax_track_stack();
++
+ 	*blocks = 0;
+ 	if (!options || !*options)
+ 		/* use default configuration: create tails, journaling on, no
+diff -urNp linux-2.6.38.7/fs/select.c linux-2.6.38.7/fs/select.c
+--- linux-2.6.38.7/fs/select.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/select.c	2011-05-16 21:47:08.000000000 -0400
 @@ -20,6 +20,7 @@
  #include <linux/module.h>
  #include <linux/slab.h>
@@ -34476,17 +42642,37 @@ diff -urNp linux-2.6.38.2/fs/select.c linux-2.6.38.2/fs/select.c
  #include <linux/personality.h> /* for STICKY_TIMEOUTS */
  #include <linux/file.h>
  #include <linux/fdtable.h>
-@@ -840,6 +841,7 @@ int do_sys_poll(struct pollfd __user *uf
+@@ -403,6 +404,8 @@ int do_select(int n, fd_set_bits *fds, s
+ 	int retval, i, timed_out = 0;
+ 	unsigned long slack = 0;
+ 
++	pax_track_stack();
++
+ 	rcu_read_lock();
+ 	retval = max_select_fd(n, fds);
+ 	rcu_read_unlock();
+@@ -531,6 +534,8 @@ int core_sys_select(int n, fd_set __user
+ 	/* Allocate small arguments on the stack to save memory and be faster */
+ 	long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
+ 
++	pax_track_stack();
++
+ 	ret = -EINVAL;
+ 	if (n < 0)
+ 		goto out_nofds;
+@@ -840,6 +845,9 @@ int do_sys_poll(struct pollfd __user *uf
   	struct poll_list *walk = head;
   	unsigned long todo = nfds;
  
++	pax_track_stack();
++
 +	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
  	if (nfds > rlimit(RLIMIT_NOFILE))
  		return -EINVAL;
  
-diff -urNp linux-2.6.38.2/fs/seq_file.c linux-2.6.38.2/fs/seq_file.c
---- linux-2.6.38.2/fs/seq_file.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/seq_file.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/seq_file.c linux-2.6.38.7/fs/seq_file.c
+--- linux-2.6.38.7/fs/seq_file.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/seq_file.c	2011-04-28 19:34:15.000000000 -0400
 @@ -76,7 +76,8 @@ static int traverse(struct seq_file *m, 
  		return 0;
  	}
@@ -34527,9 +42713,9 @@ diff -urNp linux-2.6.38.2/fs/seq_file.c linux-2.6.38.2/fs/seq_file.c
  		if (!m->buf)
  			goto Enomem;
  		m->count = 0;
-diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
---- linux-2.6.38.2/fs/splice.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/splice.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/splice.c linux-2.6.38.7/fs/splice.c
+--- linux-2.6.38.7/fs/splice.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/splice.c	2011-05-16 21:47:08.000000000 -0400
 @@ -186,7 +186,7 @@ ssize_t splice_to_pipe(struct pipe_inode
  	pipe_lock(pipe);
  
@@ -34551,7 +42737,16 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  	}
  
  	pipe_unlock(pipe);
-@@ -556,7 +556,7 @@ static ssize_t kernel_readv(struct file 
+@@ -316,6 +316,8 @@ __generic_file_splice_read(struct file *
+ 		.spd_release = spd_release_page,
+ 	};
+ 
++	pax_track_stack();
++
+ 	if (splice_grow_spd(pipe, &spd))
+ 		return -ENOMEM;
+ 
+@@ -556,7 +558,7 @@ static ssize_t kernel_readv(struct file 
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -34560,7 +42755,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  	set_fs(old_fs);
  
  	return res;
-@@ -571,7 +571,7 @@ static ssize_t kernel_write(struct file 
+@@ -571,7 +573,7 @@ static ssize_t kernel_write(struct file 
  	old_fs = get_fs();
  	set_fs(get_ds());
  	/* The cast to a user pointer is valid due to the set_fs() */
@@ -34569,7 +42764,16 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  	set_fs(old_fs);
  
  	return res;
-@@ -622,7 +622,7 @@ ssize_t default_file_splice_read(struct 
+@@ -599,6 +601,8 @@ ssize_t default_file_splice_read(struct 
+ 		.spd_release = spd_release_page,
+ 	};
+ 
++	pax_track_stack();
++
+ 	if (splice_grow_spd(pipe, &spd))
+ 		return -ENOMEM;
+ 
+@@ -622,7 +626,7 @@ ssize_t default_file_splice_read(struct 
  			goto err;
  
  		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
@@ -34578,7 +42782,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  		vec[i].iov_len = this_len;
  		spd.pages[i] = page;
  		spd.nr_pages++;
-@@ -842,10 +842,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
+@@ -842,10 +846,10 @@ EXPORT_SYMBOL(splice_from_pipe_feed);
  int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
  {
  	while (!pipe->nrbufs) {
@@ -34591,7 +42795,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  			return 0;
  
  		if (sd->flags & SPLICE_F_NONBLOCK)
-@@ -1178,7 +1178,7 @@ ssize_t splice_direct_to_actor(struct fi
+@@ -1178,7 +1182,7 @@ ssize_t splice_direct_to_actor(struct fi
  		 * out of the pipe right after the splice_to_pipe(). So set
  		 * PIPE_READERS appropriately.
  		 */
@@ -34600,7 +42804,16 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  
  		current->splice_pipe = pipe;
  	}
-@@ -1730,9 +1730,9 @@ static int ipipe_prep(struct pipe_inode_
+@@ -1615,6 +1619,8 @@ static long vmsplice_to_pipe(struct file
+ 	};
+ 	long ret;
+ 
++	pax_track_stack();
++
+ 	pipe = get_pipe_info(file);
+ 	if (!pipe)
+ 		return -EBADF;
+@@ -1730,9 +1736,9 @@ static int ipipe_prep(struct pipe_inode_
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -34612,7 +42825,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  			if (flags & SPLICE_F_NONBLOCK) {
  				ret = -EAGAIN;
  				break;
-@@ -1764,7 +1764,7 @@ static int opipe_prep(struct pipe_inode_
+@@ -1764,7 +1770,7 @@ static int opipe_prep(struct pipe_inode_
  	pipe_lock(pipe);
  
  	while (pipe->nrbufs >= pipe->buffers) {
@@ -34621,7 +42834,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  			send_sig(SIGPIPE, current, 0);
  			ret = -EPIPE;
  			break;
-@@ -1777,9 +1777,9 @@ static int opipe_prep(struct pipe_inode_
+@@ -1777,9 +1783,9 @@ static int opipe_prep(struct pipe_inode_
  			ret = -ERESTARTSYS;
  			break;
  		}
@@ -34633,7 +42846,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  	}
  
  	pipe_unlock(pipe);
-@@ -1815,14 +1815,14 @@ retry:
+@@ -1815,14 +1821,14 @@ retry:
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -34650,7 +42863,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  			break;
  
  		/*
-@@ -1922,7 +1922,7 @@ static int link_pipe(struct pipe_inode_i
+@@ -1922,7 +1928,7 @@ static int link_pipe(struct pipe_inode_i
  	pipe_double_lock(ipipe, opipe);
  
  	do {
@@ -34659,7 +42872,7 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  			send_sig(SIGPIPE, current, 0);
  			if (!ret)
  				ret = -EPIPE;
-@@ -1967,7 +1967,7 @@ static int link_pipe(struct pipe_inode_i
+@@ -1967,7 +1973,7 @@ static int link_pipe(struct pipe_inode_i
  	 * return EAGAIN if we have the potential of some data in the
  	 * future, otherwise just return 0
  	 */
@@ -34668,9 +42881,57 @@ diff -urNp linux-2.6.38.2/fs/splice.c linux-2.6.38.2/fs/splice.c
  		ret = -EAGAIN;
  
  	pipe_unlock(ipipe);
-diff -urNp linux-2.6.38.2/fs/sysfs/mount.c linux-2.6.38.2/fs/sysfs/mount.c
---- linux-2.6.38.2/fs/sysfs/mount.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/sysfs/mount.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/sysfs/file.c linux-2.6.38.7/fs/sysfs/file.c
+--- linux-2.6.38.7/fs/sysfs/file.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/sysfs/file.c	2011-04-28 19:57:25.000000000 -0400
+@@ -44,7 +44,7 @@ static DEFINE_SPINLOCK(sysfs_open_dirent
+ 
+ struct sysfs_open_dirent {
+ 	atomic_t		refcnt;
+-	atomic_t		event;
++	atomic_unchecked_t	event;
+ 	wait_queue_head_t	poll;
+ 	struct list_head	buffers; /* goes through sysfs_buffer.list */
+ };
+@@ -88,7 +88,7 @@ static int fill_read_buffer(struct dentr
+ 	if (!sysfs_get_active(attr_sd))
+ 		return -ENODEV;
+ 
+-	buffer->event = atomic_read(&attr_sd->s_attr.open->event);
++	buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
+ 	count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
+ 
+ 	sysfs_put_active(attr_sd);
+@@ -294,7 +294,7 @@ static int sysfs_get_open_dirent(struct 
+ 		return -ENOMEM;
+ 
+ 	atomic_set(&new_od->refcnt, 0);
+-	atomic_set(&new_od->event, 1);
++	atomic_set_unchecked(&new_od->event, 1);
+ 	init_waitqueue_head(&new_od->poll);
+ 	INIT_LIST_HEAD(&new_od->buffers);
+ 	goto retry;
+@@ -444,7 +444,7 @@ static unsigned int sysfs_poll(struct fi
+ 
+ 	sysfs_put_active(attr_sd);
+ 
+-	if (buffer->event != atomic_read(&od->event))
++	if (buffer->event != atomic_read_unchecked(&od->event))
+ 		goto trigger;
+ 
+ 	return DEFAULT_POLLMASK;
+@@ -463,7 +463,7 @@ void sysfs_notify_dirent(struct sysfs_di
+ 
+ 	od = sd->s_attr.open;
+ 	if (od) {
+-		atomic_inc(&od->event);
++		atomic_inc_unchecked(&od->event);
+ 		wake_up_interruptible(&od->poll);
+ 	}
+ 
+diff -urNp linux-2.6.38.7/fs/sysfs/mount.c linux-2.6.38.7/fs/sysfs/mount.c
+--- linux-2.6.38.7/fs/sysfs/mount.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/sysfs/mount.c	2011-04-28 19:34:15.000000000 -0400
 @@ -36,7 +36,11 @@ struct sysfs_dirent sysfs_root = {
  	.s_name		= "",
  	.s_count	= ATOMIC_INIT(1),
@@ -34683,9 +42944,9 @@ diff -urNp linux-2.6.38.2/fs/sysfs/mount.c linux-2.6.38.2/fs/sysfs/mount.c
  	.s_ino		= 1,
  };
  
-diff -urNp linux-2.6.38.2/fs/sysfs/symlink.c linux-2.6.38.2/fs/sysfs/symlink.c
---- linux-2.6.38.2/fs/sysfs/symlink.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/sysfs/symlink.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/sysfs/symlink.c linux-2.6.38.7/fs/sysfs/symlink.c
+--- linux-2.6.38.7/fs/sysfs/symlink.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/sysfs/symlink.c	2011-04-28 19:34:15.000000000 -0400
 @@ -286,7 +286,7 @@ static void *sysfs_follow_link(struct de
  
  static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
@@ -34695,46 +42956,21 @@ diff -urNp linux-2.6.38.2/fs/sysfs/symlink.c linux-2.6.38.2/fs/sysfs/symlink.c
  	if (!IS_ERR(page))
  		free_page((unsigned long)page);
  }
-diff -urNp linux-2.6.38.2/fs/ubifs/debug.c linux-2.6.38.2/fs/ubifs/debug.c
---- linux-2.6.38.2/fs/ubifs/debug.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/ubifs/debug.c	2011-03-21 18:31:35.000000000 -0400
-@@ -2813,19 +2813,19 @@ int dbg_debugfs_init_fs(struct ubifs_inf
- 	}
- 
- 	fname = "dump_lprops";
--	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-+	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
- 	if (IS_ERR(dent))
- 		goto out_remove;
- 	d->dfs_dump_lprops = dent;
- 
- 	fname = "dump_budg";
--	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-+	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
- 	if (IS_ERR(dent))
- 		goto out_remove;
- 	d->dfs_dump_budg = dent;
- 
- 	fname = "dump_tnc";
--	dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
-+	dent = debugfs_create_file(fname, S_IWUSR, d->dfs_dir, c, &dfs_fops);
- 	if (IS_ERR(dent))
- 		goto out_remove;
- 	d->dfs_dump_tnc = dent;
-diff -urNp linux-2.6.38.2/fs/udf/misc.c linux-2.6.38.2/fs/udf/misc.c
---- linux-2.6.38.2/fs/udf/misc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/udf/misc.c	2011-03-21 18:31:35.000000000 -0400
-@@ -142,8 +142,8 @@ struct genericFormat *udf_add_extendedat
- 		iinfo->i_lenEAttr += size;
- 		return (struct genericFormat *)&ea[offset];
- 	}
--	if (loc & 0x02)
--		;
-+	if (loc & 0x02) {
-+	}
- 
- 	return NULL;
- }
+diff -urNp linux-2.6.38.7/fs/udf/inode.c linux-2.6.38.7/fs/udf/inode.c
+--- linux-2.6.38.7/fs/udf/inode.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/udf/inode.c	2011-05-16 21:47:09.000000000 -0400
+@@ -477,6 +477,8 @@ static struct buffer_head *inode_getblk(
+ 	int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
+ 	int lastblock = 0;
+ 
++	pax_track_stack();
++
+ 	prev_epos.offset = udf_file_entry_alloc_offset(inode);
+ 	prev_epos.block = iinfo->i_location;
+ 	prev_epos.bh = NULL;
+diff -urNp linux-2.6.38.7/fs/udf/misc.c linux-2.6.38.7/fs/udf/misc.c
+--- linux-2.6.38.7/fs/udf/misc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/udf/misc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -286,7 +286,7 @@ void udf_new_tag(char *data, uint16_t id
  
  u8 udf_tag_checksum(const struct tag *t)
@@ -34744,21 +42980,9 @@ diff -urNp linux-2.6.38.2/fs/udf/misc.c linux-2.6.38.2/fs/udf/misc.c
  	u8 checksum = 0;
  	int i;
  	for (i = 0; i < sizeof(struct tag); ++i)
-diff -urNp linux-2.6.38.2/fs/udf/udfdecl.h linux-2.6.38.2/fs/udf/udfdecl.h
---- linux-2.6.38.2/fs/udf/udfdecl.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/udf/udfdecl.h	2011-03-21 18:31:35.000000000 -0400
-@@ -26,7 +26,7 @@ do { \
- 	printk(f, ##a); \
- } while (0)
- #else
--#define udf_debug(f, a...) /**/
-+#define udf_debug(f, a...) do {} while (0)
- #endif
- 
- #define udf_info(f, a...) \
-diff -urNp linux-2.6.38.2/fs/utimes.c linux-2.6.38.2/fs/utimes.c
---- linux-2.6.38.2/fs/utimes.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/utimes.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/utimes.c linux-2.6.38.7/fs/utimes.c
+--- linux-2.6.38.7/fs/utimes.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/utimes.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1,6 +1,7 @@
  #include <linux/compiler.h>
  #include <linux/file.h>
@@ -34780,9 +43004,9 @@ diff -urNp linux-2.6.38.2/fs/utimes.c linux-2.6.38.2/fs/utimes.c
  	mutex_lock(&inode->i_mutex);
  	error = notify_change(path->dentry, &newattrs);
  	mutex_unlock(&inode->i_mutex);
-diff -urNp linux-2.6.38.2/fs/xattr_acl.c linux-2.6.38.2/fs/xattr_acl.c
---- linux-2.6.38.2/fs/xattr_acl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xattr_acl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xattr_acl.c linux-2.6.38.7/fs/xattr_acl.c
+--- linux-2.6.38.7/fs/xattr_acl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xattr_acl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -17,8 +17,8 @@
  struct posix_acl *
  posix_acl_from_xattr(const void *value, size_t size)
@@ -34794,9 +43018,9 @@ diff -urNp linux-2.6.38.2/fs/xattr_acl.c linux-2.6.38.2/fs/xattr_acl.c
  	int count;
  	struct posix_acl *acl;
  	struct posix_acl_entry *acl_e;
-diff -urNp linux-2.6.38.2/fs/xattr.c linux-2.6.38.2/fs/xattr.c
---- linux-2.6.38.2/fs/xattr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xattr.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xattr.c linux-2.6.38.7/fs/xattr.c
+--- linux-2.6.38.7/fs/xattr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xattr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -247,7 +247,7 @@ EXPORT_SYMBOL_GPL(vfs_removexattr);
   * Extended attribute SET operations
   */
@@ -34859,9 +43083,9 @@ diff -urNp linux-2.6.38.2/fs/xattr.c linux-2.6.38.2/fs/xattr.c
  		mnt_drop_write(f->f_path.mnt);
  	}
  	fput(f);
-diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl32.c
---- linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl32.c
+--- linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-04-28 19:34:15.000000000 -0400
 @@ -73,6 +73,7 @@ xfs_compat_ioc_fsgeometry_v1(
  	xfs_fsop_geom_t		  fsgeo;
  	int			  error;
@@ -34870,9 +43094,9 @@ diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.38.2/fs/xfs/l
  	error = xfs_fs_geometry(mp, &fsgeo, 3);
  	if (error)
  		return -error;
-diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl.c
---- linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl.c
+--- linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xfs/linux-2.6/xfs_ioctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -128,7 +128,7 @@ xfs_find_handle(
  	}
  
@@ -34882,17 +43106,9 @@ diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.38.2/fs/xfs/lin
  	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
  		goto out_put;
  
-@@ -720,6 +720,7 @@ xfs_ioc_fsgeometry(
- 	xfs_fsop_geom_t		fsgeo;
- 	int			error;
- 
-+	memset(&fsgeo, 0, sizeof(fsgeo));
- 	error = xfs_fs_geometry(mp, &fsgeo, 4);
- 	if (error)
- 		return -error;
-diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.38.2/fs/xfs/linux-2.6/xfs_iops.c
---- linux-2.6.38.2/fs/xfs/linux-2.6/xfs_iops.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xfs/linux-2.6/xfs_iops.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.38.7/fs/xfs/linux-2.6/xfs_iops.c
+--- linux-2.6.38.7/fs/xfs/linux-2.6/xfs_iops.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xfs/linux-2.6/xfs_iops.c	2011-04-28 19:34:15.000000000 -0400
 @@ -436,7 +436,7 @@ xfs_vn_put_link(
  	struct nameidata *nd,
  	void		*p)
@@ -34902,9 +43118,9 @@ diff -urNp linux-2.6.38.2/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.38.2/fs/xfs/linu
  
  	if (!IS_ERR(s))
  		kfree(s);
-diff -urNp linux-2.6.38.2/fs/xfs/xfs_bmap.c linux-2.6.38.2/fs/xfs/xfs_bmap.c
---- linux-2.6.38.2/fs/xfs/xfs_bmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/fs/xfs/xfs_bmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xfs/xfs_bmap.c linux-2.6.38.7/fs/xfs/xfs_bmap.c
+--- linux-2.6.38.7/fs/xfs/xfs_bmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xfs/xfs_bmap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -287,7 +287,7 @@ xfs_bmap_validate_ret(
  	int			nmap,
  	int			ret_nmap);
@@ -34914,9 +43130,29 @@ diff -urNp linux-2.6.38.2/fs/xfs/xfs_bmap.c linux-2.6.38.2/fs/xfs/xfs_bmap.c
  #endif /* DEBUG */
  
  STATIC int
-diff -urNp linux-2.6.38.2/grsecurity/gracl_alloc.c linux-2.6.38.2/grsecurity/gracl_alloc.c
---- linux-2.6.38.2/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_alloc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/fs/xfs/xfs_dir2_sf.c linux-2.6.38.7/fs/xfs/xfs_dir2_sf.c
+--- linux-2.6.38.7/fs/xfs/xfs_dir2_sf.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/fs/xfs/xfs_dir2_sf.c	2011-04-28 19:34:15.000000000 -0400
+@@ -780,7 +780,15 @@ xfs_dir2_sf_getdents(
+ 		}
+ 
+ 		ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
+-		if (filldir(dirent, (char *)sfep->name, sfep->namelen,
++		if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
++			char name[sfep->namelen];
++			memcpy(name, sfep->name, sfep->namelen);
++			if (filldir(dirent, name, sfep->namelen,
++			    off & 0x7fffffff, ino, DT_UNKNOWN)) {
++				*offset = off & 0x7fffffff;
++				return 0;
++			}
++		} else if (filldir(dirent, (char *)sfep->name, sfep->namelen,
+ 			    off & 0x7fffffff, ino, DT_UNKNOWN)) {
+ 			*offset = off & 0x7fffffff;
+ 			return 0;
+diff -urNp linux-2.6.38.7/grsecurity/gracl_alloc.c linux-2.6.38.7/grsecurity/gracl_alloc.c
+--- linux-2.6.38.7/grsecurity/gracl_alloc.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_alloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,105 @@
 +#include <linux/kernel.h>
 +#include <linux/mm.h>
@@ -35023,10 +43259,10 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_alloc.c linux-2.6.38.2/grsecurity/gra
 +	else
 +		return 1;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
---- linux-2.6.38.2/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl.c	2011-03-28 17:16:45.000000000 -0400
-@@ -0,0 +1,4074 @@
+diff -urNp linux-2.6.38.7/grsecurity/gracl.c linux-2.6.38.7/grsecurity/gracl.c
+--- linux-2.6.38.7/grsecurity/gracl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl.c	2011-05-17 17:30:19.000000000 -0400
+@@ -0,0 +1,4098 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -36856,9 +45092,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
 +	write_seqlock(&rename_lock);
 +	br_read_lock(vfsmount_lock);
 +
-+	if (unlikely(mnt == shm_mnt || mnt == pipe_mnt || mnt == sock_mnt ||
++	if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt || mnt == sock_mnt ||
 +#ifdef CONFIG_HUGETLBFS
-+	    mnt == hugetlbfs_vfsmount ||
++	    (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
 +#endif
 +		/* ignore Eric Biederman */
 +	    IS_PRIVATE(l_dentry->d_inode))) {
@@ -37310,6 +45546,8 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
 +	return;
 +}
 +
++extern int __gr_process_user_ban(struct user_struct *user);
++
 +int
 +gr_check_user_change(int real, int effective, int fs)
 +{
@@ -37321,6 +45559,28 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
 +	int effectiveok = 0;
 +	int fsok = 0;
 +
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++	struct user_struct *user;
++
++	if (real == -1)
++		goto skipit;
++
++	user = find_user(real);
++	if (user == NULL)
++		goto skipit;
++
++	if (__gr_process_user_ban(user)) {
++		/* for find_user */
++		free_uid(user);
++		return 1;
++	}
++
++	/* for find_user */
++	free_uid(user);
++
++skipit:
++#endif
++
 +	if (unlikely(!(gr_status & GR_READY)))
 +		return 0;
 +
@@ -38837,7 +47097,7 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
 +	struct acl_object_label *obj, *obj2;
 +
 +	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
-+	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && filp->f_path.mnt != shm_mnt) {
++	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
 +		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
 +		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
 +				     task->role->root_label);
@@ -39101,9 +47361,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl.c linux-2.6.38.2/grsecurity/gracl.c
 +EXPORT_SYMBOL(gr_check_group_change);
 +#endif
 +
-diff -urNp linux-2.6.38.2/grsecurity/gracl_cap.c linux-2.6.38.2/grsecurity/gracl_cap.c
---- linux-2.6.38.2/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_cap.c	2011-03-21 20:22:36.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_cap.c linux-2.6.38.7/grsecurity/gracl_cap.c
+--- linux-2.6.38.7/grsecurity/gracl_cap.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_cap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,139 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
@@ -39244,9 +47504,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_cap.c linux-2.6.38.2/grsecurity/gracl
 +	return 0;
 +}
 +
-diff -urNp linux-2.6.38.2/grsecurity/gracl_fs.c linux-2.6.38.2/grsecurity/gracl_fs.c
---- linux-2.6.38.2/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_fs.c	2011-03-26 14:32:42.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_fs.c linux-2.6.38.7/grsecurity/gracl_fs.c
+--- linux-2.6.38.7/grsecurity/gracl_fs.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_fs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,431 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -39679,9 +47939,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_fs.c linux-2.6.38.2/grsecurity/gracl_
 +
 +	return 0;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/gracl_ip.c linux-2.6.38.2/grsecurity/gracl_ip.c
---- linux-2.6.38.2/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_ip.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_ip.c linux-2.6.38.7/grsecurity/gracl_ip.c
+--- linux-2.6.38.7/grsecurity/gracl_ip.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_ip.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,382 @@
 +#include <linux/kernel.h>
 +#include <asm/uaccess.h>
@@ -40065,9 +48325,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_ip.c linux-2.6.38.2/grsecurity/gracl_
 +
 +	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
 +}
-diff -urNp linux-2.6.38.2/grsecurity/gracl_learn.c linux-2.6.38.2/grsecurity/gracl_learn.c
---- linux-2.6.38.2/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_learn.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_learn.c linux-2.6.38.7/grsecurity/gracl_learn.c
+--- linux-2.6.38.7/grsecurity/gracl_learn.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_learn.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,211 @@
 +#include <linux/kernel.h>
 +#include <linux/mm.h>
@@ -40280,9 +48540,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_learn.c linux-2.6.38.2/grsecurity/gra
 +	.release	= close_learn,
 +	.poll		= poll_learn,
 +};
-diff -urNp linux-2.6.38.2/grsecurity/gracl_res.c linux-2.6.38.2/grsecurity/gracl_res.c
---- linux-2.6.38.2/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_res.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_res.c linux-2.6.38.7/grsecurity/gracl_res.c
+--- linux-2.6.38.7/grsecurity/gracl_res.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_res.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,68 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -40352,10 +48612,10 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_res.c linux-2.6.38.2/grsecurity/gracl
 +	rcu_read_unlock();
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/gracl_segv.c linux-2.6.38.2/grsecurity/gracl_segv.c
---- linux-2.6.38.2/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_segv.c	2011-03-24 23:09:37.000000000 -0400
-@@ -0,0 +1,326 @@
+diff -urNp linux-2.6.38.7/grsecurity/gracl_segv.c linux-2.6.38.7/grsecurity/gracl_segv.c
+--- linux-2.6.38.7/grsecurity/gracl_segv.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_segv.c	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,300 @@
 +#include <linux/kernel.h>
 +#include <linux/mm.h>
 +#include <asm/uaccess.h>
@@ -40382,8 +48642,6 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_segv.c linux-2.6.38.2/grsecurity/grac
 +extern struct acl_subject_label *
 +	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
 +			      struct acl_role_label *role);
-+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
-+
 +
 +#ifdef CONFIG_BTRFS_FS
 +extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
@@ -40533,32 +48791,8 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_segv.c linux-2.6.38.2/grsecurity/grac
 +
 +	return 0;
 +}
-+static __inline__ int
-+gr_fake_force_sig(int sig, struct task_struct *t)
-+{
-+	unsigned long int flags;
-+	int ret, blocked, ignored;
-+	struct k_sigaction *action;
 +
-+	spin_lock_irqsave(&t->sighand->siglock, flags);
-+	action = &t->sighand->action[sig-1];
-+	ignored = action->sa.sa_handler == SIG_IGN;
-+	blocked = sigismember(&t->blocked, sig);
-+	if (blocked || ignored) {
-+		action->sa.sa_handler = SIG_DFL;
-+		if (blocked) {
-+			sigdelset(&t->blocked, sig);
-+			recalc_sigpending_and_wake(t);
-+		}
-+	}
-+	if (action->sa.sa_handler == SIG_DFL)
-+		t->signal->flags &= ~SIGNAL_UNKILLABLE;
-+	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
-+
-+	spin_unlock_irqrestore(&t->sighand->siglock, flags);
-+
-+	return ret;
-+}
++extern int gr_fake_force_sig(int sig, struct task_struct *t);
 +
 +void
 +gr_handle_crash(struct task_struct *task, const int sig)
@@ -40682,9 +48916,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_segv.c linux-2.6.38.2/grsecurity/grac
 +
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/gracl_shm.c linux-2.6.38.2/grsecurity/gracl_shm.c
---- linux-2.6.38.2/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/gracl_shm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/gracl_shm.c linux-2.6.38.7/grsecurity/gracl_shm.c
+--- linux-2.6.38.7/grsecurity/gracl_shm.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/gracl_shm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,40 @@
 +#include <linux/kernel.h>
 +#include <linux/mm.h>
@@ -40726,9 +48960,9 @@ diff -urNp linux-2.6.38.2/grsecurity/gracl_shm.c linux-2.6.38.2/grsecurity/gracl
 +
 +	return 1;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_chdir.c linux-2.6.38.2/grsecurity/grsec_chdir.c
---- linux-2.6.38.2/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_chdir.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_chdir.c linux-2.6.38.7/grsecurity/grsec_chdir.c
+--- linux-2.6.38.7/grsecurity/grsec_chdir.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_chdir.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,19 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -40749,10 +48983,10 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chdir.c linux-2.6.38.2/grsecurity/grs
 +#endif
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/grsec_chroot.c
---- linux-2.6.38.2/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_chroot.c	2011-03-21 21:24:10.000000000 -0400
-@@ -0,0 +1,351 @@
+diff -urNp linux-2.6.38.7/grsecurity/grsec_chroot.c linux-2.6.38.7/grsecurity/grsec_chroot.c
+--- linux-2.6.38.7/grsecurity/grsec_chroot.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_chroot.c	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,355 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
 +#include <linux/sched.h>
@@ -40802,7 +49036,7 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/gr
 +	rcu_read_lock();
 +	read_lock(&tasklist_lock);
 +	p = pid_task(pid, PIDTYPE_PID);
-+	if (unlikely(!have_same_root(current, p))) {
++	if (unlikely(p && !have_same_root(current, p))) {
 +		read_unlock(&tasklist_lock);
 +		rcu_read_unlock();
 +		gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
@@ -40945,6 +49179,8 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/gr
 +	if (pid) {
 +		struct task_struct *p;
 +		p = pid_task(pid, PIDTYPE_PID);
++		if (p == NULL)
++			goto unlock;
 +		starttime = p->start_time.tv_sec;
 +		if (unlikely(!have_same_root(current, p) &&
 +			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
@@ -40958,6 +49194,8 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/gr
 +		if (pid) {
 +			struct task_struct *p;
 +			p = pid_task(pid, PIDTYPE_PID);
++			if (p == NULL)
++				goto unlock;
 +			if (unlikely(!have_same_root(current, p))) {
 +				read_unlock(&tasklist_lock);
 +				rcu_read_unlock();
@@ -40966,7 +49204,7 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/gr
 +			}
 +		}
 +	}
-+
++unlock:
 +	read_unlock(&tasklist_lock);
 +	rcu_read_unlock();
 +#endif
@@ -41104,9 +49342,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_chroot.c linux-2.6.38.2/grsecurity/gr
 +#ifdef CONFIG_SECURITY
 +EXPORT_SYMBOL(gr_handle_chroot_caps);
 +#endif
-diff -urNp linux-2.6.38.2/grsecurity/grsec_disabled.c linux-2.6.38.2/grsecurity/grsec_disabled.c
---- linux-2.6.38.2/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_disabled.c	2011-03-25 18:57:41.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_disabled.c linux-2.6.38.7/grsecurity/grsec_disabled.c
+--- linux-2.6.38.7/grsecurity/grsec_disabled.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_disabled.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,447 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
@@ -41555,9 +49793,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_disabled.c linux-2.6.38.2/grsecurity/
 +EXPORT_SYMBOL(gr_check_user_change);
 +EXPORT_SYMBOL(gr_check_group_change);
 +#endif
-diff -urNp linux-2.6.38.2/grsecurity/grsec_exec.c linux-2.6.38.2/grsecurity/grsec_exec.c
---- linux-2.6.38.2/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_exec.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_exec.c linux-2.6.38.7/grsecurity/grsec_exec.c
+--- linux-2.6.38.7/grsecurity/grsec_exec.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_exec.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,147 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -41706,9 +49944,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_exec.c linux-2.6.38.2/grsecurity/grse
 +	return;
 +}
 +#endif
-diff -urNp linux-2.6.38.2/grsecurity/grsec_fifo.c linux-2.6.38.2/grsecurity/grsec_fifo.c
---- linux-2.6.38.2/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_fifo.c	2011-03-21 20:33:29.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_fifo.c linux-2.6.38.7/grsecurity/grsec_fifo.c
+--- linux-2.6.38.7/grsecurity/grsec_fifo.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_fifo.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,24 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -41734,9 +49972,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_fifo.c linux-2.6.38.2/grsecurity/grse
 +#endif
 +	return 0;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_fork.c linux-2.6.38.2/grsecurity/grsec_fork.c
---- linux-2.6.38.2/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_fork.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_fork.c linux-2.6.38.7/grsecurity/grsec_fork.c
+--- linux-2.6.38.7/grsecurity/grsec_fork.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_fork.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,23 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -41761,9 +49999,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_fork.c linux-2.6.38.2/grsecurity/grse
 +#endif
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_init.c linux-2.6.38.2/grsecurity/grsec_init.c
---- linux-2.6.38.2/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_init.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_init.c linux-2.6.38.7/grsecurity/grsec_init.c
+--- linux-2.6.38.7/grsecurity/grsec_init.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_init.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,270 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42035,9 +50273,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_init.c linux-2.6.38.2/grsecurity/grse
 +
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_link.c linux-2.6.38.2/grsecurity/grsec_link.c
---- linux-2.6.38.2/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_link.c	2011-03-21 20:34:41.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_link.c linux-2.6.38.7/grsecurity/grsec_link.c
+--- linux-2.6.38.7/grsecurity/grsec_link.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_link.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,43 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42082,9 +50320,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_link.c linux-2.6.38.2/grsecurity/grse
 +#endif
 +	return 0;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_log.c linux-2.6.38.2/grsecurity/grsec_log.c
---- linux-2.6.38.2/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_log.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_log.c linux-2.6.38.7/grsecurity/grsec_log.c
+--- linux-2.6.38.7/grsecurity/grsec_log.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_log.c	2011-05-10 21:15:15.000000000 -0400
 @@ -0,0 +1,310 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42217,14 +50455,14 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_log.c linux-2.6.38.2/grsecurity/grsec
 +{
 +	int logtype;
 +	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
-+	char *str1, *str2, *str3;
-+	void *voidptr;
-+	int num1, num2;
-+	unsigned long ulong1, ulong2;
-+	struct dentry *dentry;
-+	struct vfsmount *mnt;
-+	struct file *file;
-+	struct task_struct *task;
++	char *str1 = NULL, *str2 = NULL, *str3 = NULL;
++	void *voidptr = NULL;
++	int num1 = 0, num2 = 0;
++	unsigned long ulong1 = 0, ulong2 = 0;
++	struct dentry *dentry = NULL;
++	struct vfsmount *mnt = NULL;
++	struct file *file = NULL;
++	struct task_struct *task = NULL;
 +	const struct cred *cred, *pcred;
 +	va_list ap;
 +
@@ -42396,10 +50634,10 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_log.c linux-2.6.38.2/grsecurity/grsec
 +	gr_log_end(audit);
 +	END_LOCKS(audit);
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_mem.c linux-2.6.38.2/grsecurity/grsec_mem.c
---- linux-2.6.38.2/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_mem.c	2011-03-26 14:40:33.000000000 -0400
-@@ -0,0 +1,100 @@
+diff -urNp linux-2.6.38.7/grsecurity/grsec_mem.c linux-2.6.38.7/grsecurity/grsec_mem.c
+--- linux-2.6.38.7/grsecurity/grsec_mem.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_mem.c	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,33 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/mm.h>
@@ -42421,88 +50659,21 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_mem.c linux-2.6.38.2/grsecurity/grsec
 +}
 +
 +void
-+gr_handle_mem_write(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_MEM_WRITE_MSG);
-+	return;
-+}
-+
-+void
-+gr_handle_kmem_write(void)
++gr_handle_mem_readwrite(u64 from, u64 to)
 +{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_KMEM_MSG);
++	gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
 +	return;
 +}
 +
 +void
-+gr_handle_open_port(void)
-+{
-+	gr_log_noargs(GR_DONT_AUDIT, GR_PORT_OPEN_MSG);
-+	return;
-+}
-+
-+int
-+gr_handle_mem_mmap(const unsigned long offset, struct vm_area_struct *vma)
-+{
-+	unsigned long start, end;
-+
-+	start = offset;
-+	end = start + vma->vm_end - vma->vm_start;
-+
-+	if (start > end) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	}
-+
-+/* if raw i/o is disabled, prevent writes to /dev/mem entirely */
-+#ifndef CONFIG_GRKERNSEC_IO
-+	/* allowed ranges : ISA I/O BIOS */
-+	if ((start >= __pa(high_memory))
-+#if defined(CONFIG_X86) || defined(CONFIG_PPC)
-+	    || (start >= 0x000a0000 && end <= 0x00100000)
-+	    || (start >= 0x00000000 && end <= 0x00001000)
-+#endif
-+	)
-+		return 0;
-+#endif
-+
-+	if (vma->vm_flags & VM_WRITE) {
-+		gr_log_noargs(GR_DONT_AUDIT, GR_MEM_MMAP_MSG);
-+		return -EPERM;
-+	} else
-+		vma->vm_flags &= ~VM_MAYWRITE;
-+
-+	return 0;
-+}
-+
-+void
-+gr_log_nonroot_mod_load(const char *modname)
-+{
-+	if (1
-+#if !defined(CONFIG_IPV6) && !defined(CONFIG_IPV6_MODULE)
-+		/* There are known knowns.  These are things we know
-+		   that we know.  There are known unknowns.  That is to say,
-+		   there are things that we know we don't know.  But there are
-+		   also unknown unknowns.  There are things we don't know
-+		   we don't know.
-+		   This here is a known unknown.
-+		*/
-+		&& strcmp(modname, "net-pf-10")
-+#endif
-+	)
-+	        gr_log_str(GR_DONT_AUDIT, GR_NONROOT_MODLOAD_MSG, modname);
-+        return;
-+}
-+
-+void
 +gr_handle_vm86(void)
 +{
 +	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_mount.c linux-2.6.38.2/grsecurity/grsec_mount.c
---- linux-2.6.38.2/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_mount.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_mount.c linux-2.6.38.7/grsecurity/grsec_mount.c
+--- linux-2.6.38.7/grsecurity/grsec_mount.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_mount.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,62 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42566,9 +50737,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_mount.c linux-2.6.38.2/grsecurity/grs
 +#endif
 +	return 0;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_pax.c linux-2.6.38.2/grsecurity/grsec_pax.c
---- linux-2.6.38.2/grsecurity/grsec_pax.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_pax.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_pax.c linux-2.6.38.7/grsecurity/grsec_pax.c
+--- linux-2.6.38.7/grsecurity/grsec_pax.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_pax.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,36 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42606,9 +50777,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_pax.c linux-2.6.38.2/grsecurity/grsec
 +#endif
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_ptrace.c linux-2.6.38.2/grsecurity/grsec_ptrace.c
---- linux-2.6.38.2/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_ptrace.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_ptrace.c linux-2.6.38.7/grsecurity/grsec_ptrace.c
+--- linux-2.6.38.7/grsecurity/grsec_ptrace.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_ptrace.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,14 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -42624,15 +50795,16 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_ptrace.c linux-2.6.38.2/grsecurity/gr
 +#endif
 +	return;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_sig.c linux-2.6.38.2/grsecurity/grsec_sig.c
---- linux-2.6.38.2/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_sig.c	2011-03-26 19:58:27.000000000 -0400
-@@ -0,0 +1,65 @@
+diff -urNp linux-2.6.38.7/grsecurity/grsec_sig.c linux-2.6.38.7/grsecurity/grsec_sig.c
+--- linux-2.6.38.7/grsecurity/grsec_sig.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_sig.c	2011-05-17 17:30:33.000000000 -0400
+@@ -0,0 +1,203 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
 +#include <linux/delay.h>
 +#include <linux/grsecurity.h>
 +#include <linux/grinternal.h>
++#include <linux/hardirq.h>
 +
 +char *signames[] = {
 +	[SIGSEGV] = "Segmentation fault",
@@ -42671,15 +50843,91 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_sig.c linux-2.6.38.2/grsecurity/grsec
 +	return 0;
 +}
 +
-+void gr_handle_brute_attach(struct task_struct *p)
++#ifdef CONFIG_GRKERNSEC
++extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
++
++int gr_fake_force_sig(int sig, struct task_struct *t)
++{
++	unsigned long int flags;
++	int ret, blocked, ignored;
++	struct k_sigaction *action;
++
++	spin_lock_irqsave(&t->sighand->siglock, flags);
++	action = &t->sighand->action[sig-1];
++	ignored = action->sa.sa_handler == SIG_IGN;
++	blocked = sigismember(&t->blocked, sig);
++	if (blocked || ignored) {
++		action->sa.sa_handler = SIG_DFL;
++		if (blocked) {
++			sigdelset(&t->blocked, sig);
++			recalc_sigpending_and_wake(t);
++		}
++	}
++	if (action->sa.sa_handler == SIG_DFL)
++		t->signal->flags &= ~SIGNAL_UNKILLABLE;
++	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
++
++	spin_unlock_irqrestore(&t->sighand->siglock, flags);
++
++	return ret;
++}
++#endif
++
++#ifdef CONFIG_GRKERNSEC_BRUTE
++#define GR_USER_BAN_TIME (15 * 60)
++
++static int __get_dumpable(unsigned long mm_flags)
++{
++	int ret;
++
++	ret = mm_flags & MMF_DUMPABLE_MASK;
++	return (ret >= 2) ? 2 : ret;
++}
++#endif
++
++void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
 +{
 +#ifdef CONFIG_GRKERNSEC_BRUTE
++	uid_t uid = 0;
++
++	rcu_read_lock();
 +	read_lock(&tasklist_lock);
 +	read_lock(&grsec_exec_file_lock);
 +	if (p->real_parent && p->real_parent->exec_file == p->exec_file)
 +		p->real_parent->brute = 1;
++	else {
++		const struct cred *cred = __task_cred(p), *cred2;
++		struct task_struct *tsk, *tsk2;
++
++		if (!__get_dumpable(mm_flags) && cred->uid) {
++			struct user_struct *user;
++
++			uid = cred->uid;
++
++			/* this is put upon execution past expiration */
++			user = find_user(uid);
++			if (user == NULL)
++				goto unlock;
++			user->banned = 1;
++			user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
++			if (user->ban_expires == ~0UL)
++				user->ban_expires--;
++
++			do_each_thread(tsk2, tsk) {
++				cred2 = __task_cred(tsk);
++				if (tsk != p && cred2->uid == uid)
++					gr_fake_force_sig(SIGKILL, tsk);
++			} while_each_thread(tsk2, tsk);
++		}
++	}
++unlock:
 +	read_unlock(&grsec_exec_file_lock);
 +	read_unlock(&tasklist_lock);
++	rcu_read_unlock();
++
++	if (uid)
++		printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
++
 +#endif
 +	return;
 +}
@@ -42693,9 +50941,70 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_sig.c linux-2.6.38.2/grsecurity/grsec
 +	return;
 +}
 +
-diff -urNp linux-2.6.38.2/grsecurity/grsec_sock.c linux-2.6.38.2/grsecurity/grsec_sock.c
---- linux-2.6.38.2/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_sock.c	2011-03-21 18:31:35.000000000 -0400
++void gr_handle_kernel_exploit(void)
++{
++#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
++	const struct cred *cred;
++	struct task_struct *tsk, *tsk2;
++	struct user_struct *user;
++	uid_t uid;
++
++	if (in_irq() || in_serving_softirq() || in_nmi())
++		panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
++
++	uid = current_uid();
++
++	if (uid == 0)
++		panic("grsec: halting the system due to suspicious kernel crash caused by root");
++	else {
++		/* kill all the processes of this user, hold a reference
++		   to their creds struct, and prevent them from creating
++		   another process until system reset
++		*/
++		printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
++		/* we intentionally leak this ref */
++		user = get_uid(current->cred->user);
++		if (user) {
++			user->banned = 1;
++			user->ban_expires = ~0UL;
++		}
++
++		read_lock(&tasklist_lock);
++		do_each_thread(tsk2, tsk) {
++			cred = __task_cred(tsk);
++			if (cred->uid == uid)
++				gr_fake_force_sig(SIGKILL, tsk);
++		} while_each_thread(tsk2, tsk);
++		read_unlock(&tasklist_lock); 
++	}
++#endif
++}
++
++int __gr_process_user_ban(struct user_struct *user)
++{
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++	if (unlikely(user->banned)) {
++		if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
++			user->banned = 0;
++			user->ban_expires = 0;
++			free_uid(user);
++		} else
++			return -EPERM;
++	}
++#endif
++	return 0;
++}
++
++int gr_process_user_ban(void)
++{
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++	return __gr_process_user_ban(current->cred->user);
++#endif
++	return 0;
++}
+diff -urNp linux-2.6.38.7/grsecurity/grsec_sock.c linux-2.6.38.7/grsecurity/grsec_sock.c
+--- linux-2.6.38.7/grsecurity/grsec_sock.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_sock.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,275 @@
 +#include <linux/kernel.h>
 +#include <linux/module.h>
@@ -42972,9 +51281,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_sock.c linux-2.6.38.2/grsecurity/grse
 +	return current_cap();
 +#endif
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsec_sysctl.c linux-2.6.38.2/grsecurity/grsec_sysctl.c
---- linux-2.6.38.2/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_sysctl.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_sysctl.c linux-2.6.38.7/grsecurity/grsec_sysctl.c
+--- linux-2.6.38.7/grsecurity/grsec_sysctl.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_sysctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,433 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -43409,9 +51718,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_sysctl.c linux-2.6.38.2/grsecurity/gr
 +	{ }
 +};
 +#endif
-diff -urNp linux-2.6.38.2/grsecurity/grsec_time.c linux-2.6.38.2/grsecurity/grsec_time.c
---- linux-2.6.38.2/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_time.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_time.c linux-2.6.38.7/grsecurity/grsec_time.c
+--- linux-2.6.38.7/grsecurity/grsec_time.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_time.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,16 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -43429,9 +51738,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_time.c linux-2.6.38.2/grsecurity/grse
 +}
 +
 +EXPORT_SYMBOL(gr_log_timechange);
-diff -urNp linux-2.6.38.2/grsecurity/grsec_tpe.c linux-2.6.38.2/grsecurity/grsec_tpe.c
---- linux-2.6.38.2/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsec_tpe.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsec_tpe.c linux-2.6.38.7/grsecurity/grsec_tpe.c
+--- linux-2.6.38.7/grsecurity/grsec_tpe.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsec_tpe.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,39 @@
 +#include <linux/kernel.h>
 +#include <linux/sched.h>
@@ -43472,9 +51781,9 @@ diff -urNp linux-2.6.38.2/grsecurity/grsec_tpe.c linux-2.6.38.2/grsecurity/grsec
 +#endif
 +	return 1;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/grsum.c linux-2.6.38.2/grsecurity/grsum.c
---- linux-2.6.38.2/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/grsum.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/grsum.c linux-2.6.38.7/grsecurity/grsum.c
+--- linux-2.6.38.7/grsecurity/grsum.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/grsum.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,61 @@
 +#include <linux/err.h>
 +#include <linux/kernel.h>
@@ -43537,10 +51846,10 @@ diff -urNp linux-2.6.38.2/grsecurity/grsum.c linux-2.6.38.2/grsecurity/grsum.c
 +
 +	return retval;
 +}
-diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
---- linux-2.6.38.2/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/Kconfig	2011-03-26 19:54:37.000000000 -0400
-@@ -0,0 +1,1020 @@
+diff -urNp linux-2.6.38.7/grsecurity/Kconfig linux-2.6.38.7/grsecurity/Kconfig
+--- linux-2.6.38.7/grsecurity/Kconfig	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/Kconfig	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,1045 @@
 +#
 +# grecurity configuration
 +#
@@ -43683,6 +51992,7 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +	select GRKERNSEC_MODHARDEN if (MODULES)
 +	select GRKERNSEC_HARDEN_PTRACE
 +	select GRKERNSEC_VM86 if (X86_32)
++	select GRKERNSEC_KERN_LOCKOUT if (X86)
 +	select PAX
 +	select PAX_RANDUSTACK
 +	select PAX_ASLR
@@ -43694,7 +52004,7 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +	select PAX_HAVE_ACL_FLAGS
 +	select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
 +	select PAX_MEMORY_UDEREF if (X86 && !XEN)
-+	select PAX_RANDKSTACK if (X86_TSC && !X86_64)
++	select PAX_RANDKSTACK if (X86_TSC && X86)
 +	select PAX_SEGMEXEC if (X86_32)
 +	select PAX_PAGEEXEC
 +	select PAX_EMUPLT if (ALPHA || PARISC || SPARC32 || SPARC64)
@@ -43735,6 +52045,7 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +	  - Ptrace restrictions
 +	  - Restricted vm86 mode
 +	  - Restricted sysfs/debugfs
++	  - Active kernel exploit response
 +
 +config GRKERNSEC_CUSTOM
 +	bool "Custom"
@@ -43753,6 +52064,7 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +
 +config GRKERNSEC_KMEM
 +	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
++	select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
 +	help
 +	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
 +	  be written to via mmap or otherwise to modify the running kernel.
@@ -43819,13 +52131,18 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +	bool "Deter exploit bruteforcing"
 +	help
 +	  If you say Y here, attempts to bruteforce exploits against forking
-+	  daemons such as apache or sshd will be deterred.  When a child of a
-+	  forking daemon is killed by PaX or crashes due to an illegal
-+	  instruction, the parent process will be delayed 30 seconds upon every
-+	  subsequent fork until the administrator is able to assess the
-+	  situation and restart the daemon.  It is recommended that you also
-+	  enable signal logging in the auditing section so that logs are
-+	  generated when a process performs an illegal instruction.
++	  daemons such as apache or sshd, as well as against suid/sgid binaries
++	  will be deterred.  When a child of a forking daemon is killed by PaX
++	  or crashes due to an illegal instruction or other suspicious signal,
++	  the parent process will be delayed 30 seconds upon every subsequent
++	  fork until the administrator is able to assess the situation and
++	  restart the daemon.
++	  In the suid/sgid case, the attempt is logged, the user has all their
++	  processes terminated, and they are prevented from executing any further
++	  processes for 15 minutes.
++	  It is recommended that you also enable signal logging in the auditing
++	  section so that logs are generated when a process triggers a suspicious
++	  signal.
 +
 +config GRKERNSEC_MODHARDEN
 +	bool "Harden module auto-loading"
@@ -43873,6 +52190,23 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +	  useful protection against local kernel exploitation of overflows
 +	  and arbitrary read/write vulnerabilities.
 +
++config GRKERNSEC_KERN_LOCKOUT
++	bool "Active kernel exploit response"
++	depends on X86
++	help
++	  If you say Y here, when a PaX alert is triggered due to suspicious
++	  activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
++	  or an OOPs occurs due to bad memory accesses, instead of just
++	  terminating the offending process (and potentially allowing
++	  a subsequent exploit from the same user), we will take one of two
++	  actions:
++	   If the user was root, we will panic the system
++	   If the user was non-root, we will log the attempt, terminate
++	   all processes owned by the user, then prevent them from creating
++	   any new processes until the system is restarted
++	  This deters repeated kernel exploitation/bruteforcing attempts
++	  and is useful for later forensics.
++
 +endmenu
 +menu "Role Based Access Control Options"
 +depends on GRKERNSEC
@@ -44561,9 +52895,9 @@ diff -urNp linux-2.6.38.2/grsecurity/Kconfig linux-2.6.38.2/grsecurity/Kconfig
 +endmenu
 +
 +endmenu
-diff -urNp linux-2.6.38.2/grsecurity/Makefile linux-2.6.38.2/grsecurity/Makefile
---- linux-2.6.38.2/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/grsecurity/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/grsecurity/Makefile linux-2.6.38.7/grsecurity/Makefile
+--- linux-2.6.38.7/grsecurity/Makefile	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/grsecurity/Makefile	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,29 @@
 +# grsecurity's ACL system was originally written in 2001 by Michael Dalton
 +# during 2001-2009 it has been completely redesigned by Brad Spengler
@@ -44594,23 +52928,9 @@ diff -urNp linux-2.6.38.2/grsecurity/Makefile linux-2.6.38.2/grsecurity/Makefile
 +	@-chmod -f 700 .
 +	@echo '  grsec: protected kernel image paths'
 +endif
-diff -urNp linux-2.6.38.2/include/acpi/acoutput.h linux-2.6.38.2/include/acpi/acoutput.h
---- linux-2.6.38.2/include/acpi/acoutput.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/acpi/acoutput.h	2011-03-21 18:31:35.000000000 -0400
-@@ -269,8 +269,8 @@
-  * leaving no executable debug code!
-  */
- #define ACPI_FUNCTION_NAME(a)
--#define ACPI_DEBUG_PRINT(pl)
--#define ACPI_DEBUG_PRINT_RAW(pl)
-+#define ACPI_DEBUG_PRINT(pl) do {} while (0)
-+#define ACPI_DEBUG_PRINT_RAW(pl) do {} while (0)
- 
- #endif				/* ACPI_DEBUG_OUTPUT */
- 
-diff -urNp linux-2.6.38.2/include/acpi/acpi_drivers.h linux-2.6.38.2/include/acpi/acpi_drivers.h
---- linux-2.6.38.2/include/acpi/acpi_drivers.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/acpi/acpi_drivers.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/acpi/acpi_drivers.h linux-2.6.38.7/include/acpi/acpi_drivers.h
+--- linux-2.6.38.7/include/acpi/acpi_drivers.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/acpi/acpi_drivers.h	2011-04-28 19:34:15.000000000 -0400
 @@ -119,8 +119,8 @@ void pci_acpi_crs_quirks(void);
                                    Dock Station
    -------------------------------------------------------------------------- */
@@ -44640,9 +52960,9 @@ diff -urNp linux-2.6.38.2/include/acpi/acpi_drivers.h linux-2.6.38.2/include/acp
  					       void *context)
  {
  	return -ENODEV;
-diff -urNp linux-2.6.38.2/include/asm-generic/atomic-long.h linux-2.6.38.2/include/asm-generic/atomic-long.h
---- linux-2.6.38.2/include/asm-generic/atomic-long.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/atomic-long.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/atomic-long.h linux-2.6.38.7/include/asm-generic/atomic-long.h
+--- linux-2.6.38.7/include/asm-generic/atomic-long.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/atomic-long.h	2011-05-16 21:47:08.000000000 -0400
 @@ -22,6 +22,12 @@
  
  typedef atomic64_t atomic_long_t;
@@ -44893,7 +53213,7 @@ diff -urNp linux-2.6.38.2/include/asm-generic/atomic-long.h linux-2.6.38.2/inclu
  static inline long atomic_long_dec_return(atomic_long_t *l)
  {
  	atomic_t *v = (atomic_t *)l;
-@@ -255,4 +393,41 @@ static inline long atomic_long_add_unles
+@@ -255,4 +393,49 @@ static inline long atomic_long_add_unles
  
  #endif  /*  BITS_PER_LONG == 64  */
  
@@ -44905,8 +53225,12 @@ diff -urNp linux-2.6.38.2/include/asm-generic/atomic-long.h linux-2.6.38.2/inclu
 +	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
 +	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
 +	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
++	atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
 +	atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
 +	atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
++	atomic_dec_unchecked((atomic_unchecked_t *)NULL);
++	atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
++	atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
 +
 +	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
 +	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
@@ -44922,8 +53246,12 @@ diff -urNp linux-2.6.38.2/include/asm-generic/atomic-long.h linux-2.6.38.2/inclu
 +#define atomic_add_unchecked(i, v) atomic_add((i), (v))
 +#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
 +#define atomic_inc_unchecked(v) atomic_inc(v)
++#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
 +#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
 +#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
++#define atomic_dec_unchecked(v) atomic_dec(v)
++#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
++#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
 +
 +#define atomic_long_read_unchecked(v) atomic_long_read(v)
 +#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
@@ -44935,9 +53263,22 @@ diff -urNp linux-2.6.38.2/include/asm-generic/atomic-long.h linux-2.6.38.2/inclu
 +#endif
 +
  #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
-diff -urNp linux-2.6.38.2/include/asm-generic/dma-mapping-common.h linux-2.6.38.2/include/asm-generic/dma-mapping-common.h
---- linux-2.6.38.2/include/asm-generic/dma-mapping-common.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/dma-mapping-common.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/cache.h linux-2.6.38.7/include/asm-generic/cache.h
+--- linux-2.6.38.7/include/asm-generic/cache.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/cache.h	2011-04-28 19:57:25.000000000 -0400
+@@ -6,7 +6,7 @@
+  * cache lines need to provide their own cache.h.
+  */
+ 
+-#define L1_CACHE_SHIFT		5
+-#define L1_CACHE_BYTES		(1 << L1_CACHE_SHIFT)
++#define L1_CACHE_SHIFT		5U
++#define L1_CACHE_BYTES		(1U << L1_CACHE_SHIFT)
+ 
+ #endif /* __ASM_GENERIC_CACHE_H */
+diff -urNp linux-2.6.38.7/include/asm-generic/dma-mapping-common.h linux-2.6.38.7/include/asm-generic/dma-mapping-common.h
+--- linux-2.6.38.7/include/asm-generic/dma-mapping-common.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/dma-mapping-common.h	2011-04-28 19:34:15.000000000 -0400
 @@ -11,7 +11,7 @@ static inline dma_addr_t dma_map_single_
  					      enum dma_data_direction dir,
  					      struct dma_attrs *attrs)
@@ -45028,9 +53369,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/dma-mapping-common.h linux-2.6.38.
  
  	BUG_ON(!valid_dma_direction(dir));
  	if (ops->sync_sg_for_device)
-diff -urNp linux-2.6.38.2/include/asm-generic/futex.h linux-2.6.38.2/include/asm-generic/futex.h
---- linux-2.6.38.2/include/asm-generic/futex.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/futex.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/futex.h linux-2.6.38.7/include/asm-generic/futex.h
+--- linux-2.6.38.7/include/asm-generic/futex.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/futex.h	2011-04-28 19:34:15.000000000 -0400
 @@ -6,7 +6,7 @@
  #include <asm/errno.h>
  
@@ -45049,9 +53390,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/futex.h linux-2.6.38.2/include/asm
  {
  	return -ENOSYS;
  }
-diff -urNp linux-2.6.38.2/include/asm-generic/int-l64.h linux-2.6.38.2/include/asm-generic/int-l64.h
---- linux-2.6.38.2/include/asm-generic/int-l64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/int-l64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/int-l64.h linux-2.6.38.7/include/asm-generic/int-l64.h
+--- linux-2.6.38.7/include/asm-generic/int-l64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/int-l64.h	2011-04-28 19:34:15.000000000 -0400
 @@ -46,6 +46,8 @@ typedef unsigned int u32;
  typedef signed long s64;
  typedef unsigned long u64;
@@ -45061,9 +53402,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/int-l64.h linux-2.6.38.2/include/a
  #define S8_C(x)  x
  #define U8_C(x)  x ## U
  #define S16_C(x) x
-diff -urNp linux-2.6.38.2/include/asm-generic/int-ll64.h linux-2.6.38.2/include/asm-generic/int-ll64.h
---- linux-2.6.38.2/include/asm-generic/int-ll64.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/int-ll64.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/int-ll64.h linux-2.6.38.7/include/asm-generic/int-ll64.h
+--- linux-2.6.38.7/include/asm-generic/int-ll64.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/int-ll64.h	2011-04-28 19:34:15.000000000 -0400
 @@ -51,6 +51,8 @@ typedef unsigned int u32;
  typedef signed long long s64;
  typedef unsigned long long u64;
@@ -45073,9 +53414,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/int-ll64.h linux-2.6.38.2/include/
  #define S8_C(x)  x
  #define U8_C(x)  x ## U
  #define S16_C(x) x
-diff -urNp linux-2.6.38.2/include/asm-generic/kmap_types.h linux-2.6.38.2/include/asm-generic/kmap_types.h
---- linux-2.6.38.2/include/asm-generic/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/kmap_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/kmap_types.h linux-2.6.38.7/include/asm-generic/kmap_types.h
+--- linux-2.6.38.7/include/asm-generic/kmap_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/kmap_types.h	2011-04-28 19:34:15.000000000 -0400
 @@ -29,10 +29,11 @@ KMAP_D(16)	KM_IRQ_PTE,
  KMAP_D(17)	KM_NMI,
  KMAP_D(18)	KM_NMI_PTE,
@@ -45089,9 +53430,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/kmap_types.h linux-2.6.38.2/includ
  };
  
  #undef KMAP_D
-diff -urNp linux-2.6.38.2/include/asm-generic/pgtable.h linux-2.6.38.2/include/asm-generic/pgtable.h
---- linux-2.6.38.2/include/asm-generic/pgtable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/pgtable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/pgtable.h linux-2.6.38.7/include/asm-generic/pgtable.h
+--- linux-2.6.38.7/include/asm-generic/pgtable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/pgtable.h	2011-04-28 19:34:15.000000000 -0400
 @@ -447,6 +447,14 @@ static inline int pmd_write(pmd_t pmd)
  #endif /* __HAVE_ARCH_PMD_WRITE */
  #endif
@@ -45107,9 +53448,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/pgtable.h linux-2.6.38.2/include/a
  #endif /* !__ASSEMBLY__ */
  
  #endif /* _ASM_GENERIC_PGTABLE_H */
-diff -urNp linux-2.6.38.2/include/asm-generic/pgtable-nopmd.h linux-2.6.38.2/include/asm-generic/pgtable-nopmd.h
---- linux-2.6.38.2/include/asm-generic/pgtable-nopmd.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/pgtable-nopmd.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/pgtable-nopmd.h linux-2.6.38.7/include/asm-generic/pgtable-nopmd.h
+--- linux-2.6.38.7/include/asm-generic/pgtable-nopmd.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/pgtable-nopmd.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1,14 +1,19 @@
  #ifndef _PGTABLE_NOPMD_H
  #define _PGTABLE_NOPMD_H
@@ -45146,9 +53487,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/pgtable-nopmd.h linux-2.6.38.2/inc
  /*
   * The "pud_xxx()" functions here are trivial for a folded two-level
   * setup: the pmd is never bad, and a pmd always exists (as it's folded
-diff -urNp linux-2.6.38.2/include/asm-generic/pgtable-nopud.h linux-2.6.38.2/include/asm-generic/pgtable-nopud.h
---- linux-2.6.38.2/include/asm-generic/pgtable-nopud.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/pgtable-nopud.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/pgtable-nopud.h linux-2.6.38.7/include/asm-generic/pgtable-nopud.h
+--- linux-2.6.38.7/include/asm-generic/pgtable-nopud.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/pgtable-nopud.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1,10 +1,15 @@
  #ifndef _PGTABLE_NOPUD_H
  #define _PGTABLE_NOPUD_H
@@ -45179,9 +53520,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/pgtable-nopud.h linux-2.6.38.2/inc
  /*
   * The "pgd_xxx()" functions here are trivial for a folded two-level
   * setup: the pud is never bad, and a pud always exists (as it's folded
-diff -urNp linux-2.6.38.2/include/asm-generic/vmlinux.lds.h linux-2.6.38.2/include/asm-generic/vmlinux.lds.h
---- linux-2.6.38.2/include/asm-generic/vmlinux.lds.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/asm-generic/vmlinux.lds.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/asm-generic/vmlinux.lds.h linux-2.6.38.7/include/asm-generic/vmlinux.lds.h
+--- linux-2.6.38.7/include/asm-generic/vmlinux.lds.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/asm-generic/vmlinux.lds.h	2011-04-28 19:34:15.000000000 -0400
 @@ -213,6 +213,7 @@
  	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
  		VMLINUX_SYMBOL(__start_rodata) = .;			\
@@ -45218,115 +53559,9 @@ diff -urNp linux-2.6.38.2/include/asm-generic/vmlinux.lds.h linux-2.6.38.2/inclu
  
  /**
   * PERCPU - define output section for percpu area, simple version
-diff -urNp linux-2.6.38.2/include/drm/drm_pciids.h linux-2.6.38.2/include/drm/drm_pciids.h
---- linux-2.6.38.2/include/drm/drm_pciids.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/drm/drm_pciids.h	2011-03-21 18:31:35.000000000 -0400
-@@ -458,7 +458,7 @@
- 	{0x1002, 0x9803, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9804, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
- 	{0x1002, 0x9805, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PALM|RADEON_NEW_MEMMAP|RADEON_IS_IGP}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define r128_PCI_IDS \
- 	{0x1002, 0x4c45, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -498,14 +498,14 @@
- 	{0x1002, 0x5446, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x544C, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x5452, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mga_PCI_IDS \
- 	{0x102b, 0x0520, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0521, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G200}, \
- 	{0x102b, 0x0525, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G400}, \
- 	{0x102b, 0x2527, PCI_ANY_ID, PCI_ANY_ID, 0, 0, MGA_CARD_TYPE_G550}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define mach64_PCI_IDS \
- 	{0x1002, 0x4749, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -528,7 +528,7 @@
- 	{0x1002, 0x4c53, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1002, 0x4c4e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define sisdrv_PCI_IDS \
- 	{0x1039, 0x0300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -539,7 +539,7 @@
- 	{0x1039, 0x7300, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x18CA, 0x0040, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
- 	{0x18CA, 0x0042, PCI_ANY_ID, PCI_ANY_ID, 0, 0, SIS_CHIP_315}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define tdfx_PCI_IDS \
- 	{0x121a, 0x0003, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -548,7 +548,7 @@
- 	{0x121a, 0x0007, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x0009, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x121a, 0x000b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define viadrv_PCI_IDS \
- 	{0x1106, 0x3022, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -560,14 +560,14 @@
- 	{0x1106, 0x3343, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x1106, 0x3230, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_DX9_0}, \
- 	{0x1106, 0x3157, PCI_ANY_ID, PCI_ANY_ID, 0, 0, VIA_PRO_GROUP_A}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i810_PCI_IDS \
- 	{0x8086, 0x7121, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7123, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x7125, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x1132, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i830_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
-@@ -575,11 +575,11 @@
- 	{0x8086, 0x3582, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x2572, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
- 	{0x8086, 0x358e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define gamma_PCI_IDS \
- 	{0x3d3d, 0x0008, PCI_ANY_ID, PCI_ANY_ID, 0, 0, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define savage_PCI_IDS \
- 	{0x5333, 0x8a20, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_SAVAGE3D}, \
-@@ -605,10 +605,10 @@
- 	{0x5333, 0x8d02, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_TWISTER}, \
- 	{0x5333, 0x8d03, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
- 	{0x5333, 0x8d04, PCI_ANY_ID, PCI_ANY_ID, 0, 0, S3_PROSAVAGEDDR}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define ffb_PCI_IDS \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
- 
- #define i915_PCI_IDS \
- 	{0x8086, 0x3577, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
-@@ -642,4 +642,4 @@
- 	{0x8086, 0x0042, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0046, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
- 	{0x8086, 0x0102, PCI_ANY_ID, PCI_ANY_ID, PCI_CLASS_DISPLAY_VGA << 8, 0xffff00, 0}, \
--	{0, 0, 0}
-+	{0, 0, 0, 0, 0, 0}
-diff -urNp linux-2.6.38.2/include/drm/drmP.h linux-2.6.38.2/include/drm/drmP.h
---- linux-2.6.38.2/include/drm/drmP.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/drm/drmP.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/drm/drmP.h linux-2.6.38.7/include/drm/drmP.h
+--- linux-2.6.38.7/include/drm/drmP.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/drm/drmP.h	2011-04-28 19:34:15.000000000 -0400
 @@ -73,6 +73,7 @@
  #include <linux/workqueue.h>
  #include <linux/poll.h>
@@ -45380,9 +53615,9 @@ diff -urNp linux-2.6.38.2/include/drm/drmP.h linux-2.6.38.2/include/drm/drmP.h
  	void *dev_private;		/**< device private data */
  	void *mm_private;
  	struct address_space *dev_mapping;
-diff -urNp linux-2.6.38.2/include/linux/a.out.h linux-2.6.38.2/include/linux/a.out.h
---- linux-2.6.38.2/include/linux/a.out.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/a.out.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/a.out.h linux-2.6.38.7/include/linux/a.out.h
+--- linux-2.6.38.7/include/linux/a.out.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/a.out.h	2011-04-28 19:34:15.000000000 -0400
 @@ -39,6 +39,14 @@ enum machine_type {
    M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
  };
@@ -45398,9 +53633,9 @@ diff -urNp linux-2.6.38.2/include/linux/a.out.h linux-2.6.38.2/include/linux/a.o
  #if !defined (N_MAGIC)
  #define N_MAGIC(exec) ((exec).a_info & 0xffff)
  #endif
-diff -urNp linux-2.6.38.2/include/linux/atmdev.h linux-2.6.38.2/include/linux/atmdev.h
---- linux-2.6.38.2/include/linux/atmdev.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/atmdev.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/atmdev.h linux-2.6.38.7/include/linux/atmdev.h
+--- linux-2.6.38.7/include/linux/atmdev.h	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/include/linux/atmdev.h	2011-04-28 19:34:15.000000000 -0400
 @@ -237,7 +237,7 @@ struct compat_atm_iobuf {
  #endif
  
@@ -45410,9 +53645,9 @@ diff -urNp linux-2.6.38.2/include/linux/atmdev.h linux-2.6.38.2/include/linux/at
  	__AAL_STAT_ITEMS
  #undef __HANDLE_ITEM
  };
-diff -urNp linux-2.6.38.2/include/linux/binfmts.h linux-2.6.38.2/include/linux/binfmts.h
---- linux-2.6.38.2/include/linux/binfmts.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/binfmts.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/binfmts.h linux-2.6.38.7/include/linux/binfmts.h
+--- linux-2.6.38.7/include/linux/binfmts.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/binfmts.h	2011-04-28 19:34:15.000000000 -0400
 @@ -92,6 +92,7 @@ struct linux_binfmt {
  	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
  	int (*load_shlib)(struct file *);
@@ -45421,9 +53656,9 @@ diff -urNp linux-2.6.38.2/include/linux/binfmts.h linux-2.6.38.2/include/linux/b
  	unsigned long min_coredump;	/* minimal dump size */
  };
  
-diff -urNp linux-2.6.38.2/include/linux/blkdev.h linux-2.6.38.2/include/linux/blkdev.h
---- linux-2.6.38.2/include/linux/blkdev.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/blkdev.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/blkdev.h linux-2.6.38.7/include/linux/blkdev.h
+--- linux-2.6.38.7/include/linux/blkdev.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/blkdev.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1247,22 +1247,22 @@ queue_max_integrity_segments(struct requ
  #endif /* CONFIG_BLK_DEV_INTEGRITY */
  
@@ -45459,9 +53694,21 @@ diff -urNp linux-2.6.38.2/include/linux/blkdev.h linux-2.6.38.2/include/linux/bl
  };
  
  extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
-diff -urNp linux-2.6.38.2/include/linux/byteorder/little_endian.h linux-2.6.38.2/include/linux/byteorder/little_endian.h
---- linux-2.6.38.2/include/linux/byteorder/little_endian.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/byteorder/little_endian.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/blktrace_api.h linux-2.6.38.7/include/linux/blktrace_api.h
+--- linux-2.6.38.7/include/linux/blktrace_api.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/blktrace_api.h	2011-04-28 19:57:25.000000000 -0400
+@@ -161,7 +161,7 @@ struct blk_trace {
+ 	struct dentry *dir;
+ 	struct dentry *dropped_file;
+ 	struct dentry *msg_file;
+-	atomic_t dropped;
++	atomic_unchecked_t dropped;
+ };
+ 
+ extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
+diff -urNp linux-2.6.38.7/include/linux/byteorder/little_endian.h linux-2.6.38.7/include/linux/byteorder/little_endian.h
+--- linux-2.6.38.7/include/linux/byteorder/little_endian.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/byteorder/little_endian.h	2011-04-28 19:34:15.000000000 -0400
 @@ -42,51 +42,51 @@
  
  static inline __le64 __cpu_to_le64p(const __u64 *p)
@@ -45526,9 +53773,9 @@ diff -urNp linux-2.6.38.2/include/linux/byteorder/little_endian.h linux-2.6.38.2
  }
  #define __cpu_to_le64s(x) do { (void)(x); } while (0)
  #define __le64_to_cpus(x) do { (void)(x); } while (0)
-diff -urNp linux-2.6.38.2/include/linux/cache.h linux-2.6.38.2/include/linux/cache.h
---- linux-2.6.38.2/include/linux/cache.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/cache.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/cache.h linux-2.6.38.7/include/linux/cache.h
+--- linux-2.6.38.7/include/linux/cache.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/cache.h	2011-04-28 19:34:15.000000000 -0400
 @@ -16,6 +16,10 @@
  #define __read_mostly
  #endif
@@ -45540,9 +53787,9 @@ diff -urNp linux-2.6.38.2/include/linux/cache.h linux-2.6.38.2/include/linux/cac
  #ifndef ____cacheline_aligned
  #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
  #endif
-diff -urNp linux-2.6.38.2/include/linux/capability.h linux-2.6.38.2/include/linux/capability.h
---- linux-2.6.38.2/include/linux/capability.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/capability.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/capability.h linux-2.6.38.7/include/linux/capability.h
+--- linux-2.6.38.7/include/linux/capability.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/capability.h	2011-04-28 19:34:15.000000000 -0400
 @@ -561,6 +561,7 @@ extern const kernel_cap_t __cap_init_eff
  	(security_real_capable_noaudit((t), (cap)) == 0)
  
@@ -45551,9 +53798,9 @@ diff -urNp linux-2.6.38.2/include/linux/capability.h linux-2.6.38.2/include/linu
  
  /* audit system wants to get cap info from files as well */
  struct dentry;
-diff -urNp linux-2.6.38.2/include/linux/compiler-gcc4.h linux-2.6.38.2/include/linux/compiler-gcc4.h
---- linux-2.6.38.2/include/linux/compiler-gcc4.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/compiler-gcc4.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/compiler-gcc4.h linux-2.6.38.7/include/linux/compiler-gcc4.h
+--- linux-2.6.38.7/include/linux/compiler-gcc4.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/compiler-gcc4.h	2011-04-28 19:34:15.000000000 -0400
 @@ -54,6 +54,10 @@
  
  #endif
@@ -45565,9 +53812,9 @@ diff -urNp linux-2.6.38.2/include/linux/compiler-gcc4.h linux-2.6.38.2/include/l
  #endif
  
  #if __GNUC_MINOR__ > 0
-diff -urNp linux-2.6.38.2/include/linux/compiler.h linux-2.6.38.2/include/linux/compiler.h
---- linux-2.6.38.2/include/linux/compiler.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/compiler.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/compiler.h linux-2.6.38.7/include/linux/compiler.h
+--- linux-2.6.38.7/include/linux/compiler.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/compiler.h	2011-04-28 19:34:15.000000000 -0400
 @@ -273,6 +273,22 @@ void ftrace_likely_update(struct ftrace_
  #define __cold
  #endif
@@ -45600,9 +53847,9 @@ diff -urNp linux-2.6.38.2/include/linux/compiler.h linux-2.6.38.2/include/linux/
 +#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
  
  #endif /* __LINUX_COMPILER_H */
-diff -urNp linux-2.6.38.2/include/linux/cpuset.h linux-2.6.38.2/include/linux/cpuset.h
---- linux-2.6.38.2/include/linux/cpuset.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/cpuset.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/cpuset.h linux-2.6.38.7/include/linux/cpuset.h
+--- linux-2.6.38.7/include/linux/cpuset.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/cpuset.h	2011-04-28 19:34:15.000000000 -0400
 @@ -118,7 +118,7 @@ static inline void put_mems_allowed(void
  	 * nodemask.
  	 */
@@ -45612,9 +53859,9 @@ diff -urNp linux-2.6.38.2/include/linux/cpuset.h linux-2.6.38.2/include/linux/cp
  }
  
  static inline void set_mems_allowed(nodemask_t nodemask)
-diff -urNp linux-2.6.38.2/include/linux/decompress/mm.h linux-2.6.38.2/include/linux/decompress/mm.h
---- linux-2.6.38.2/include/linux/decompress/mm.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/decompress/mm.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/decompress/mm.h linux-2.6.38.7/include/linux/decompress/mm.h
+--- linux-2.6.38.7/include/linux/decompress/mm.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/decompress/mm.h	2011-04-28 19:34:15.000000000 -0400
 @@ -77,7 +77,7 @@ static void free(void *where)
   * warnings when not needed (indeed large_malloc / large_free are not
   * needed by inflate */
@@ -45624,9 +53871,9 @@ diff -urNp linux-2.6.38.2/include/linux/decompress/mm.h linux-2.6.38.2/include/l
  #define free(a) kfree(a)
  
  #define large_malloc(a) vmalloc(a)
-diff -urNp linux-2.6.38.2/include/linux/dma-mapping.h linux-2.6.38.2/include/linux/dma-mapping.h
---- linux-2.6.38.2/include/linux/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/dma-mapping.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/dma-mapping.h linux-2.6.38.7/include/linux/dma-mapping.h
+--- linux-2.6.38.7/include/linux/dma-mapping.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/dma-mapping.h	2011-04-28 19:34:15.000000000 -0400
 @@ -16,40 +16,40 @@ enum dma_data_direction {
  };
  
@@ -45682,9 +53929,9 @@ diff -urNp linux-2.6.38.2/include/linux/dma-mapping.h linux-2.6.38.2/include/lin
  };
  
  #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
-diff -urNp linux-2.6.38.2/include/linux/elf.h linux-2.6.38.2/include/linux/elf.h
---- linux-2.6.38.2/include/linux/elf.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/elf.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/elf.h linux-2.6.38.7/include/linux/elf.h
+--- linux-2.6.38.7/include/linux/elf.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/elf.h	2011-04-28 19:34:15.000000000 -0400
 @@ -49,6 +49,17 @@ typedef __s64	Elf64_Sxword;
  #define PT_GNU_EH_FRAME		0x6474e550
  
@@ -45757,9 +54004,30 @@ diff -urNp linux-2.6.38.2/include/linux/elf.h linux-2.6.38.2/include/linux/elf.h
  
  #endif
  
-diff -urNp linux-2.6.38.2/include/linux/fs.h linux-2.6.38.2/include/linux/fs.h
---- linux-2.6.38.2/include/linux/fs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/fs.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/fscache-cache.h linux-2.6.38.7/include/linux/fscache-cache.h
+--- linux-2.6.38.7/include/linux/fscache-cache.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/fscache-cache.h	2011-04-28 19:57:25.000000000 -0400
+@@ -113,7 +113,7 @@ struct fscache_operation {
+ #endif
+ };
+ 
+-extern atomic_t fscache_op_debug_id;
++extern atomic_unchecked_t fscache_op_debug_id;
+ extern void fscache_op_work_func(struct work_struct *work);
+ 
+ extern void fscache_enqueue_operation(struct fscache_operation *);
+@@ -133,7 +133,7 @@ static inline void fscache_operation_ini
+ {
+ 	INIT_WORK(&op->work, fscache_op_work_func);
+ 	atomic_set(&op->usage, 1);
+-	op->debug_id = atomic_inc_return(&fscache_op_debug_id);
++	op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
+ 	op->processor = processor;
+ 	op->release = release;
+ 	INIT_LIST_HEAD(&op->pend_link);
+diff -urNp linux-2.6.38.7/include/linux/fs.h linux-2.6.38.7/include/linux/fs.h
+--- linux-2.6.38.7/include/linux/fs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/fs.h	2011-04-28 19:34:15.000000000 -0400
 @@ -105,6 +105,11 @@ struct inodes_stat_t {
  /* File was opened by fanotify and shouldn't generate fanotify events */
  #define FMODE_NONOTIFY		((__force fmode_t)0x1000000)
@@ -45908,9 +54176,9 @@ diff -urNp linux-2.6.38.2/include/linux/fs.h linux-2.6.38.2/include/linux/fs.h
  };
  
  /*
-diff -urNp linux-2.6.38.2/include/linux/fs_struct.h linux-2.6.38.2/include/linux/fs_struct.h
---- linux-2.6.38.2/include/linux/fs_struct.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/fs_struct.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/fs_struct.h linux-2.6.38.7/include/linux/fs_struct.h
+--- linux-2.6.38.7/include/linux/fs_struct.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/fs_struct.h	2011-04-28 19:34:15.000000000 -0400
 @@ -6,7 +6,7 @@
  #include <linux/seqlock.h>
  
@@ -45920,9 +54188,21 @@ diff -urNp linux-2.6.38.2/include/linux/fs_struct.h linux-2.6.38.2/include/linux
  	spinlock_t lock;
  	seqcount_t seq;
  	int umask;
-diff -urNp linux-2.6.38.2/include/linux/genhd.h linux-2.6.38.2/include/linux/genhd.h
---- linux-2.6.38.2/include/linux/genhd.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/genhd.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/ftrace_event.h linux-2.6.38.7/include/linux/ftrace_event.h
+--- linux-2.6.38.7/include/linux/ftrace_event.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/ftrace_event.h	2011-05-02 19:07:09.000000000 -0400
+@@ -236,7 +236,7 @@ extern int trace_define_field(struct ftr
+ extern int trace_add_event_call(struct ftrace_event_call *call);
+ extern void trace_remove_event_call(struct ftrace_event_call *call);
+ 
+-#define is_signed_type(type)	(((type)(-1)) < 0)
++#define is_signed_type(type)	(((type)(-1)) < (type)1)
+ 
+ int trace_set_clr_event(const char *system, const char *event, int set);
+ 
+diff -urNp linux-2.6.38.7/include/linux/genhd.h linux-2.6.38.7/include/linux/genhd.h
+--- linux-2.6.38.7/include/linux/genhd.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/genhd.h	2011-04-28 19:34:15.000000000 -0400
 @@ -183,7 +183,7 @@ struct gendisk {
  	struct kobject *slave_dir;
  
@@ -45932,9 +54212,9 @@ diff -urNp linux-2.6.38.2/include/linux/genhd.h linux-2.6.38.2/include/linux/gen
  	struct disk_events *ev;
  #ifdef  CONFIG_BLK_DEV_INTEGRITY
  	struct blk_integrity *integrity;
-diff -urNp linux-2.6.38.2/include/linux/gracl.h linux-2.6.38.2/include/linux/gracl.h
---- linux-2.6.38.2/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/gracl.h	2011-03-26 14:27:27.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/gracl.h linux-2.6.38.7/include/linux/gracl.h
+--- linux-2.6.38.7/include/linux/gracl.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/gracl.h	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,317 @@
 +#ifndef GR_ACL_H
 +#define GR_ACL_H
@@ -46253,9 +54533,9 @@ diff -urNp linux-2.6.38.2/include/linux/gracl.h linux-2.6.38.2/include/linux/gra
 +
 +#endif
 +
-diff -urNp linux-2.6.38.2/include/linux/gralloc.h linux-2.6.38.2/include/linux/gralloc.h
---- linux-2.6.38.2/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/gralloc.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/gralloc.h linux-2.6.38.7/include/linux/gralloc.h
+--- linux-2.6.38.7/include/linux/gralloc.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/gralloc.h	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,9 @@
 +#ifndef __GRALLOC_H
 +#define __GRALLOC_H
@@ -46266,9 +54546,9 @@ diff -urNp linux-2.6.38.2/include/linux/gralloc.h linux-2.6.38.2/include/linux/g
 +void *acl_alloc_num(unsigned long num, unsigned long len);
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/grdefs.h linux-2.6.38.2/include/linux/grdefs.h
---- linux-2.6.38.2/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/grdefs.h	2011-03-26 16:39:14.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/grdefs.h linux-2.6.38.7/include/linux/grdefs.h
+--- linux-2.6.38.7/include/linux/grdefs.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/grdefs.h	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,139 @@
 +#ifndef GRDEFS_H
 +#define GRDEFS_H
@@ -46409,10 +54689,10 @@ diff -urNp linux-2.6.38.2/include/linux/grdefs.h linux-2.6.38.2/include/linux/gr
 +};
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/grinternal.h linux-2.6.38.2/include/linux/grinternal.h
---- linux-2.6.38.2/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/grinternal.h	2011-03-26 16:51:07.000000000 -0400
-@@ -0,0 +1,217 @@
+diff -urNp linux-2.6.38.7/include/linux/grinternal.h linux-2.6.38.7/include/linux/grinternal.h
+--- linux-2.6.38.7/include/linux/grinternal.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/grinternal.h	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,219 @@
 +#ifndef __GRINTERNAL_H
 +#define __GRINTERNAL_H
 +
@@ -46569,6 +54849,7 @@ diff -urNp linux-2.6.38.2/include/linux/grinternal.h linux-2.6.38.2/include/linu
 +	GR_STR_INT,
 +	GR_TWO_STR_INT,
 +	GR_TWO_INT,
++	GR_TWO_U64,
 +	GR_THREE_INT,
 +	GR_FIVE_INT_TWO_STR,
 +	GR_TWO_STR,
@@ -46604,6 +54885,7 @@ diff -urNp linux-2.6.38.2/include/linux/grinternal.h linux-2.6.38.2/include/linu
 +#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
 +#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
 +#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
++#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
 +#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
 +#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
 +#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
@@ -46630,10 +54912,10 @@ diff -urNp linux-2.6.38.2/include/linux/grinternal.h linux-2.6.38.2/include/linu
 +#endif
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/grmsg.h linux-2.6.38.2/include/linux/grmsg.h
---- linux-2.6.38.2/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/grmsg.h	2011-03-26 16:52:08.000000000 -0400
-@@ -0,0 +1,112 @@
+diff -urNp linux-2.6.38.7/include/linux/grmsg.h linux-2.6.38.7/include/linux/grmsg.h
+--- linux-2.6.38.7/include/linux/grmsg.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/grmsg.h	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,108 @@
 +#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
 +#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
@@ -46645,10 +54927,7 @@ diff -urNp linux-2.6.38.2/include/linux/grmsg.h linux-2.6.38.2/include/linux/grm
 +#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
 +#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
 +#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
-+#define GR_KMEM_MSG "denied write of /dev/kmem by "
-+#define GR_PORT_OPEN_MSG "denied open of /dev/port by "
-+#define GR_MEM_WRITE_MSG "denied write of /dev/mem by "
-+#define GR_MEM_MMAP_MSG "denied mmap write of /dev/[k]mem by "
++#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
 +#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
 +#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
 +#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
@@ -46742,14 +55021,13 @@ diff -urNp linux-2.6.38.2/include/linux/grmsg.h linux-2.6.38.2/include/linux/grm
 +#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
 +#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
 +#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
-+#define GR_NONROOT_MODLOAD_MSG "denied kernel module auto-load of %.64s by "
 +#define GR_VM86_MSG "denied use of vm86 by "
 +#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
 +#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
-diff -urNp linux-2.6.38.2/include/linux/grsecurity.h linux-2.6.38.2/include/linux/grsecurity.h
---- linux-2.6.38.2/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/grsecurity.h	2011-03-26 19:58:41.000000000 -0400
-@@ -0,0 +1,215 @@
+diff -urNp linux-2.6.38.7/include/linux/grsecurity.h linux-2.6.38.7/include/linux/grsecurity.h
+--- linux-2.6.38.7/include/linux/grsecurity.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/grsecurity.h	2011-04-28 19:34:15.000000000 -0400
+@@ -0,0 +1,212 @@
 +#ifndef GR_SECURITY_H
 +#define GR_SECURITY_H
 +#include <linux/fs.h>
@@ -46775,8 +55053,10 @@ diff -urNp linux-2.6.38.2/include/linux/grsecurity.h linux-2.6.38.2/include/linu
 +#error "CONFIG_PAX enabled, but no PaX options are enabled."
 +#endif
 +
-+void gr_handle_brute_attach(struct task_struct *p);
++void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
 +void gr_handle_brute_check(void);
++void gr_handle_kernel_exploit(void);
++int gr_process_user_ban(void);
 +
 +char gr_roletype_to_char(void);
 +
@@ -46952,22 +55232,17 @@ diff -urNp linux-2.6.38.2/include/linux/grsecurity.h linux-2.6.38.2/include/linu
 +
 +#ifdef CONFIG_GRKERNSEC
 +void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
-+void gr_log_nonroot_mod_load(const char *modname);
 +void gr_handle_vm86(void);
-+void gr_handle_mem_write(void);
-+void gr_handle_kmem_write(void);
-+void gr_handle_open_port(void);
-+int gr_handle_mem_mmap(const unsigned long offset,
-+			      struct vm_area_struct *vma);
++void gr_handle_mem_readwrite(u64 from, u64 to);
 +
 +extern int grsec_enable_dmesg;
 +extern int grsec_disable_privio;
 +#endif
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/grsock.h linux-2.6.38.2/include/linux/grsock.h
---- linux-2.6.38.2/include/linux/grsock.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/grsock.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/grsock.h linux-2.6.38.7/include/linux/grsock.h
+--- linux-2.6.38.7/include/linux/grsock.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/grsock.h	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,19 @@
 +#ifndef __GRSOCK_H
 +#define __GRSOCK_H
@@ -46988,9 +55263,9 @@ diff -urNp linux-2.6.38.2/include/linux/grsock.h linux-2.6.38.2/include/linux/gr
 +			    const int protocol);
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/highmem.h linux-2.6.38.2/include/linux/highmem.h
---- linux-2.6.38.2/include/linux/highmem.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/highmem.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/highmem.h linux-2.6.38.7/include/linux/highmem.h
+--- linux-2.6.38.7/include/linux/highmem.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/highmem.h	2011-04-28 19:34:15.000000000 -0400
 @@ -185,6 +185,18 @@ static inline void clear_highpage(struct
  	kunmap_atomic(kaddr, KM_USER0);
  }
@@ -47010,9 +55285,21 @@ diff -urNp linux-2.6.38.2/include/linux/highmem.h linux-2.6.38.2/include/linux/h
  static inline void zero_user_segments(struct page *page,
  	unsigned start1, unsigned end1,
  	unsigned start2, unsigned end2)
-diff -urNp linux-2.6.38.2/include/linux/init.h linux-2.6.38.2/include/linux/init.h
---- linux-2.6.38.2/include/linux/init.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/init.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/i2o.h linux-2.6.38.7/include/linux/i2o.h
+--- linux-2.6.38.7/include/linux/i2o.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/i2o.h	2011-04-28 19:57:25.000000000 -0400
+@@ -564,7 +564,7 @@ struct i2o_controller {
+ 	struct i2o_device *exec;	/* Executive */
+ #if BITS_PER_LONG == 64
+ 	spinlock_t context_list_lock;	/* lock for context_list */
+-	atomic_t context_list_counter;	/* needed for unique contexts */
++	atomic_unchecked_t context_list_counter;	/* needed for unique contexts */
+ 	struct list_head context_list;	/* list of context id's
+ 					   and pointers */
+ #endif
+diff -urNp linux-2.6.38.7/include/linux/init.h linux-2.6.38.7/include/linux/init.h
+--- linux-2.6.38.7/include/linux/init.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/init.h	2011-04-28 19:34:15.000000000 -0400
 @@ -293,13 +293,13 @@ void __init parse_early_options(char *cm
  
  /* Each module must use one module_init(). */
@@ -47029,9 +55316,33 @@ diff -urNp linux-2.6.38.2/include/linux/init.h linux-2.6.38.2/include/linux/init
  	{ return exitfn; }					\
  	void cleanup_module(void) __attribute__((alias(#exitfn)));
  
-diff -urNp linux-2.6.38.2/include/linux/interrupt.h linux-2.6.38.2/include/linux/interrupt.h
---- linux-2.6.38.2/include/linux/interrupt.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/interrupt.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/init_task.h linux-2.6.38.7/include/linux/init_task.h
+--- linux-2.6.38.7/include/linux/init_task.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/init_task.h	2011-04-30 19:59:43.000000000 -0400
+@@ -83,6 +83,12 @@ extern struct group_info init_groups;
+ #define INIT_IDS
+ #endif
+ 
++#ifdef CONFIG_X86
++#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
++#else
++#define INIT_TASK_THREAD_INFO
++#endif
++
+ /*
+  * Because of the reduced scope of CAP_SETPCAP when filesystem
+  * capabilities are in effect, it is safe to allow CAP_SETPCAP to
+@@ -163,6 +169,7 @@ extern struct cred init_cred;
+ 	RCU_INIT_POINTER(.cred, &init_cred),				\
+ 	.comm		= "swapper",					\
+ 	.thread		= INIT_THREAD,					\
++	INIT_TASK_THREAD_INFO						\
+ 	.fs		= &init_fs,					\
+ 	.files		= &init_files,					\
+ 	.signal		= &init_signals,				\
+diff -urNp linux-2.6.38.7/include/linux/interrupt.h linux-2.6.38.7/include/linux/interrupt.h
+--- linux-2.6.38.7/include/linux/interrupt.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/interrupt.h	2011-04-28 19:34:15.000000000 -0400
 @@ -393,7 +393,7 @@ enum
  /* map softirq index to softirq name. update 'softirq_to_name' in
   * kernel/softirq.c when adding a new softirq.
@@ -47056,33 +55367,9 @@ diff -urNp linux-2.6.38.2/include/linux/interrupt.h linux-2.6.38.2/include/linux
  extern void softirq_init(void);
  static inline void __raise_softirq_irqoff(unsigned int nr)
  {
-diff -urNp linux-2.6.38.2/include/linux/jbd2.h linux-2.6.38.2/include/linux/jbd2.h
---- linux-2.6.38.2/include/linux/jbd2.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/jbd2.h	2011-03-21 18:31:35.000000000 -0400
-@@ -67,7 +67,7 @@ extern u8 jbd2_journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- extern void *jbd2_alloc(size_t size, gfp_t flags);
-diff -urNp linux-2.6.38.2/include/linux/jbd.h linux-2.6.38.2/include/linux/jbd.h
---- linux-2.6.38.2/include/linux/jbd.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/jbd.h	2011-03-21 18:31:35.000000000 -0400
-@@ -67,7 +67,7 @@ extern u8 journal_enable_debug;
- 		}							\
- 	} while (0)
- #else
--#define jbd_debug(f, a...)	/**/
-+#define jbd_debug(f, a...)	do {} while (0)
- #endif
- 
- static inline void *jbd_alloc(size_t size, gfp_t flags)
-diff -urNp linux-2.6.38.2/include/linux/kallsyms.h linux-2.6.38.2/include/linux/kallsyms.h
---- linux-2.6.38.2/include/linux/kallsyms.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/kallsyms.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/kallsyms.h linux-2.6.38.7/include/linux/kallsyms.h
+--- linux-2.6.38.7/include/linux/kallsyms.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/kallsyms.h	2011-04-28 19:34:15.000000000 -0400
 @@ -15,7 +15,8 @@
  
  struct module;
@@ -47109,9 +55396,18 @@ diff -urNp linux-2.6.38.2/include/linux/kallsyms.h linux-2.6.38.2/include/linux/
  
  /* This macro allows us to keep printk typechecking */
  static void __check_printsym_format(const char *fmt, ...)
-diff -urNp linux-2.6.38.2/include/linux/kgdb.h linux-2.6.38.2/include/linux/kgdb.h
---- linux-2.6.38.2/include/linux/kgdb.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/kgdb.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/kgdb.h linux-2.6.38.7/include/linux/kgdb.h
+--- linux-2.6.38.7/include/linux/kgdb.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/kgdb.h	2011-04-28 19:57:25.000000000 -0400
+@@ -53,7 +53,7 @@ extern int kgdb_connected;
+ extern int kgdb_io_module_registered;
+ 
+ extern atomic_t			kgdb_setting_breakpoint;
+-extern atomic_t			kgdb_cpu_doing_single_step;
++extern atomic_unchecked_t	kgdb_cpu_doing_single_step;
+ 
+ extern struct task_struct	*kgdb_usethread;
+ extern struct task_struct	*kgdb_contthread;
 @@ -269,22 +269,22 @@ struct kgdb_arch {
   */
  struct kgdb_io {
@@ -47145,9 +55441,21 @@ diff -urNp linux-2.6.38.2/include/linux/kgdb.h linux-2.6.38.2/include/linux/kgdb
  
  extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
  extern char *kgdb_mem2hex(char *mem, char *buf, int count);
-diff -urNp linux-2.6.38.2/include/linux/kvm_host.h linux-2.6.38.2/include/linux/kvm_host.h
---- linux-2.6.38.2/include/linux/kvm_host.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/kvm_host.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/kmod.h linux-2.6.38.7/include/linux/kmod.h
+--- linux-2.6.38.7/include/linux/kmod.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/kmod.h	2011-04-28 19:34:15.000000000 -0400
+@@ -33,6 +33,8 @@ extern char modprobe_path[]; /* for sysc
+  * usually useless though. */
+ extern int __request_module(bool wait, const char *name, ...) \
+ 	__attribute__((format(printf, 2, 3)));
++extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
++	__attribute__((format(printf, 3, 4)));
+ #define request_module(mod...) __request_module(true, mod)
+ #define request_module_nowait(mod...) __request_module(false, mod)
+ #define try_then_request_module(x, mod...) \
+diff -urNp linux-2.6.38.7/include/linux/kvm_host.h linux-2.6.38.7/include/linux/kvm_host.h
+--- linux-2.6.38.7/include/linux/kvm_host.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/kvm_host.h	2011-04-28 19:34:15.000000000 -0400
 @@ -288,7 +288,7 @@ void kvm_vcpu_uninit(struct kvm_vcpu *vc
  void vcpu_load(struct kvm_vcpu *vcpu);
  void vcpu_put(struct kvm_vcpu *vcpu);
@@ -47166,25 +55474,10 @@ diff -urNp linux-2.6.38.2/include/linux/kvm_host.h linux-2.6.38.2/include/linux/
  void kvm_arch_exit(void);
  
  int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
-diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/libata.h
---- linux-2.6.38.2/include/linux/libata.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/libata.h	2011-03-21 18:31:35.000000000 -0400
-@@ -65,11 +65,11 @@
- #ifdef ATA_VERBOSE_DEBUG
- #define VPRINTK(fmt, args...) printk(KERN_ERR "%s: " fmt, __func__, ## args)
- #else
--#define VPRINTK(fmt, args...)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_VERBOSE_DEBUG */
- #else
--#define DPRINTK(fmt, args...)
--#define VPRINTK(fmt, args...)
-+#define DPRINTK(fmt, args...) do {} while (0)
-+#define VPRINTK(fmt, args...) do {} while (0)
- #endif	/* ATA_DEBUG */
- 
- #define BPRINTK(fmt, args...) if (ap->flags & ATA_FLAG_DEBUGMSG) printk(KERN_ERR "%s: " fmt, __func__, ## args)
-@@ -530,11 +530,11 @@ struct ata_ioports {
+diff -urNp linux-2.6.38.7/include/linux/libata.h linux-2.6.38.7/include/linux/libata.h
+--- linux-2.6.38.7/include/linux/libata.h	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/include/linux/libata.h	2011-05-10 22:06:56.000000000 -0400
+@@ -531,11 +531,11 @@ struct ata_ioports {
  
  struct ata_host {
  	spinlock_t		lock;
@@ -47198,7 +55491,7 @@ diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/li
  	unsigned long		flags;
  
  	struct mutex		eh_mutex;
-@@ -725,7 +725,7 @@ struct ata_link {
+@@ -726,7 +726,7 @@ struct ata_link {
  
  struct ata_port {
  	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
@@ -47207,7 +55500,7 @@ diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/li
  	spinlock_t		*lock;
  	/* Flags owned by the EH context. Only EH should touch these once the
  	   port is active */
-@@ -913,7 +913,7 @@ struct ata_port_info {
+@@ -914,7 +914,7 @@ struct ata_port_info {
  	unsigned long		pio_mask;
  	unsigned long		mwdma_mask;
  	unsigned long		udma_mask;
@@ -47216,7 +55509,7 @@ diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/li
  	void 			*private_data;
  };
  
-@@ -937,7 +937,7 @@ extern const unsigned long sata_deb_timi
+@@ -938,7 +938,7 @@ extern const unsigned long sata_deb_timi
  extern const unsigned long sata_deb_timing_hotplug[];
  extern const unsigned long sata_deb_timing_long[];
  
@@ -47225,7 +55518,7 @@ diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/li
  extern const struct ata_port_info ata_dummy_port_info;
  
  static inline const unsigned long *
-@@ -983,7 +983,7 @@ extern int ata_host_activate(struct ata_
+@@ -984,7 +984,7 @@ extern int ata_host_activate(struct ata_
  			     struct scsi_host_template *sht);
  extern void ata_host_detach(struct ata_host *host);
  extern void ata_host_init(struct ata_host *, struct device *,
@@ -47234,9 +55527,9 @@ diff -urNp linux-2.6.38.2/include/linux/libata.h linux-2.6.38.2/include/linux/li
  extern int ata_scsi_detect(struct scsi_host_template *sht);
  extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
  extern int ata_scsi_queuecmd(struct Scsi_Host *h, struct scsi_cmnd *cmd);
-diff -urNp linux-2.6.38.2/include/linux/lockd/bind.h linux-2.6.38.2/include/linux/lockd/bind.h
---- linux-2.6.38.2/include/linux/lockd/bind.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/lockd/bind.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/lockd/bind.h linux-2.6.38.7/include/linux/lockd/bind.h
+--- linux-2.6.38.7/include/linux/lockd/bind.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/lockd/bind.h	2011-04-28 19:34:15.000000000 -0400
 @@ -23,13 +23,13 @@ struct svc_rqst;
   * This is the set of functions for lockd->nfsd communication
   */
@@ -47254,9 +55547,9 @@ diff -urNp linux-2.6.38.2/include/linux/lockd/bind.h linux-2.6.38.2/include/linu
  
  /*
   * Similar to nfs_client_initdata, but without the NFS-specific
-diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
---- linux-2.6.38.2/include/linux/mm.h	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/include/linux/mm.h	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mm.h linux-2.6.38.7/include/linux/mm.h
+--- linux-2.6.38.7/include/linux/mm.h	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/include/linux/mm.h	2011-05-22 23:06:04.000000000 -0400
 @@ -113,7 +113,14 @@ extern unsigned int kobjsize(const void 
  
  #define VM_CAN_NONLINEAR 0x08000000	/* Has ->fault & does nonlinear pages */
@@ -47272,20 +55565,42 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
  #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
  
-@@ -992,12 +999,6 @@ int set_page_dirty(struct page *page);
+@@ -993,34 +1000,6 @@ int set_page_dirty(struct page *page);
  int set_page_dirty_lock(struct page *page);
  int clear_page_dirty_for_io(struct page *page);
  
 -/* Is the vma a continuation of the stack vma above it? */
--static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
+-static inline int vma_growsdown(struct vm_area_struct *vma, unsigned long addr)
 -{
 -	return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
 -}
 -
+-static inline int stack_guard_page_start(struct vm_area_struct *vma,
+-					     unsigned long addr)
+-{
+-	return (vma->vm_flags & VM_GROWSDOWN) &&
+-		(vma->vm_start == addr) &&
+-		!vma_growsdown(vma->vm_prev, addr);
+-}
+-
+-/* Is the vma a continuation of the stack vma below it? */
+-static inline int vma_growsup(struct vm_area_struct *vma, unsigned long addr)
+-{
+-	return vma && (vma->vm_start == addr) && (vma->vm_flags & VM_GROWSUP);
+-}
+-
+-static inline int stack_guard_page_end(struct vm_area_struct *vma,
+-					   unsigned long addr)
+-{
+-	return (vma->vm_flags & VM_GROWSUP) &&
+-		(vma->vm_end == addr) &&
+-		!vma_growsup(vma->vm_next, addr);
+-}
+-
  extern unsigned long move_page_tables(struct vm_area_struct *vma,
  		unsigned long old_addr, struct vm_area_struct *new_vma,
  		unsigned long new_addr, unsigned long len);
-@@ -1149,6 +1150,15 @@ struct shrinker {
+@@ -1172,6 +1151,15 @@ struct shrinker {
  extern void register_shrinker(struct shrinker *);
  extern void unregister_shrinker(struct shrinker *);
  
@@ -47301,7 +55616,7 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  int vma_wants_writenotify(struct vm_area_struct *vma);
  
  extern pte_t *__get_locked_pte(struct mm_struct *mm, unsigned long addr,
-@@ -1438,6 +1448,7 @@ out:
+@@ -1461,6 +1449,7 @@ out:
  }
  
  extern int do_munmap(struct mm_struct *, unsigned long, size_t);
@@ -47309,7 +55624,7 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  
  extern unsigned long do_brk(unsigned long, unsigned long);
  
-@@ -1494,6 +1505,10 @@ extern struct vm_area_struct * find_vma(
+@@ -1517,6 +1506,10 @@ extern struct vm_area_struct * find_vma(
  extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
  					     struct vm_area_struct **pprev);
  
@@ -47320,7 +55635,7 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
     NULL if none.  Assume start_addr < end_addr. */
  static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
-@@ -1510,15 +1525,6 @@ static inline unsigned long vma_pages(st
+@@ -1533,15 +1526,6 @@ static inline unsigned long vma_pages(st
  	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
  }
  
@@ -47336,7 +55651,7 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
  int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
  			unsigned long pfn, unsigned long size, pgprot_t);
-@@ -1627,7 +1633,7 @@ extern int unpoison_memory(unsigned long
+@@ -1650,7 +1634,7 @@ extern int unpoison_memory(unsigned long
  extern int sysctl_memory_failure_early_kill;
  extern int sysctl_memory_failure_recovery;
  extern void shake_page(struct page *p, int access);
@@ -47345,7 +55660,7 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
  extern int soft_offline_page(struct page *page, int flags);
  #ifdef CONFIG_MEMORY_FAILURE
  int is_hwpoison_address(unsigned long addr);
-@@ -1649,5 +1655,11 @@ extern void copy_user_huge_page(struct p
+@@ -1672,5 +1656,11 @@ extern void copy_user_huge_page(struct p
  				unsigned int pages_per_huge_page);
  #endif /* CONFIG_TRANSPARENT_HUGEPAGE || CONFIG_HUGETLBFS */
  
@@ -47357,9 +55672,9 @@ diff -urNp linux-2.6.38.2/include/linux/mm.h linux-2.6.38.2/include/linux/mm.h
 +
  #endif /* __KERNEL__ */
  #endif /* _LINUX_MM_H */
-diff -urNp linux-2.6.38.2/include/linux/mm_types.h linux-2.6.38.2/include/linux/mm_types.h
---- linux-2.6.38.2/include/linux/mm_types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/mm_types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mm_types.h linux-2.6.38.7/include/linux/mm_types.h
+--- linux-2.6.38.7/include/linux/mm_types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/mm_types.h	2011-04-28 19:34:15.000000000 -0400
 @@ -183,6 +183,8 @@ struct vm_area_struct {
  #ifdef CONFIG_NUMA
  	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
@@ -47394,9 +55709,9 @@ diff -urNp linux-2.6.38.2/include/linux/mm_types.h linux-2.6.38.2/include/linux/
  };
  
  /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
-diff -urNp linux-2.6.38.2/include/linux/mmu_notifier.h linux-2.6.38.2/include/linux/mmu_notifier.h
---- linux-2.6.38.2/include/linux/mmu_notifier.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/mmu_notifier.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mmu_notifier.h linux-2.6.38.7/include/linux/mmu_notifier.h
+--- linux-2.6.38.7/include/linux/mmu_notifier.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/mmu_notifier.h	2011-04-28 19:34:15.000000000 -0400
 @@ -255,12 +255,12 @@ static inline void mmu_notifier_mm_destr
   */
  #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
@@ -47413,9 +55728,9 @@ diff -urNp linux-2.6.38.2/include/linux/mmu_notifier.h linux-2.6.38.2/include/li
  })
  
  #define pmdp_clear_flush_notify(__vma, __address, __pmdp)		\
-diff -urNp linux-2.6.38.2/include/linux/mmzone.h linux-2.6.38.2/include/linux/mmzone.h
---- linux-2.6.38.2/include/linux/mmzone.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/mmzone.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mmzone.h linux-2.6.38.7/include/linux/mmzone.h
+--- linux-2.6.38.7/include/linux/mmzone.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/mmzone.h	2011-04-28 19:34:15.000000000 -0400
 @@ -355,7 +355,7 @@ struct zone {
  	unsigned long		flags;		   /* zone flags, see below */
  
@@ -47425,9 +55740,9 @@ diff -urNp linux-2.6.38.2/include/linux/mmzone.h linux-2.6.38.2/include/linux/mm
  
  	/*
  	 * The target ratio of ACTIVE_ANON to INACTIVE_ANON pages on
-diff -urNp linux-2.6.38.2/include/linux/mod_devicetable.h linux-2.6.38.2/include/linux/mod_devicetable.h
---- linux-2.6.38.2/include/linux/mod_devicetable.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/mod_devicetable.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mod_devicetable.h linux-2.6.38.7/include/linux/mod_devicetable.h
+--- linux-2.6.38.7/include/linux/mod_devicetable.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/mod_devicetable.h	2011-04-28 19:34:15.000000000 -0400
 @@ -12,7 +12,7 @@
  typedef unsigned long kernel_ulong_t;
  #endif
@@ -47446,9 +55761,9 @@ diff -urNp linux-2.6.38.2/include/linux/mod_devicetable.h linux-2.6.38.2/include
  
  struct hid_device_id {
  	__u16 bus;
-diff -urNp linux-2.6.38.2/include/linux/module.h linux-2.6.38.2/include/linux/module.h
---- linux-2.6.38.2/include/linux/module.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/module.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/module.h linux-2.6.38.7/include/linux/module.h
+--- linux-2.6.38.7/include/linux/module.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/module.h	2011-04-28 19:34:15.000000000 -0400
 @@ -324,19 +324,16 @@ struct module
  	int (*init)(void);
  
@@ -47524,9 +55839,9 @@ diff -urNp linux-2.6.38.2/include/linux/module.h linux-2.6.38.2/include/linux/mo
  }
  
  /* Search for module by name: must hold module_mutex. */
-diff -urNp linux-2.6.38.2/include/linux/moduleloader.h linux-2.6.38.2/include/linux/moduleloader.h
---- linux-2.6.38.2/include/linux/moduleloader.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/moduleloader.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/moduleloader.h linux-2.6.38.7/include/linux/moduleloader.h
+--- linux-2.6.38.7/include/linux/moduleloader.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/moduleloader.h	2011-04-28 19:34:15.000000000 -0400
 @@ -20,9 +20,21 @@ unsigned int arch_mod_section_prepend(st
     sections.  Returns NULL on failure. */
  void *module_alloc(unsigned long size);
@@ -47549,9 +55864,9 @@ diff -urNp linux-2.6.38.2/include/linux/moduleloader.h linux-2.6.38.2/include/li
  /* Apply the given relocation to the (simplified) ELF.  Return -error
     or 0. */
  int apply_relocate(Elf_Shdr *sechdrs,
-diff -urNp linux-2.6.38.2/include/linux/moduleparam.h linux-2.6.38.2/include/linux/moduleparam.h
---- linux-2.6.38.2/include/linux/moduleparam.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/moduleparam.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/moduleparam.h linux-2.6.38.7/include/linux/moduleparam.h
+--- linux-2.6.38.7/include/linux/moduleparam.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/moduleparam.h	2011-04-28 19:34:15.000000000 -0400
 @@ -255,7 +255,7 @@ static inline void __kernel_param_unlock
   * @len is usually just sizeof(string).
   */
@@ -47570,9 +55885,21 @@ diff -urNp linux-2.6.38.2/include/linux/moduleparam.h linux-2.6.38.2/include/lin
  	= { ARRAY_SIZE(array), nump, &param_ops_##type,			\
  	    sizeof(array[0]), array };					\
  	__module_param_call(MODULE_PARAM_PREFIX, name,			\
-diff -urNp linux-2.6.38.2/include/linux/namei.h linux-2.6.38.2/include/linux/namei.h
---- linux-2.6.38.2/include/linux/namei.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/namei.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/mutex.h linux-2.6.38.7/include/linux/mutex.h
+--- linux-2.6.38.7/include/linux/mutex.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/mutex.h	2011-04-28 19:34:15.000000000 -0400
+@@ -51,7 +51,7 @@ struct mutex {
+ 	spinlock_t		wait_lock;
+ 	struct list_head	wait_list;
+ #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
+-	struct thread_info	*owner;
++	struct task_struct	*owner;
+ #endif
+ #ifdef CONFIG_DEBUG_MUTEXES
+ 	const char 		*name;
+diff -urNp linux-2.6.38.7/include/linux/namei.h linux-2.6.38.7/include/linux/namei.h
+--- linux-2.6.38.7/include/linux/namei.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/namei.h	2011-04-28 19:34:15.000000000 -0400
 @@ -25,7 +25,7 @@ struct nameidata {
  	unsigned	seq;
  	int		last_type;
@@ -47597,9 +55924,9 @@ diff -urNp linux-2.6.38.2/include/linux/namei.h linux-2.6.38.2/include/linux/nam
  {
  	return nd->saved_names[nd->depth];
  }
-diff -urNp linux-2.6.38.2/include/linux/netfilter/xt_gradm.h linux-2.6.38.2/include/linux/netfilter/xt_gradm.h
---- linux-2.6.38.2/include/linux/netfilter/xt_gradm.h	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/include/linux/netfilter/xt_gradm.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/netfilter/xt_gradm.h linux-2.6.38.7/include/linux/netfilter/xt_gradm.h
+--- linux-2.6.38.7/include/linux/netfilter/xt_gradm.h	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/include/linux/netfilter/xt_gradm.h	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,9 @@
 +#ifndef _LINUX_NETFILTER_XT_GRADM_H
 +#define _LINUX_NETFILTER_XT_GRADM_H 1
@@ -47610,9 +55937,9 @@ diff -urNp linux-2.6.38.2/include/linux/netfilter/xt_gradm.h linux-2.6.38.2/incl
 +};
 +
 +#endif
-diff -urNp linux-2.6.38.2/include/linux/oprofile.h linux-2.6.38.2/include/linux/oprofile.h
---- linux-2.6.38.2/include/linux/oprofile.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/oprofile.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/oprofile.h linux-2.6.38.7/include/linux/oprofile.h
+--- linux-2.6.38.7/include/linux/oprofile.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/oprofile.h	2011-04-28 19:34:15.000000000 -0400
 @@ -132,9 +132,9 @@ int oprofilefs_create_ulong(struct super
  int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
  	char const * name, ulong * val);
@@ -47625,9 +55952,46 @@ diff -urNp linux-2.6.38.2/include/linux/oprofile.h linux-2.6.38.2/include/linux/
   
  /** create a directory */
  struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
-diff -urNp linux-2.6.38.2/include/linux/pipe_fs_i.h linux-2.6.38.2/include/linux/pipe_fs_i.h
---- linux-2.6.38.2/include/linux/pipe_fs_i.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/pipe_fs_i.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/padata.h linux-2.6.38.7/include/linux/padata.h
+--- linux-2.6.38.7/include/linux/padata.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/padata.h	2011-04-28 19:57:25.000000000 -0400
+@@ -129,7 +129,7 @@ struct parallel_data {
+ 	struct padata_instance		*pinst;
+ 	struct padata_parallel_queue	__percpu *pqueue;
+ 	struct padata_serial_queue	__percpu *squeue;
+-	atomic_t			seq_nr;
++	atomic_unchecked_t		seq_nr;
+ 	atomic_t			reorder_objects;
+ 	atomic_t			refcnt;
+ 	unsigned int			max_seq_nr;
+diff -urNp linux-2.6.38.7/include/linux/perf_event.h linux-2.6.38.7/include/linux/perf_event.h
+--- linux-2.6.38.7/include/linux/perf_event.h	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/include/linux/perf_event.h	2011-04-28 19:57:25.000000000 -0400
+@@ -732,8 +732,8 @@ struct perf_event {
+ 
+ 	enum perf_event_active_state	state;
+ 	unsigned int			attach_state;
+-	local64_t			count;
+-	atomic64_t			child_count;
++	local64_t			count; /* PaX: fix it one day */
++	atomic64_unchecked_t		child_count;
+ 
+ 	/*
+ 	 * These are the total time in nanoseconds that the event
+@@ -784,8 +784,8 @@ struct perf_event {
+ 	 * These accumulate total time (in nanoseconds) that children
+ 	 * events have been enabled and running, respectively.
+ 	 */
+-	atomic64_t			child_total_time_enabled;
+-	atomic64_t			child_total_time_running;
++	atomic64_unchecked_t		child_total_time_enabled;
++	atomic64_unchecked_t		child_total_time_running;
+ 
+ 	/*
+ 	 * Protect attach/detach and child_list:
+diff -urNp linux-2.6.38.7/include/linux/pipe_fs_i.h linux-2.6.38.7/include/linux/pipe_fs_i.h
+--- linux-2.6.38.7/include/linux/pipe_fs_i.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/pipe_fs_i.h	2011-04-28 19:34:15.000000000 -0400
 @@ -46,9 +46,9 @@ struct pipe_buffer {
  struct pipe_inode_info {
  	wait_queue_head_t wait;
@@ -47641,9 +56005,9 @@ diff -urNp linux-2.6.38.2/include/linux/pipe_fs_i.h linux-2.6.38.2/include/linux
  	unsigned int r_counter;
  	unsigned int w_counter;
  	struct page *tmp_page;
-diff -urNp linux-2.6.38.2/include/linux/pm_runtime.h linux-2.6.38.2/include/linux/pm_runtime.h
---- linux-2.6.38.2/include/linux/pm_runtime.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/pm_runtime.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/pm_runtime.h linux-2.6.38.7/include/linux/pm_runtime.h
+--- linux-2.6.38.7/include/linux/pm_runtime.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/pm_runtime.h	2011-04-28 19:34:15.000000000 -0400
 @@ -89,7 +89,7 @@ static inline bool pm_runtime_enabled(st
  
  static inline void pm_runtime_mark_last_busy(struct device *dev)
@@ -47653,9 +56017,9 @@ diff -urNp linux-2.6.38.2/include/linux/pm_runtime.h linux-2.6.38.2/include/linu
  }
  
  #else /* !CONFIG_PM_RUNTIME */
-diff -urNp linux-2.6.38.2/include/linux/poison.h linux-2.6.38.2/include/linux/poison.h
---- linux-2.6.38.2/include/linux/poison.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/poison.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/poison.h linux-2.6.38.7/include/linux/poison.h
+--- linux-2.6.38.7/include/linux/poison.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/poison.h	2011-04-28 19:34:15.000000000 -0400
 @@ -19,8 +19,8 @@
   * under normal circumstances, used to verify that nobody uses
   * non-initialized list entries.
@@ -47667,9 +56031,9 @@ diff -urNp linux-2.6.38.2/include/linux/poison.h linux-2.6.38.2/include/linux/po
  
  /********** include/linux/timer.h **********/
  /*
-diff -urNp linux-2.6.38.2/include/linux/proc_fs.h linux-2.6.38.2/include/linux/proc_fs.h
---- linux-2.6.38.2/include/linux/proc_fs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/proc_fs.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/proc_fs.h linux-2.6.38.7/include/linux/proc_fs.h
+--- linux-2.6.38.7/include/linux/proc_fs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/proc_fs.h	2011-04-28 19:34:15.000000000 -0400
 @@ -155,6 +155,19 @@ static inline struct proc_dir_entry *pro
  	return proc_create_data(name, mode, parent, proc_fops, NULL);
  }
@@ -47690,9 +56054,9 @@ diff -urNp linux-2.6.38.2/include/linux/proc_fs.h linux-2.6.38.2/include/linux/p
  static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
  	mode_t mode, struct proc_dir_entry *base, 
  	read_proc_t *read_proc, void * data)
-diff -urNp linux-2.6.38.2/include/linux/ptrace.h linux-2.6.38.2/include/linux/ptrace.h
---- linux-2.6.38.2/include/linux/ptrace.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/ptrace.h	2011-03-26 11:36:13.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/ptrace.h linux-2.6.38.7/include/linux/ptrace.h
+--- linux-2.6.38.7/include/linux/ptrace.h	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/include/linux/ptrace.h	2011-05-22 23:06:04.000000000 -0400
 @@ -115,10 +115,10 @@ extern void __ptrace_unlink(struct task_
  extern void exit_ptrace(struct task_struct *tracer);
  #define PTRACE_MODE_READ   1
@@ -47706,9 +56070,9 @@ diff -urNp linux-2.6.38.2/include/linux/ptrace.h linux-2.6.38.2/include/linux/pt
  
  static inline int ptrace_reparented(struct task_struct *child)
  {
-diff -urNp linux-2.6.38.2/include/linux/random.h linux-2.6.38.2/include/linux/random.h
---- linux-2.6.38.2/include/linux/random.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/random.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/random.h linux-2.6.38.7/include/linux/random.h
+--- linux-2.6.38.7/include/linux/random.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/random.h	2011-04-28 19:34:15.000000000 -0400
 @@ -80,12 +80,17 @@ void srandom32(u32 seed);
  
  u32 prandom32(struct rnd_state *);
@@ -47728,9 +56092,47 @@ diff -urNp linux-2.6.38.2/include/linux/random.h linux-2.6.38.2/include/linux/ra
  }
  
  /**
-diff -urNp linux-2.6.38.2/include/linux/reiserfs_fs.h linux-2.6.38.2/include/linux/reiserfs_fs.h
---- linux-2.6.38.2/include/linux/reiserfs_fs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/reiserfs_fs.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/reboot.h linux-2.6.38.7/include/linux/reboot.h
+--- linux-2.6.38.7/include/linux/reboot.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/reboot.h	2011-05-22 23:03:34.000000000 -0400
+@@ -47,9 +47,9 @@ extern int unregister_reboot_notifier(st
+  * Architecture-specific implementations of sys_reboot commands.
+  */
+ 
+-extern void machine_restart(char *cmd);
+-extern void machine_halt(void);
+-extern void machine_power_off(void);
++extern void machine_restart(char *cmd) __noreturn;
++extern void machine_halt(void) __noreturn;
++extern void machine_power_off(void) __noreturn;
+ 
+ extern void machine_shutdown(void);
+ struct pt_regs;
+@@ -60,9 +60,9 @@ extern void machine_crash_shutdown(struc
+  */
+ 
+ extern void kernel_restart_prepare(char *cmd);
+-extern void kernel_restart(char *cmd);
+-extern void kernel_halt(void);
+-extern void kernel_power_off(void);
++extern void kernel_restart(char *cmd) __noreturn;
++extern void kernel_halt(void) __noreturn;
++extern void kernel_power_off(void) __noreturn;
+ 
+ extern int C_A_D; /* for sysctl */
+ void ctrl_alt_del(void);
+@@ -76,7 +76,7 @@ extern int orderly_poweroff(bool force);
+  * Emergency restart, callable from an interrupt handler.
+  */
+ 
+-extern void emergency_restart(void);
++extern void emergency_restart(void) __noreturn;
+ #include <asm/emergency-restart.h>
+ 
+ #endif
+diff -urNp linux-2.6.38.7/include/linux/reiserfs_fs.h linux-2.6.38.7/include/linux/reiserfs_fs.h
+--- linux-2.6.38.7/include/linux/reiserfs_fs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/reiserfs_fs.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1403,7 +1403,7 @@ static inline loff_t max_reiserfs_offset
  #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
  
@@ -47777,9 +56179,9 @@ diff -urNp linux-2.6.38.2/include/linux/reiserfs_fs.h linux-2.6.38.2/include/lin
  
  #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
  #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
-diff -urNp linux-2.6.38.2/include/linux/reiserfs_fs_sb.h linux-2.6.38.2/include/linux/reiserfs_fs_sb.h
---- linux-2.6.38.2/include/linux/reiserfs_fs_sb.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/reiserfs_fs_sb.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/reiserfs_fs_sb.h linux-2.6.38.7/include/linux/reiserfs_fs_sb.h
+--- linux-2.6.38.7/include/linux/reiserfs_fs_sb.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/reiserfs_fs_sb.h	2011-04-28 19:34:15.000000000 -0400
 @@ -386,7 +386,7 @@ struct reiserfs_sb_info {
  	/* Comment? -Hans */
  	wait_queue_head_t s_wait;
@@ -47789,9 +56191,9 @@ diff -urNp linux-2.6.38.2/include/linux/reiserfs_fs_sb.h linux-2.6.38.2/include/
  	// tree gets re-balanced
  	unsigned long s_properties;	/* File system properties. Currently holds
  					   on-disk FS format */
-diff -urNp linux-2.6.38.2/include/linux/rmap.h linux-2.6.38.2/include/linux/rmap.h
---- linux-2.6.38.2/include/linux/rmap.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/rmap.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/rmap.h linux-2.6.38.7/include/linux/rmap.h
+--- linux-2.6.38.7/include/linux/rmap.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/rmap.h	2011-04-28 19:34:15.000000000 -0400
 @@ -145,8 +145,8 @@ static inline void anon_vma_unlock(struc
  void anon_vma_init(void);	/* create anon_vma_cachep */
  int  anon_vma_prepare(struct vm_area_struct *);
@@ -47803,9 +56205,9 @@ diff -urNp linux-2.6.38.2/include/linux/rmap.h linux-2.6.38.2/include/linux/rmap
  void __anon_vma_link(struct vm_area_struct *);
  void anon_vma_free(struct anon_vma *);
  
-diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sched.h
---- linux-2.6.38.2/include/linux/sched.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/sched.h	2011-03-26 17:18:15.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sched.h linux-2.6.38.7/include/linux/sched.h
+--- linux-2.6.38.7/include/linux/sched.h	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/include/linux/sched.h	2011-05-22 23:06:04.000000000 -0400
 @@ -99,6 +99,7 @@ struct robust_list_head;
  struct bio_list;
  struct fs_struct;
@@ -47814,6 +56216,15 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  
  /*
   * List of flags we want to share for kernel threads,
+@@ -359,7 +360,7 @@ extern signed long schedule_timeout_inte
+ extern signed long schedule_timeout_killable(signed long timeout);
+ extern signed long schedule_timeout_uninterruptible(signed long timeout);
+ asmlinkage void schedule(void);
+-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
++extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
+ 
+ struct nsproxy;
+ struct user_namespace;
 @@ -380,10 +381,13 @@ struct user_namespace;
  #define DEFAULT_MAX_MAP_COUNT	(USHRT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
  
@@ -47846,16 +56257,19 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  #ifdef CONFIG_AUDIT
  	unsigned audit_tty;
  	struct tty_audit_buf *tty_audit_buf;
-@@ -1192,7 +1207,7 @@ enum perf_event_task_context {
- 
- struct task_struct {
- 	volatile long state;	/* -1 unrunnable, 0 runnable, >0 stopped */
--	void *stack;
-+	struct thread_info *stack;
- 	atomic_t usage;
- 	unsigned int flags;	/* per process flags, defined below */
- 	unsigned int ptrace;
-@@ -1307,8 +1322,8 @@ struct task_struct {
+@@ -700,6 +715,11 @@ struct user_struct {
+ 	struct key *session_keyring;	/* UID's default session keyring */
+ #endif
+ 
++#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
++	unsigned int banned;
++	unsigned long ban_expires;
++#endif
++
+ 	/* Hash table maintenance information */
+ 	struct hlist_node uidhash_node;
+ 	uid_t uid;
+@@ -1310,8 +1330,8 @@ struct task_struct {
  	struct list_head thread_group;
  
  	struct completion *vfork_done;		/* for vfork() */
@@ -47866,7 +56280,7 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  
  	cputime_t utime, stime, utimescaled, stimescaled;
  	cputime_t gtime;
-@@ -1324,13 +1339,6 @@ struct task_struct {
+@@ -1327,13 +1347,6 @@ struct task_struct {
  	struct task_cputime cputime_expires;
  	struct list_head cpu_timers[3];
  
@@ -47880,8 +56294,14 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  	char comm[TASK_COMM_LEN]; /* executable name excluding path
  				     - access with [gs]et_task_comm (which lock
  				       it with task_lock())
-@@ -1349,6 +1357,10 @@ struct task_struct {
+@@ -1350,8 +1363,16 @@ struct task_struct {
+ #endif
+ /* CPU-specific state of this task */
  	struct thread_struct thread;
++/* thread_info moved to task_struct */
++#ifdef CONFIG_X86
++	struct thread_info tinfo;
++#endif
  /* filesystem information */
  	struct fs_struct *fs;
 +
@@ -47891,7 +56311,7 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  /* open file information */
  	struct files_struct *files;
  /* namespaces */
-@@ -1395,6 +1407,11 @@ struct task_struct {
+@@ -1398,6 +1419,11 @@ struct task_struct {
  	struct rt_mutex_waiter *pi_blocked_on;
  #endif
  
@@ -47903,7 +56323,7 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  #ifdef CONFIG_DEBUG_MUTEXES
  	/* mutex deadlock detection */
  	struct mutex_waiter *blocked_on;
-@@ -1499,6 +1516,21 @@ struct task_struct {
+@@ -1502,6 +1528,21 @@ struct task_struct {
  	unsigned long default_timer_slack_ns;
  
  	struct list_head	*scm_work_list;
@@ -47925,7 +56345,7 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  #ifdef CONFIG_FUNCTION_GRAPH_TRACER
  	/* Index of current stored address in ret_stack */
  	int curr_ret_stack;
-@@ -1530,6 +1562,52 @@ struct task_struct {
+@@ -1536,6 +1577,63 @@ struct task_struct {
  #endif
  };
  
@@ -47972,13 +56392,34 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
 +void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
 +void pax_report_insns(void *pc, void *sp);
 +void pax_report_refcount_overflow(struct pt_regs *regs);
-+void pax_report_leak_to_user(const void *ptr, unsigned long len);
-+void pax_report_overflow_from_user(const void *ptr, unsigned long len);
++void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type);
++
++static inline void pax_track_stack(void)
++{
++
++#ifdef CONFIG_PAX_MEMORY_STACKLEAK
++	unsigned long sp = current_stack_pointer;
++	if (current_thread_info()->lowest_stack > sp &&
++	    (unsigned long)task_stack_page(current) < sp)
++		current_thread_info()->lowest_stack = sp;
++#endif
++
++}
 +
  /* Future-safe accessor for struct task_struct's cpus_allowed. */
  #define tsk_cpus_allowed(tsk) (&(tsk)->cpus_allowed)
  
-@@ -2169,7 +2247,7 @@ extern void __cleanup_sighand(struct sig
+@@ -2005,7 +2103,9 @@ void yield(void);
+ extern struct exec_domain	default_exec_domain;
+ 
+ union thread_union {
++#ifndef CONFIG_X86
+ 	struct thread_info thread_info;
++#endif
+ 	unsigned long stack[THREAD_SIZE/sizeof(long)];
+ };
+ 
+@@ -2175,7 +2275,7 @@ extern void __cleanup_sighand(struct sig
  extern void exit_itimers(struct signal_struct *);
  extern void flush_itimer_signals(void);
  
@@ -47987,18 +56428,7 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  
  extern void daemonize(const char *, ...);
  extern int allow_signal(int);
-@@ -2294,8 +2372,8 @@ static inline void unlock_task_sighand(s
- 
- #ifndef __HAVE_THREAD_FUNCTIONS
- 
--#define task_thread_info(task)	((struct thread_info *)(task)->stack)
--#define task_stack_page(task)	((task)->stack)
-+#define task_thread_info(task)	((task)->stack)
-+#define task_stack_page(task)	((void *)(task)->stack)
- 
- static inline void setup_thread_stack(struct task_struct *p, struct task_struct *org)
- {
-@@ -2310,13 +2388,17 @@ static inline unsigned long *end_of_stac
+@@ -2316,13 +2416,17 @@ static inline unsigned long *end_of_stac
  
  #endif
  
@@ -48018,9 +56448,9 @@ diff -urNp linux-2.6.38.2/include/linux/sched.h linux-2.6.38.2/include/linux/sch
  extern void thread_info_cache_init(void);
  
  #ifdef CONFIG_DEBUG_STACK_USAGE
-diff -urNp linux-2.6.38.2/include/linux/screen_info.h linux-2.6.38.2/include/linux/screen_info.h
---- linux-2.6.38.2/include/linux/screen_info.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/screen_info.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/screen_info.h linux-2.6.38.7/include/linux/screen_info.h
+--- linux-2.6.38.7/include/linux/screen_info.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/screen_info.h	2011-04-28 19:34:15.000000000 -0400
 @@ -43,7 +43,8 @@ struct screen_info {
  	__u16 pages;		/* 0x32 */
  	__u16 vesa_attributes;	/* 0x34 */
@@ -48031,9 +56461,9 @@ diff -urNp linux-2.6.38.2/include/linux/screen_info.h linux-2.6.38.2/include/lin
  } __attribute__((packed));
  
  #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
-diff -urNp linux-2.6.38.2/include/linux/security.h linux-2.6.38.2/include/linux/security.h
---- linux-2.6.38.2/include/linux/security.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/security.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/security.h linux-2.6.38.7/include/linux/security.h
+--- linux-2.6.38.7/include/linux/security.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/security.h	2011-04-28 19:34:15.000000000 -0400
 @@ -35,6 +35,7 @@
  #include <linux/key.h>
  #include <linux/xfrm.h>
@@ -48042,9 +56472,9 @@ diff -urNp linux-2.6.38.2/include/linux/security.h linux-2.6.38.2/include/linux/
  #include <net/flow.h>
  
  /* Maximum number of letters for an LSM name string */
-diff -urNp linux-2.6.38.2/include/linux/shm.h linux-2.6.38.2/include/linux/shm.h
---- linux-2.6.38.2/include/linux/shm.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/shm.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/shm.h linux-2.6.38.7/include/linux/shm.h
+--- linux-2.6.38.7/include/linux/shm.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/shm.h	2011-04-28 19:34:15.000000000 -0400
 @@ -95,6 +95,10 @@ struct shmid_kernel /* private to the ke
  	pid_t			shm_cprid;
  	pid_t			shm_lprid;
@@ -48056,9 +56486,9 @@ diff -urNp linux-2.6.38.2/include/linux/shm.h linux-2.6.38.2/include/linux/shm.h
  };
  
  /* shm_mode upper byte flags */
-diff -urNp linux-2.6.38.2/include/linux/skbuff.h linux-2.6.38.2/include/linux/skbuff.h
---- linux-2.6.38.2/include/linux/skbuff.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/skbuff.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/skbuff.h linux-2.6.38.7/include/linux/skbuff.h
+--- linux-2.6.38.7/include/linux/skbuff.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/skbuff.h	2011-04-28 19:57:25.000000000 -0400
 @@ -589,7 +589,7 @@ static inline struct skb_shared_hwtstamp
   */
  static inline int skb_queue_empty(const struct sk_buff_head *list)
@@ -48086,10 +56516,37 @@ diff -urNp linux-2.6.38.2/include/linux/skbuff.h linux-2.6.38.2/include/linux/sk
  }
  
  /**
-diff -urNp linux-2.6.38.2/include/linux/slab.h linux-2.6.38.2/include/linux/slab.h
---- linux-2.6.38.2/include/linux/slab.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/slab.h	2011-03-21 18:31:35.000000000 -0400
-@@ -11,6 +11,7 @@
+@@ -1432,7 +1432,7 @@ static inline int pskb_network_may_pull(
+  * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
+  */
+ #ifndef NET_SKB_PAD
+-#define NET_SKB_PAD	max(32, L1_CACHE_BYTES)
++#define NET_SKB_PAD	max(_AC(32,U), L1_CACHE_BYTES)
+ #endif
+ 
+ extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
+diff -urNp linux-2.6.38.7/include/linux/slab_def.h linux-2.6.38.7/include/linux/slab_def.h
+--- linux-2.6.38.7/include/linux/slab_def.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/slab_def.h	2011-04-28 19:57:25.000000000 -0400
+@@ -96,10 +96,10 @@ struct kmem_cache {
+ 	unsigned long node_allocs;
+ 	unsigned long node_frees;
+ 	unsigned long node_overflow;
+-	atomic_t allochit;
+-	atomic_t allocmiss;
+-	atomic_t freehit;
+-	atomic_t freemiss;
++	atomic_unchecked_t allochit;
++	atomic_unchecked_t allocmiss;
++	atomic_unchecked_t freehit;
++	atomic_unchecked_t freemiss;
+ 
+ 	/*
+ 	 * If debugging is enabled, then the allocator can add additional
+diff -urNp linux-2.6.38.7/include/linux/slab.h linux-2.6.38.7/include/linux/slab.h
+--- linux-2.6.38.7/include/linux/slab.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/slab.h	2011-04-28 19:34:15.000000000 -0400
+@@ -11,12 +11,20 @@
  
  #include <linux/gfp.h>
  #include <linux/types.h>
@@ -48097,7 +56554,20 @@ diff -urNp linux-2.6.38.2/include/linux/slab.h linux-2.6.38.2/include/linux/slab
  
  /*
   * Flags to pass to kmem_cache_create().
-@@ -87,10 +88,13 @@
+  * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
+  */
+ #define SLAB_DEBUG_FREE		0x00000100UL	/* DEBUG: Perform (expensive) checks on free */
++
++#ifdef CONFIG_PAX_USERCOPY
++#define SLAB_USERCOPY		0x00000200UL	/* PaX: Allow copying objs to/from userland */
++#else
++#define SLAB_USERCOPY		0x00000000UL
++#endif
++
+ #define SLAB_RED_ZONE		0x00000400UL	/* DEBUG: Red zone objs in a cache */
+ #define SLAB_POISON		0x00000800UL	/* DEBUG: Poison objects */
+ #define SLAB_HWCACHE_ALIGN	0x00002000UL	/* Align objs on cache lines */
+@@ -87,10 +95,13 @@
   * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
   * Both make kfree a no-op.
   */
@@ -48114,7 +56584,7 @@ diff -urNp linux-2.6.38.2/include/linux/slab.h linux-2.6.38.2/include/linux/slab
  
  /*
   * struct kmem_cache related prototypes
-@@ -142,6 +146,7 @@ void * __must_check krealloc(const void 
+@@ -142,6 +153,7 @@ void * __must_check krealloc(const void 
  void kfree(const void *);
  void kzfree(const void *);
  size_t ksize(const void *);
@@ -48122,7 +56592,7 @@ diff -urNp linux-2.6.38.2/include/linux/slab.h linux-2.6.38.2/include/linux/slab
  
  /*
   * Allocator specific definitions. These are mainly used to establish optimized
-@@ -334,4 +339,37 @@ static inline void *kzalloc_node(size_t 
+@@ -334,4 +346,37 @@ static inline void *kzalloc_node(size_t 
  
  void __init kmem_cache_init_late(void);
  
@@ -48160,9 +56630,9 @@ diff -urNp linux-2.6.38.2/include/linux/slab.h linux-2.6.38.2/include/linux/slab
 +})
 +
  #endif	/* _LINUX_SLAB_H */
-diff -urNp linux-2.6.38.2/include/linux/slub_def.h linux-2.6.38.2/include/linux/slub_def.h
---- linux-2.6.38.2/include/linux/slub_def.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/slub_def.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/slub_def.h linux-2.6.38.7/include/linux/slub_def.h
+--- linux-2.6.38.7/include/linux/slub_def.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/slub_def.h	2011-04-28 19:34:15.000000000 -0400
 @@ -79,7 +79,7 @@ struct kmem_cache {
  	struct kmem_cache_order_objects max;
  	struct kmem_cache_order_objects min;
@@ -48172,9 +56642,9 @@ diff -urNp linux-2.6.38.2/include/linux/slub_def.h linux-2.6.38.2/include/linux/
  	void (*ctor)(void *);
  	int inuse;		/* Offset to metadata */
  	int align;		/* Alignment */
-diff -urNp linux-2.6.38.2/include/linux/sonet.h linux-2.6.38.2/include/linux/sonet.h
---- linux-2.6.38.2/include/linux/sonet.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/sonet.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sonet.h linux-2.6.38.7/include/linux/sonet.h
+--- linux-2.6.38.7/include/linux/sonet.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/sonet.h	2011-04-28 19:34:15.000000000 -0400
 @@ -61,7 +61,7 @@ struct sonet_stats {
  #include <asm/atomic.h>
  
@@ -48184,9 +56654,9 @@ diff -urNp linux-2.6.38.2/include/linux/sonet.h linux-2.6.38.2/include/linux/son
  	__SONET_ITEMS
  #undef __HANDLE_ITEM
  };
-diff -urNp linux-2.6.38.2/include/linux/sunrpc/clnt.h linux-2.6.38.2/include/linux/sunrpc/clnt.h
---- linux-2.6.38.2/include/linux/sunrpc/clnt.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/sunrpc/clnt.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sunrpc/clnt.h linux-2.6.38.7/include/linux/sunrpc/clnt.h
+--- linux-2.6.38.7/include/linux/sunrpc/clnt.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/sunrpc/clnt.h	2011-04-28 19:34:15.000000000 -0400
 @@ -168,9 +168,9 @@ static inline unsigned short rpc_get_por
  {
  	switch (sap->sa_family) {
@@ -48217,9 +56687,37 @@ diff -urNp linux-2.6.38.2/include/linux/sunrpc/clnt.h linux-2.6.38.2/include/lin
  }
  
  #endif /* __KERNEL__ */
-diff -urNp linux-2.6.38.2/include/linux/suspend.h linux-2.6.38.2/include/linux/suspend.h
---- linux-2.6.38.2/include/linux/suspend.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/suspend.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sunrpc/svc_rdma.h linux-2.6.38.7/include/linux/sunrpc/svc_rdma.h
+--- linux-2.6.38.7/include/linux/sunrpc/svc_rdma.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/sunrpc/svc_rdma.h	2011-04-28 19:57:25.000000000 -0400
+@@ -53,15 +53,15 @@ extern unsigned int svcrdma_ord;
+ extern unsigned int svcrdma_max_requests;
+ extern unsigned int svcrdma_max_req_size;
+ 
+-extern atomic_t rdma_stat_recv;
+-extern atomic_t rdma_stat_read;
+-extern atomic_t rdma_stat_write;
+-extern atomic_t rdma_stat_sq_starve;
+-extern atomic_t rdma_stat_rq_starve;
+-extern atomic_t rdma_stat_rq_poll;
+-extern atomic_t rdma_stat_rq_prod;
+-extern atomic_t rdma_stat_sq_poll;
+-extern atomic_t rdma_stat_sq_prod;
++extern atomic_unchecked_t rdma_stat_recv;
++extern atomic_unchecked_t rdma_stat_read;
++extern atomic_unchecked_t rdma_stat_write;
++extern atomic_unchecked_t rdma_stat_sq_starve;
++extern atomic_unchecked_t rdma_stat_rq_starve;
++extern atomic_unchecked_t rdma_stat_rq_poll;
++extern atomic_unchecked_t rdma_stat_rq_prod;
++extern atomic_unchecked_t rdma_stat_sq_poll;
++extern atomic_unchecked_t rdma_stat_sq_prod;
+ 
+ #define RPCRDMA_VERSION 1
+ 
+diff -urNp linux-2.6.38.7/include/linux/suspend.h linux-2.6.38.7/include/linux/suspend.h
+--- linux-2.6.38.7/include/linux/suspend.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/suspend.h	2011-04-28 19:34:15.000000000 -0400
 @@ -106,15 +106,15 @@ typedef int __bitwise suspend_state_t;
   *	which require special recovery actions in that situation.
   */
@@ -48272,9 +56770,9 @@ diff -urNp linux-2.6.38.2/include/linux/suspend.h linux-2.6.38.2/include/linux/s
  };
  
  #ifdef CONFIG_HIBERNATION
-diff -urNp linux-2.6.38.2/include/linux/sysctl.h linux-2.6.38.2/include/linux/sysctl.h
---- linux-2.6.38.2/include/linux/sysctl.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/sysctl.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sysctl.h linux-2.6.38.7/include/linux/sysctl.h
+--- linux-2.6.38.7/include/linux/sysctl.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/sysctl.h	2011-04-28 19:34:15.000000000 -0400
 @@ -155,7 +155,11 @@ enum
  	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
  };
@@ -48297,9 +56795,9 @@ diff -urNp linux-2.6.38.2/include/linux/sysctl.h linux-2.6.38.2/include/linux/sy
  extern int proc_dointvec(struct ctl_table *, int,
  			 void __user *, size_t *, loff_t *);
  extern int proc_dointvec_minmax(struct ctl_table *, int,
-diff -urNp linux-2.6.38.2/include/linux/sysfs.h linux-2.6.38.2/include/linux/sysfs.h
---- linux-2.6.38.2/include/linux/sysfs.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/sysfs.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/sysfs.h linux-2.6.38.7/include/linux/sysfs.h
+--- linux-2.6.38.7/include/linux/sysfs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/sysfs.h	2011-04-28 19:34:15.000000000 -0400
 @@ -110,8 +110,8 @@ struct bin_attribute {
  #define sysfs_bin_attr_init(bin_attr) sysfs_attr_init(&(bin_attr)->attr)
  
@@ -48311,9 +56809,9 @@ diff -urNp linux-2.6.38.2/include/linux/sysfs.h linux-2.6.38.2/include/linux/sys
  };
  
  struct sysfs_dirent;
-diff -urNp linux-2.6.38.2/include/linux/tty.h linux-2.6.38.2/include/linux/tty.h
---- linux-2.6.38.2/include/linux/tty.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/tty.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/tty.h linux-2.6.38.7/include/linux/tty.h
+--- linux-2.6.38.7/include/linux/tty.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/tty.h	2011-04-28 19:34:15.000000000 -0400
 @@ -13,6 +13,8 @@
  #include <linux/tty_driver.h>
  #include <linux/tty_ldisc.h>
@@ -48350,9 +56848,9 @@ diff -urNp linux-2.6.38.2/include/linux/tty.h linux-2.6.38.2/include/linux/tty.h
  
  /* n_tty.c */
  extern struct tty_ldisc_ops tty_ldisc_N_TTY;
-diff -urNp linux-2.6.38.2/include/linux/tty_ldisc.h linux-2.6.38.2/include/linux/tty_ldisc.h
---- linux-2.6.38.2/include/linux/tty_ldisc.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/tty_ldisc.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/tty_ldisc.h linux-2.6.38.7/include/linux/tty_ldisc.h
+--- linux-2.6.38.7/include/linux/tty_ldisc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/tty_ldisc.h	2011-04-28 19:34:15.000000000 -0400
 @@ -148,7 +148,7 @@ struct tty_ldisc_ops {
  
  	struct  module *owner;
@@ -48362,9 +56860,9 @@ diff -urNp linux-2.6.38.2/include/linux/tty_ldisc.h linux-2.6.38.2/include/linux
  };
  
  struct tty_ldisc {
-diff -urNp linux-2.6.38.2/include/linux/types.h linux-2.6.38.2/include/linux/types.h
---- linux-2.6.38.2/include/linux/types.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/types.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/types.h linux-2.6.38.7/include/linux/types.h
+--- linux-2.6.38.7/include/linux/types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/types.h	2011-04-28 19:34:15.000000000 -0400
 @@ -207,10 +207,26 @@ typedef struct {
  	int counter;
  } atomic_t;
@@ -48392,9 +56890,9 @@ diff -urNp linux-2.6.38.2/include/linux/types.h linux-2.6.38.2/include/linux/typ
  #endif
  
  struct list_head {
-diff -urNp linux-2.6.38.2/include/linux/uaccess.h linux-2.6.38.2/include/linux/uaccess.h
---- linux-2.6.38.2/include/linux/uaccess.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/uaccess.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/uaccess.h linux-2.6.38.7/include/linux/uaccess.h
+--- linux-2.6.38.7/include/linux/uaccess.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/uaccess.h	2011-04-28 19:34:15.000000000 -0400
 @@ -76,11 +76,11 @@ static inline unsigned long __copy_from_
  		long ret;				\
  		mm_segment_t old_fs = get_fs();		\
@@ -48430,9 +56928,9 @@ diff -urNp linux-2.6.38.2/include/linux/uaccess.h linux-2.6.38.2/include/linux/u
 +extern long notrace __probe_kernel_write(void *dst, const void *src, size_t size);
  
  #endif		/* __LINUX_UACCESS_H__ */
-diff -urNp linux-2.6.38.2/include/linux/unaligned/access_ok.h linux-2.6.38.2/include/linux/unaligned/access_ok.h
---- linux-2.6.38.2/include/linux/unaligned/access_ok.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/unaligned/access_ok.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/unaligned/access_ok.h linux-2.6.38.7/include/linux/unaligned/access_ok.h
+--- linux-2.6.38.7/include/linux/unaligned/access_ok.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/unaligned/access_ok.h	2011-04-28 19:34:15.000000000 -0400
 @@ -6,32 +6,32 @@
  
  static inline u16 get_unaligned_le16(const void *p)
@@ -48472,9 +56970,9 @@ diff -urNp linux-2.6.38.2/include/linux/unaligned/access_ok.h linux-2.6.38.2/inc
  }
  
  static inline void put_unaligned_le16(u16 val, void *p)
-diff -urNp linux-2.6.38.2/include/linux/usb/hcd.h linux-2.6.38.2/include/linux/usb/hcd.h
---- linux-2.6.38.2/include/linux/usb/hcd.h	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/include/linux/usb/hcd.h	2011-03-23 17:21:51.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/usb/hcd.h linux-2.6.38.7/include/linux/usb/hcd.h
+--- linux-2.6.38.7/include/linux/usb/hcd.h	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/include/linux/usb/hcd.h	2011-04-28 19:34:15.000000000 -0400
 @@ -589,7 +589,7 @@ struct usb_mon_operations {
  	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
  };
@@ -48493,9 +56991,9 @@ diff -urNp linux-2.6.38.2/include/linux/usb/hcd.h linux-2.6.38.2/include/linux/u
  void usb_mon_deregister(void);
  
  #else
-diff -urNp linux-2.6.38.2/include/linux/vmalloc.h linux-2.6.38.2/include/linux/vmalloc.h
---- linux-2.6.38.2/include/linux/vmalloc.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/vmalloc.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/vmalloc.h linux-2.6.38.7/include/linux/vmalloc.h
+--- linux-2.6.38.7/include/linux/vmalloc.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/vmalloc.h	2011-04-28 19:34:15.000000000 -0400
 @@ -13,6 +13,11 @@ struct vm_area_struct;		/* vma defining 
  #define VM_MAP		0x00000004	/* vmap()ed pages */
  #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
@@ -48612,9 +57110,9 @@ diff -urNp linux-2.6.38.2/include/linux/vmalloc.h linux-2.6.38.2/include/linux/v
 +})
 +
  #endif /* _LINUX_VMALLOC_H */
-diff -urNp linux-2.6.38.2/include/linux/vmstat.h linux-2.6.38.2/include/linux/vmstat.h
---- linux-2.6.38.2/include/linux/vmstat.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/linux/vmstat.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/linux/vmstat.h linux-2.6.38.7/include/linux/vmstat.h
+--- linux-2.6.38.7/include/linux/vmstat.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/linux/vmstat.h	2011-04-28 19:34:15.000000000 -0400
 @@ -140,18 +140,18 @@ static inline void vm_events_fold_cpu(in
  /*
   * Zone based page accounting with per cpu differentials.
@@ -48678,9 +57176,47 @@ diff -urNp linux-2.6.38.2/include/linux/vmstat.h linux-2.6.38.2/include/linux/vm
  }
  
  static inline void __dec_zone_page_state(struct page *page,
-diff -urNp linux-2.6.38.2/include/net/inetpeer.h linux-2.6.38.2/include/net/inetpeer.h
---- linux-2.6.38.2/include/net/inetpeer.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/inetpeer.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/media/v4l2-device.h linux-2.6.38.7/include/media/v4l2-device.h
+--- linux-2.6.38.7/include/media/v4l2-device.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/media/v4l2-device.h	2011-04-28 19:57:25.000000000 -0400
+@@ -77,7 +77,7 @@ int __must_check v4l2_device_register(st
+    this function returns 0. If the name ends with a digit (e.g. cx18),
+    then the name will be set to cx18-0 since cx180 looks really odd. */
+ int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
+-						atomic_t *instance);
++						atomic_unchecked_t *instance);
+ 
+ /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
+    Since the parent disappears this ensures that v4l2_dev doesn't have an
+diff -urNp linux-2.6.38.7/include/net/caif/cfctrl.h linux-2.6.38.7/include/net/caif/cfctrl.h
+--- linux-2.6.38.7/include/net/caif/cfctrl.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/caif/cfctrl.h	2011-04-28 19:57:25.000000000 -0400
+@@ -101,8 +101,8 @@ struct cfctrl_request_info {
+ struct cfctrl {
+ 	struct cfsrvl serv;
+ 	struct cfctrl_rsp res;
+-	atomic_t req_seq_no;
+-	atomic_t rsp_seq_no;
++	atomic_unchecked_t req_seq_no;
++	atomic_unchecked_t rsp_seq_no;
+ 	struct list_head list;
+ 	/* Protects from simultaneous access to first_req list */
+ 	spinlock_t info_list_lock;
+diff -urNp linux-2.6.38.7/include/net/flow.h linux-2.6.38.7/include/net/flow.h
+--- linux-2.6.38.7/include/net/flow.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/flow.h	2011-04-28 19:57:25.000000000 -0400
+@@ -109,7 +109,7 @@ extern struct flow_cache_object *flow_ca
+ 		u8 dir, flow_resolve_t resolver, void *ctx);
+ 
+ extern void flow_cache_flush(void);
+-extern atomic_t flow_cache_genid;
++extern atomic_unchecked_t flow_cache_genid;
+ 
+ static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
+ {
+diff -urNp linux-2.6.38.7/include/net/inetpeer.h linux-2.6.38.7/include/net/inetpeer.h
+--- linux-2.6.38.7/include/net/inetpeer.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/inetpeer.h	2011-04-28 19:34:15.000000000 -0400
 @@ -38,8 +38,8 @@ struct inet_peer {
  	 */
  	union {
@@ -48701,9 +57237,30 @@ diff -urNp linux-2.6.38.2/include/net/inetpeer.h linux-2.6.38.2/include/net/inet
  }
  
  #endif /* _NET_INETPEER_H */
-diff -urNp linux-2.6.38.2/include/net/irda/ircomm_tty.h linux-2.6.38.2/include/net/irda/ircomm_tty.h
---- linux-2.6.38.2/include/net/irda/ircomm_tty.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/irda/ircomm_tty.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/ip_vs.h linux-2.6.38.7/include/net/ip_vs.h
+--- linux-2.6.38.7/include/net/ip_vs.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/ip_vs.h	2011-04-28 19:57:25.000000000 -0400
+@@ -404,7 +404,7 @@ struct ip_vs_conn {
+ 	struct ip_vs_conn       *control;       /* Master control connection */
+ 	atomic_t                n_control;      /* Number of controlled ones */
+ 	struct ip_vs_dest       *dest;          /* real server */
+-	atomic_t                in_pkts;        /* incoming packet counter */
++	atomic_unchecked_t      in_pkts;        /* incoming packet counter */
+ 
+ 	/* packet transmitter for different forwarding methods.  If it
+ 	   mangles the packet, it must return NF_DROP or better NF_STOLEN,
+@@ -513,7 +513,7 @@ struct ip_vs_dest {
+ 	union nf_inet_addr	addr;		/* IP address of the server */
+ 	__be16			port;		/* port number of the server */
+ 	volatile unsigned	flags;		/* dest status flags */
+-	atomic_t		conn_flags;	/* flags to copy to conn */
++	atomic_unchecked_t	conn_flags;	/* flags to copy to conn */
+ 	atomic_t		weight;		/* server weight */
+ 
+ 	atomic_t		refcnt;		/* reference counter */
+diff -urNp linux-2.6.38.7/include/net/irda/ircomm_tty.h linux-2.6.38.7/include/net/irda/ircomm_tty.h
+--- linux-2.6.38.7/include/net/irda/ircomm_tty.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/irda/ircomm_tty.h	2011-04-28 19:34:15.000000000 -0400
 @@ -35,6 +35,7 @@
  #include <linux/termios.h>
  #include <linux/timer.h>
@@ -48723,9 +57280,21 @@ diff -urNp linux-2.6.38.2/include/net/irda/ircomm_tty.h linux-2.6.38.2/include/n
  
  	/* Protect concurent access to :
  	 *	o self->open_count
-diff -urNp linux-2.6.38.2/include/net/neighbour.h linux-2.6.38.2/include/net/neighbour.h
---- linux-2.6.38.2/include/net/neighbour.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/neighbour.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/iucv/af_iucv.h linux-2.6.38.7/include/net/iucv/af_iucv.h
+--- linux-2.6.38.7/include/net/iucv/af_iucv.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/iucv/af_iucv.h	2011-04-28 19:57:25.000000000 -0400
+@@ -87,7 +87,7 @@ struct iucv_sock {
+ struct iucv_sock_list {
+ 	struct hlist_head head;
+ 	rwlock_t	  lock;
+-	atomic_t	  autobind_name;
++	atomic_unchecked_t autobind_name;
+ };
+ 
+ unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
+diff -urNp linux-2.6.38.7/include/net/neighbour.h linux-2.6.38.7/include/net/neighbour.h
+--- linux-2.6.38.7/include/net/neighbour.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/neighbour.h	2011-04-28 19:34:15.000000000 -0400
 @@ -118,12 +118,12 @@ struct neighbour {
  
  struct neigh_ops {
@@ -48745,9 +57314,9 @@ diff -urNp linux-2.6.38.2/include/net/neighbour.h linux-2.6.38.2/include/net/nei
  };
  
  struct pneigh_entry {
-diff -urNp linux-2.6.38.2/include/net/netlink.h linux-2.6.38.2/include/net/netlink.h
---- linux-2.6.38.2/include/net/netlink.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/netlink.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/netlink.h linux-2.6.38.7/include/net/netlink.h
+--- linux-2.6.38.7/include/net/netlink.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/netlink.h	2011-04-28 19:34:15.000000000 -0400
 @@ -562,7 +562,7 @@ static inline void *nlmsg_get_pos(struct
  static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
  {
@@ -48757,9 +57326,21 @@ diff -urNp linux-2.6.38.2/include/net/netlink.h linux-2.6.38.2/include/net/netli
  }
  
  /**
-diff -urNp linux-2.6.38.2/include/net/sctp/sctp.h linux-2.6.38.2/include/net/sctp/sctp.h
---- linux-2.6.38.2/include/net/sctp/sctp.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/sctp/sctp.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/netns/ipv4.h linux-2.6.38.7/include/net/netns/ipv4.h
+--- linux-2.6.38.7/include/net/netns/ipv4.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/netns/ipv4.h	2011-04-28 19:57:25.000000000 -0400
+@@ -55,7 +55,7 @@ struct netns_ipv4 {
+ 	int sysctl_rt_cache_rebuild_count;
+ 	int current_rt_cache_rebuild_count;
+ 
+-	atomic_t rt_genid;
++	atomic_unchecked_t rt_genid;
+ 
+ #ifdef CONFIG_IP_MROUTE
+ #ifndef CONFIG_IP_MROUTE_MULTIPLE_TABLES
+diff -urNp linux-2.6.38.7/include/net/sctp/sctp.h linux-2.6.38.7/include/net/sctp/sctp.h
+--- linux-2.6.38.7/include/net/sctp/sctp.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/sctp/sctp.h	2011-04-28 19:34:15.000000000 -0400
 @@ -316,9 +316,9 @@ do {									\
  
  #else	/* SCTP_DEBUG */
@@ -48773,9 +57354,21 @@ diff -urNp linux-2.6.38.2/include/net/sctp/sctp.h linux-2.6.38.2/include/net/sct
  #define SCTP_ENABLE_DEBUG
  #define SCTP_DISABLE_DEBUG
  #define SCTP_ASSERT(expr, str, func)
-diff -urNp linux-2.6.38.2/include/net/tcp.h linux-2.6.38.2/include/net/tcp.h
---- linux-2.6.38.2/include/net/tcp.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/tcp.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/sock.h linux-2.6.38.7/include/net/sock.h
+--- linux-2.6.38.7/include/net/sock.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/sock.h	2011-04-28 19:57:25.000000000 -0400
+@@ -277,7 +277,7 @@ struct sock {
+ #ifdef CONFIG_RPS
+ 	__u32			sk_rxhash;
+ #endif
+-	atomic_t		sk_drops;
++	atomic_unchecked_t	sk_drops;
+ 	int			sk_rcvbuf;
+ 
+ 	struct sk_filter __rcu	*sk_filter;
+diff -urNp linux-2.6.38.7/include/net/tcp.h linux-2.6.38.7/include/net/tcp.h
+--- linux-2.6.38.7/include/net/tcp.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/tcp.h	2011-04-28 19:34:15.000000000 -0400
 @@ -1382,7 +1382,7 @@ enum tcp_seq_states {
  struct tcp_seq_afinfo {
  	char			*name;
@@ -48785,9 +57378,9 @@ diff -urNp linux-2.6.38.2/include/net/tcp.h linux-2.6.38.2/include/net/tcp.h
  	struct seq_operations	seq_ops;
  };
  
-diff -urNp linux-2.6.38.2/include/net/udp.h linux-2.6.38.2/include/net/udp.h
---- linux-2.6.38.2/include/net/udp.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/net/udp.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/udp.h linux-2.6.38.7/include/net/udp.h
+--- linux-2.6.38.7/include/net/udp.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/udp.h	2011-04-28 19:34:15.000000000 -0400
 @@ -223,7 +223,7 @@ struct udp_seq_afinfo {
  	char			*name;
  	sa_family_t		family;
@@ -48797,9 +57390,37 @@ diff -urNp linux-2.6.38.2/include/net/udp.h linux-2.6.38.2/include/net/udp.h
  	struct seq_operations	seq_ops;
  };
  
-diff -urNp linux-2.6.38.2/include/sound/ac97_codec.h linux-2.6.38.2/include/sound/ac97_codec.h
---- linux-2.6.38.2/include/sound/ac97_codec.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/sound/ac97_codec.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/net/xfrm.h linux-2.6.38.7/include/net/xfrm.h
+--- linux-2.6.38.7/include/net/xfrm.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/net/xfrm.h	2011-04-28 19:57:25.000000000 -0400
+@@ -484,7 +484,7 @@ struct xfrm_policy {
+ 	struct timer_list	timer;
+ 
+ 	struct flow_cache_object flo;
+-	atomic_t		genid;
++	atomic_unchecked_t	genid;
+ 	u32			priority;
+ 	u32			index;
+ 	struct xfrm_mark	mark;
+diff -urNp linux-2.6.38.7/include/scsi/scsi_device.h linux-2.6.38.7/include/scsi/scsi_device.h
+--- linux-2.6.38.7/include/scsi/scsi_device.h	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/include/scsi/scsi_device.h	2011-04-28 19:57:25.000000000 -0400
+@@ -161,9 +161,9 @@ struct scsi_device {
+ 	unsigned int max_device_blocked; /* what device_blocked counts down from  */
+ #define SCSI_DEFAULT_DEVICE_BLOCKED	3
+ 
+-	atomic_t iorequest_cnt;
+-	atomic_t iodone_cnt;
+-	atomic_t ioerr_cnt;
++	atomic_unchecked_t iorequest_cnt;
++	atomic_unchecked_t iodone_cnt;
++	atomic_unchecked_t ioerr_cnt;
+ 
+ 	struct device		sdev_gendev,
+ 				sdev_dev;
+diff -urNp linux-2.6.38.7/include/sound/ac97_codec.h linux-2.6.38.7/include/sound/ac97_codec.h
+--- linux-2.6.38.7/include/sound/ac97_codec.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/sound/ac97_codec.h	2011-04-28 19:34:15.000000000 -0400
 @@ -419,15 +419,15 @@
  struct snd_ac97;
  
@@ -48823,9 +57444,44 @@ diff -urNp linux-2.6.38.2/include/sound/ac97_codec.h linux-2.6.38.2/include/soun
  };
  
  struct snd_ac97_bus_ops {
-diff -urNp linux-2.6.38.2/include/trace/events/irq.h linux-2.6.38.2/include/trace/events/irq.h
---- linux-2.6.38.2/include/trace/events/irq.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/trace/events/irq.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/sound/ymfpci.h linux-2.6.38.7/include/sound/ymfpci.h
+--- linux-2.6.38.7/include/sound/ymfpci.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/sound/ymfpci.h	2011-04-28 19:57:25.000000000 -0400
+@@ -358,7 +358,7 @@ struct snd_ymfpci {
+ 	spinlock_t reg_lock;
+ 	spinlock_t voice_lock;
+ 	wait_queue_head_t interrupt_sleep;
+-	atomic_t interrupt_sleep_count;
++	atomic_unchecked_t interrupt_sleep_count;
+ 	struct snd_info_entry *proc_entry;
+ 	const struct firmware *dsp_microcode;
+ 	const struct firmware *controller_microcode;
+diff -urNp linux-2.6.38.7/include/target/target_core_base.h linux-2.6.38.7/include/target/target_core_base.h
+--- linux-2.6.38.7/include/target/target_core_base.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/target/target_core_base.h	2011-04-28 19:57:25.000000000 -0400
+@@ -431,8 +431,8 @@ struct se_transport_task {
+ 	atomic_t		t_task_cdbs_left;
+ 	atomic_t		t_task_cdbs_ex_left;
+ 	atomic_t		t_task_cdbs_timeout_left;
+-	atomic_t		t_task_cdbs_sent;
+-	atomic_t		t_transport_aborted;
++	atomic_unchecked_t	t_task_cdbs_sent;
++	atomic_unchecked_t	t_transport_aborted;
+ 	atomic_t		t_transport_active;
+ 	atomic_t		t_transport_complete;
+ 	atomic_t		t_transport_queue_active;
+@@ -753,7 +753,7 @@ struct se_device {
+ 	atomic_t		active_cmds;
+ 	atomic_t		simple_cmds;
+ 	atomic_t		depth_left;
+-	atomic_t		dev_ordered_id;
++	atomic_unchecked_t	dev_ordered_id;
+ 	atomic_t		dev_tur_active;
+ 	atomic_t		execute_tasks;
+ 	atomic_t		dev_status_thr_count;
+diff -urNp linux-2.6.38.7/include/trace/events/irq.h linux-2.6.38.7/include/trace/events/irq.h
+--- linux-2.6.38.7/include/trace/events/irq.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/trace/events/irq.h	2011-04-28 19:34:15.000000000 -0400
 @@ -36,7 +36,7 @@ struct softirq_action;
   */
  TRACE_EVENT(irq_handler_entry,
@@ -48844,9 +57500,27 @@ diff -urNp linux-2.6.38.2/include/trace/events/irq.h linux-2.6.38.2/include/trac
  
  	TP_ARGS(irq, action, ret),
  
-diff -urNp linux-2.6.38.2/include/video/uvesafb.h linux-2.6.38.2/include/video/uvesafb.h
---- linux-2.6.38.2/include/video/uvesafb.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/include/video/uvesafb.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/include/video/udlfb.h linux-2.6.38.7/include/video/udlfb.h
+--- linux-2.6.38.7/include/video/udlfb.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/video/udlfb.h	2011-04-28 19:57:25.000000000 -0400
+@@ -51,10 +51,10 @@ struct dlfb_data {
+ 	int base8;
+ 	u32 pseudo_palette[256];
+ 	/* blit-only rendering path metrics, exposed through sysfs */
+-	atomic_t bytes_rendered; /* raw pixel-bytes driver asked to render */
+-	atomic_t bytes_identical; /* saved effort with backbuffer comparison */
+-	atomic_t bytes_sent; /* to usb, after compression including overhead */
+-	atomic_t cpu_kcycles_used; /* transpired during pixel processing */
++	atomic_unchecked_t bytes_rendered; /* raw pixel-bytes driver asked to render */
++	atomic_unchecked_t bytes_identical; /* saved effort with backbuffer comparison */
++	atomic_unchecked_t bytes_sent; /* to usb, after compression including overhead */
++	atomic_unchecked_t cpu_kcycles_used; /* transpired during pixel processing */
+ };
+ 
+ #define NR_USB_REQUEST_I2C_SUB_IO 0x02
+diff -urNp linux-2.6.38.7/include/video/uvesafb.h linux-2.6.38.7/include/video/uvesafb.h
+--- linux-2.6.38.7/include/video/uvesafb.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/include/video/uvesafb.h	2011-04-28 19:34:15.000000000 -0400
 @@ -177,6 +177,7 @@ struct uvesafb_par {
  	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
  	u8 pmi_setpal;			/* PMI for palette changes */
@@ -48855,9 +57529,9 @@ diff -urNp linux-2.6.38.2/include/video/uvesafb.h linux-2.6.38.2/include/video/u
  	void *pmi_start;
  	void *pmi_pal;
  	u8 *vbe_state_orig;		/*
-diff -urNp linux-2.6.38.2/init/do_mounts.c linux-2.6.38.2/init/do_mounts.c
---- linux-2.6.38.2/init/do_mounts.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/do_mounts.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/do_mounts.c linux-2.6.38.7/init/do_mounts.c
+--- linux-2.6.38.7/init/do_mounts.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/do_mounts.c	2011-04-28 19:34:15.000000000 -0400
 @@ -287,7 +287,7 @@ static void __init get_fs_names(char *pa
  
  static int __init do_mount_root(char *name, char *fs, int flags, void *data)
@@ -48897,9 +57571,9 @@ diff -urNp linux-2.6.38.2/init/do_mounts.c linux-2.6.38.2/init/do_mounts.c
 +	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
  	sys_chroot((const char __user __force *)".");
  }
-diff -urNp linux-2.6.38.2/init/do_mounts.h linux-2.6.38.2/init/do_mounts.h
---- linux-2.6.38.2/init/do_mounts.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/do_mounts.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/do_mounts.h linux-2.6.38.7/init/do_mounts.h
+--- linux-2.6.38.7/init/do_mounts.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/do_mounts.h	2011-04-28 19:34:15.000000000 -0400
 @@ -15,15 +15,15 @@ extern int root_mountflags;
  
  static inline int create_dev(char *name, dev_t dev)
@@ -48919,9 +57593,9 @@ diff -urNp linux-2.6.38.2/init/do_mounts.h linux-2.6.38.2/init/do_mounts.h
  		return 0;
  	if (!S_ISBLK(stat.st_mode))
  		return 0;
-diff -urNp linux-2.6.38.2/init/do_mounts_initrd.c linux-2.6.38.2/init/do_mounts_initrd.c
---- linux-2.6.38.2/init/do_mounts_initrd.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/do_mounts_initrd.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/do_mounts_initrd.c linux-2.6.38.7/init/do_mounts_initrd.c
+--- linux-2.6.38.7/init/do_mounts_initrd.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/do_mounts_initrd.c	2011-04-28 19:34:15.000000000 -0400
 @@ -44,13 +44,13 @@ static void __init handle_initrd(void)
  	create_dev("/dev/root.old", Root_RAM0);
  	/* mount initrd on rootfs' /root */
@@ -48996,9 +57670,9 @@ diff -urNp linux-2.6.38.2/init/do_mounts_initrd.c linux-2.6.38.2/init/do_mounts_
 +	sys_unlink((__force const char __user *)"/initrd.image");
  	return 0;
  }
-diff -urNp linux-2.6.38.2/init/do_mounts_md.c linux-2.6.38.2/init/do_mounts_md.c
---- linux-2.6.38.2/init/do_mounts_md.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/do_mounts_md.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/do_mounts_md.c linux-2.6.38.7/init/do_mounts_md.c
+--- linux-2.6.38.7/init/do_mounts_md.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/do_mounts_md.c	2011-04-28 19:34:15.000000000 -0400
 @@ -170,7 +170,7 @@ static void __init md_setup_drive(void)
  			partitioned ? "_d" : "", minor,
  			md_setup_args[ent].device_names);
@@ -49017,9 +57691,9 @@ diff -urNp linux-2.6.38.2/init/do_mounts_md.c linux-2.6.38.2/init/do_mounts_md.c
  			sys_ioctl(fd, BLKRRPART, 0);
  		}
  		sys_close(fd);
-diff -urNp linux-2.6.38.2/init/initramfs.c linux-2.6.38.2/init/initramfs.c
---- linux-2.6.38.2/init/initramfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/initramfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/initramfs.c linux-2.6.38.7/init/initramfs.c
+--- linux-2.6.38.7/init/initramfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/initramfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -74,7 +74,7 @@ static void __init free_hash(void)
  	}
  }
@@ -49128,9 +57802,9 @@ diff -urNp linux-2.6.38.2/init/initramfs.c linux-2.6.38.2/init/initramfs.c
  	state = SkipIt;
  	next_state = Reset;
  	return 0;
-diff -urNp linux-2.6.38.2/init/Kconfig linux-2.6.38.2/init/Kconfig
---- linux-2.6.38.2/init/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/Kconfig linux-2.6.38.7/init/Kconfig
+--- linux-2.6.38.7/init/Kconfig	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/init/Kconfig	2011-05-10 22:06:56.000000000 -0400
 @@ -1185,7 +1185,7 @@ config SLUB_DEBUG
  
  config COMPAT_BRK
@@ -49140,9 +57814,9 @@ diff -urNp linux-2.6.38.2/init/Kconfig linux-2.6.38.2/init/Kconfig
  	help
  	  Randomizing heap placement makes heap exploits harder, but it
  	  also breaks ancient binaries (including anything libc5 based).
-diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
---- linux-2.6.38.2/init/main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/init/main.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/init/main.c linux-2.6.38.7/init/main.c
+--- linux-2.6.38.7/init/main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/init/main.c	2011-05-22 23:03:34.000000000 -0400
 @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) 
  extern void tc_init(void);
  #endif
@@ -49152,7 +57826,7 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  /*
   * Debug helper: via this flag we know that we are in 'early bootup code'
   * where only the boot processor is running with IRQ disabled.  This means
-@@ -206,6 +208,47 @@ static int __init set_reset_devices(char
+@@ -206,6 +208,49 @@ static int __init set_reset_devices(char
  
  __setup("reset_devices", set_reset_devices);
  
@@ -49167,12 +57841,14 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
 +{
 +#ifdef CONFIG_X86_32
 +	unsigned int cpu;
++	struct desc_struct *gdt;
 +
 +	for (cpu = 0; cpu < NR_CPUS; cpu++) {
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].type = 3;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_DS].limit = 0xf;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
-+		get_cpu_gdt_table(cpu)[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
++		gdt = get_cpu_gdt_table(cpu);
++		gdt[GDT_ENTRY_KERNEL_DS].type = 3;
++		gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
++		gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
++		gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
 +	}
 +	asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
 +#else
@@ -49200,7 +57876,7 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
  const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
  static const char *panic_later, *panic_param;
-@@ -751,6 +794,7 @@ int __init_or_module do_one_initcall(ini
+@@ -751,6 +796,7 @@ int __init_or_module do_one_initcall(ini
  {
  	int count = preempt_count();
  	int ret;
@@ -49208,7 +57884,7 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  
  	if (initcall_debug)
  		ret = do_one_initcall_debug(fn);
-@@ -763,15 +807,15 @@ int __init_or_module do_one_initcall(ini
+@@ -763,15 +809,15 @@ int __init_or_module do_one_initcall(ini
  		sprintf(msgbuf, "error code %d ", ret);
  
  	if (preempt_count() != count) {
@@ -49228,7 +57904,7 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  	}
  
  	return ret;
-@@ -898,7 +942,7 @@ static int __init kernel_init(void * unu
+@@ -898,7 +944,7 @@ static int __init kernel_init(void * unu
  	do_basic_setup();
  
  	/* Open the /dev/console on the rootfs, this should never fail */
@@ -49237,7 +57913,7 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  		printk(KERN_WARNING "Warning: unable to open an initial console.\n");
  
  	(void) sys_dup(0);
-@@ -911,11 +955,13 @@ static int __init kernel_init(void * unu
+@@ -911,11 +957,13 @@ static int __init kernel_init(void * unu
  	if (!ramdisk_execute_command)
  		ramdisk_execute_command = "/init";
  
@@ -49252,9 +57928,9 @@ diff -urNp linux-2.6.38.2/init/main.c linux-2.6.38.2/init/main.c
  	/*
  	 * Ok, we have completed the initial bootup, and
  	 * we're essentially up and running. Get rid of the
-diff -urNp linux-2.6.38.2/ipc/mqueue.c linux-2.6.38.2/ipc/mqueue.c
---- linux-2.6.38.2/ipc/mqueue.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/ipc/mqueue.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/ipc/mqueue.c linux-2.6.38.7/ipc/mqueue.c
+--- linux-2.6.38.7/ipc/mqueue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/ipc/mqueue.c	2011-04-28 19:34:15.000000000 -0400
 @@ -154,6 +154,7 @@ static struct inode *mqueue_get_inode(st
  			mq_bytes = (mq_msg_tblsz +
  				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
@@ -49263,9 +57939,30 @@ diff -urNp linux-2.6.38.2/ipc/mqueue.c linux-2.6.38.2/ipc/mqueue.c
  			spin_lock(&mq_lock);
  			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
  		 	    u->mq_bytes + mq_bytes >
-diff -urNp linux-2.6.38.2/ipc/shm.c linux-2.6.38.2/ipc/shm.c
---- linux-2.6.38.2/ipc/shm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/ipc/shm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/ipc/sem.c linux-2.6.38.7/ipc/sem.c
+--- linux-2.6.38.7/ipc/sem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/ipc/sem.c	2011-05-16 21:47:08.000000000 -0400
+@@ -854,6 +854,8 @@ static int semctl_main(struct ipc_namesp
+ 	int nsems;
+ 	struct list_head tasks;
+ 
++	pax_track_stack();
++
+ 	sma = sem_lock_check(ns, semid);
+ 	if (IS_ERR(sma))
+ 		return PTR_ERR(sma);
+@@ -1299,6 +1301,8 @@ SYSCALL_DEFINE4(semtimedop, int, semid, 
+ 	struct ipc_namespace *ns;
+ 	struct list_head tasks;
+ 
++	pax_track_stack();
++
+ 	ns = current->nsproxy->ipc_ns;
+ 
+ 	if (nsops < 1 || semid < 0)
+diff -urNp linux-2.6.38.7/ipc/shm.c linux-2.6.38.7/ipc/shm.c
+--- linux-2.6.38.7/ipc/shm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/ipc/shm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -69,6 +69,14 @@ static void shm_destroy (struct ipc_name
  static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
  #endif
@@ -49327,9 +58024,9 @@ diff -urNp linux-2.6.38.2/ipc/shm.c linux-2.6.38.2/ipc/shm.c
  	size = i_size_read(path.dentry->d_inode);
  	shm_unlock(shp);
  
-diff -urNp linux-2.6.38.2/kernel/acct.c linux-2.6.38.2/kernel/acct.c
---- linux-2.6.38.2/kernel/acct.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/acct.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/acct.c linux-2.6.38.7/kernel/acct.c
+--- linux-2.6.38.7/kernel/acct.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/acct.c	2011-04-28 19:34:15.000000000 -0400
 @@ -570,7 +570,7 @@ static void do_acct_process(struct bsd_a
  	 */
  	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
@@ -49339,9 +58036,69 @@ diff -urNp linux-2.6.38.2/kernel/acct.c linux-2.6.38.2/kernel/acct.c
  			       sizeof(acct_t), &file->f_pos);
  	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
  	set_fs(fs);
-diff -urNp linux-2.6.38.2/kernel/capability.c linux-2.6.38.2/kernel/capability.c
---- linux-2.6.38.2/kernel/capability.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/capability.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/audit.c linux-2.6.38.7/kernel/audit.c
+--- linux-2.6.38.7/kernel/audit.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/audit.c	2011-04-28 19:57:25.000000000 -0400
+@@ -110,7 +110,7 @@ u32		audit_sig_sid = 0;
+    3) suppressed due to audit_rate_limit
+    4) suppressed due to audit_backlog_limit
+ */
+-static atomic_t    audit_lost = ATOMIC_INIT(0);
++static atomic_unchecked_t    audit_lost = ATOMIC_INIT(0);
+ 
+ /* The netlink socket. */
+ static struct sock *audit_sock;
+@@ -232,7 +232,7 @@ void audit_log_lost(const char *message)
+ 	unsigned long		now;
+ 	int			print;
+ 
+-	atomic_inc(&audit_lost);
++	atomic_inc_unchecked(&audit_lost);
+ 
+ 	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
+ 
+@@ -251,7 +251,7 @@ void audit_log_lost(const char *message)
+ 			printk(KERN_WARNING
+ 				"audit: audit_lost=%d audit_rate_limit=%d "
+ 				"audit_backlog_limit=%d\n",
+-				atomic_read(&audit_lost),
++				atomic_read_unchecked(&audit_lost),
+ 				audit_rate_limit,
+ 				audit_backlog_limit);
+ 		audit_panic(message);
+@@ -684,7 +684,7 @@ static int audit_receive_msg(struct sk_b
+ 		status_set.pid		 = audit_pid;
+ 		status_set.rate_limit	 = audit_rate_limit;
+ 		status_set.backlog_limit = audit_backlog_limit;
+-		status_set.lost		 = atomic_read(&audit_lost);
++		status_set.lost		 = atomic_read_unchecked(&audit_lost);
+ 		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
+ 		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
+ 				 &status_set, sizeof(status_set));
+diff -urNp linux-2.6.38.7/kernel/auditsc.c linux-2.6.38.7/kernel/auditsc.c
+--- linux-2.6.38.7/kernel/auditsc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/auditsc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -2111,7 +2111,7 @@ int auditsc_get_stamp(struct audit_conte
+ }
+ 
+ /* global counter which is incremented every time something logs in */
+-static atomic_t session_id = ATOMIC_INIT(0);
++static atomic_unchecked_t session_id = ATOMIC_INIT(0);
+ 
+ /**
+  * audit_set_loginuid - set a task's audit_context loginuid
+@@ -2124,7 +2124,7 @@ static atomic_t session_id = ATOMIC_INIT
+  */
+ int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
+ {
+-	unsigned int sessionid = atomic_inc_return(&session_id);
++	unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
+ 	struct audit_context *context = task->audit_context;
+ 
+ 	if (context && context->in_syscall) {
+diff -urNp linux-2.6.38.7/kernel/capability.c linux-2.6.38.7/kernel/capability.c
+--- linux-2.6.38.7/kernel/capability.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/capability.c	2011-04-28 19:34:15.000000000 -0400
 @@ -205,6 +205,9 @@ SYSCALL_DEFINE2(capget, cap_user_header_
  		 * before modification is attempted and the application
  		 * fails.
@@ -49380,9 +58137,21 @@ diff -urNp linux-2.6.38.2/kernel/capability.c linux-2.6.38.2/kernel/capability.c
 +
  EXPORT_SYMBOL(capable);
 +EXPORT_SYMBOL(capable_nolog);
-diff -urNp linux-2.6.38.2/kernel/compat.c linux-2.6.38.2/kernel/compat.c
---- linux-2.6.38.2/kernel/compat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/compat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/cgroup.c linux-2.6.38.7/kernel/cgroup.c
+--- linux-2.6.38.7/kernel/cgroup.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/kernel/cgroup.c	2011-05-16 21:47:09.000000000 -0400
+@@ -598,6 +598,8 @@ static struct css_set *find_css_set(
+ 	struct hlist_head *hhead;
+ 	struct cg_cgroup_link *link;
+ 
++	pax_track_stack();
++
+ 	/* First see if we already have a cgroup group that matches
+ 	 * the desired set */
+ 	read_lock(&css_set_lock);
+diff -urNp linux-2.6.38.7/kernel/compat.c linux-2.6.38.7/kernel/compat.c
+--- linux-2.6.38.7/kernel/compat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/compat.c	2011-04-28 19:34:15.000000000 -0400
 @@ -13,6 +13,7 @@
  
  #include <linux/linkage.h>
@@ -49391,9 +58160,9 @@ diff -urNp linux-2.6.38.2/kernel/compat.c linux-2.6.38.2/kernel/compat.c
  #include <linux/errno.h>
  #include <linux/time.h>
  #include <linux/signal.h>
-diff -urNp linux-2.6.38.2/kernel/configs.c linux-2.6.38.2/kernel/configs.c
---- linux-2.6.38.2/kernel/configs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/configs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/configs.c linux-2.6.38.7/kernel/configs.c
+--- linux-2.6.38.7/kernel/configs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/configs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -74,8 +74,19 @@ static int __init ikconfig_init(void)
  	struct proc_dir_entry *entry;
  
@@ -49414,10 +58183,82 @@ diff -urNp linux-2.6.38.2/kernel/configs.c linux-2.6.38.2/kernel/configs.c
  	if (!entry)
  		return -ENOMEM;
  
-diff -urNp linux-2.6.38.2/kernel/cred.c linux-2.6.38.2/kernel/cred.c
---- linux-2.6.38.2/kernel/cred.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/cred.c	2011-03-21 18:31:35.000000000 -0400
-@@ -483,6 +483,8 @@ int commit_creds(struct cred *new)
+diff -urNp linux-2.6.38.7/kernel/cred.c linux-2.6.38.7/kernel/cred.c
+--- linux-2.6.38.7/kernel/cred.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/cred.c	2011-05-17 19:31:43.000000000 -0400
+@@ -157,6 +157,8 @@ static void put_cred_rcu(struct rcu_head
+  */
+ void __put_cred(struct cred *cred)
+ {
++	pax_track_stack();
++
+ 	kdebug("__put_cred(%p{%d,%d})", cred,
+ 	       atomic_read(&cred->usage),
+ 	       read_cred_subscribers(cred));
+@@ -181,6 +183,8 @@ void exit_creds(struct task_struct *tsk)
+ {
+ 	struct cred *cred;
+ 
++	pax_track_stack();
++
+ 	kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
+ 	       atomic_read(&tsk->cred->usage),
+ 	       read_cred_subscribers(tsk->cred));
+@@ -219,6 +223,8 @@ const struct cred *get_task_cred(struct 
+ {
+ 	const struct cred *cred;
+ 
++	pax_track_stack();
++
+ 	rcu_read_lock();
+ 
+ 	do {
+@@ -238,6 +244,8 @@ struct cred *cred_alloc_blank(void)
+ {
+ 	struct cred *new;
+ 
++	pax_track_stack();
++
+ 	new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
+ 	if (!new)
+ 		return NULL;
+@@ -286,6 +294,8 @@ struct cred *prepare_creds(void)
+ 	const struct cred *old;
+ 	struct cred *new;
+ 
++	pax_track_stack();
++
+ 	validate_process_creds();
+ 
+ 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+@@ -332,6 +342,8 @@ struct cred *prepare_exec_creds(void)
+ 	struct thread_group_cred *tgcred = NULL;
+ 	struct cred *new;
+ 
++	pax_track_stack();
++
+ #ifdef CONFIG_KEYS
+ 	tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
+ 	if (!tgcred)
+@@ -384,6 +396,8 @@ int copy_creds(struct task_struct *p, un
+ 	struct cred *new;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	if (
+ #ifdef CONFIG_KEYS
+ 		!p->cred->thread_keyring &&
+@@ -469,6 +483,8 @@ int commit_creds(struct cred *new)
+ 	struct task_struct *task = current;
+ 	const struct cred *old = task->real_cred;
+ 
++	pax_track_stack();
++
+ 	kdebug("commit_creds(%p{%d,%d})", new,
+ 	       atomic_read(&new->usage),
+ 	       read_cred_subscribers(new));
+@@ -483,6 +499,8 @@ int commit_creds(struct cred *new)
  
  	get_cred(new); /* we will require a ref for the subj creds too */
  
@@ -49426,9 +58267,63 @@ diff -urNp linux-2.6.38.2/kernel/cred.c linux-2.6.38.2/kernel/cred.c
  	/* dumpability changes */
  	if (old->euid != new->euid ||
  	    old->egid != new->egid ||
-diff -urNp linux-2.6.38.2/kernel/debug/debug_core.c linux-2.6.38.2/kernel/debug/debug_core.c
---- linux-2.6.38.2/kernel/debug/debug_core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/debug/debug_core.c	2011-03-21 18:31:35.000000000 -0400
+@@ -545,6 +563,8 @@ EXPORT_SYMBOL(commit_creds);
+  */
+ void abort_creds(struct cred *new)
+ {
++	pax_track_stack();
++
+ 	kdebug("abort_creds(%p{%d,%d})", new,
+ 	       atomic_read(&new->usage),
+ 	       read_cred_subscribers(new));
+@@ -568,6 +588,8 @@ const struct cred *override_creds(const 
+ {
+ 	const struct cred *old = current->cred;
+ 
++	pax_track_stack();
++
+ 	kdebug("override_creds(%p{%d,%d})", new,
+ 	       atomic_read(&new->usage),
+ 	       read_cred_subscribers(new));
+@@ -597,6 +619,8 @@ void revert_creds(const struct cred *old
+ {
+ 	const struct cred *override = current->cred;
+ 
++	pax_track_stack();
++
+ 	kdebug("revert_creds(%p{%d,%d})", old,
+ 	       atomic_read(&old->usage),
+ 	       read_cred_subscribers(old));
+@@ -643,6 +667,8 @@ struct cred *prepare_kernel_cred(struct 
+ 	const struct cred *old;
+ 	struct cred *new;
+ 
++	pax_track_stack();
++
+ 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
+ 	if (!new)
+ 		return NULL;
+@@ -697,6 +723,8 @@ EXPORT_SYMBOL(prepare_kernel_cred);
+  */
+ int set_security_override(struct cred *new, u32 secid)
+ {
++	pax_track_stack();
++
+ 	return security_kernel_act_as(new, secid);
+ }
+ EXPORT_SYMBOL(set_security_override);
+@@ -716,6 +744,8 @@ int set_security_override_from_ctx(struc
+ 	u32 secid;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
+ 	if (ret < 0)
+ 		return ret;
+diff -urNp linux-2.6.38.7/kernel/debug/debug_core.c linux-2.6.38.7/kernel/debug/debug_core.c
+--- linux-2.6.38.7/kernel/debug/debug_core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/debug/debug_core.c	2011-04-28 19:57:25.000000000 -0400
 @@ -72,7 +72,7 @@ int			kgdb_io_module_registered;
  /* Guard for recursive entry */
  static int			exception_level;
@@ -49438,6 +58333,66 @@ diff -urNp linux-2.6.38.2/kernel/debug/debug_core.c linux-2.6.38.2/kernel/debug/
  static DEFINE_SPINLOCK(kgdb_registration_lock);
  
  /* kgdb console driver is loaded */
+@@ -119,7 +119,7 @@ static DEFINE_RAW_SPINLOCK(dbg_slave_loc
+  */
+ static atomic_t			masters_in_kgdb;
+ static atomic_t			slaves_in_kgdb;
+-static atomic_t			kgdb_break_tasklet_var;
++static atomic_unchecked_t	kgdb_break_tasklet_var;
+ atomic_t			kgdb_setting_breakpoint;
+ 
+ struct task_struct		*kgdb_usethread;
+@@ -129,7 +129,7 @@ int				kgdb_single_step;
+ static pid_t			kgdb_sstep_pid;
+ 
+ /* to keep track of the CPU which is doing the single stepping*/
+-atomic_t			kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
++atomic_unchecked_t		kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
+ 
+ /*
+  * If you are debugging a problem where roundup (the collection of
+@@ -542,7 +542,7 @@ return_normal:
+ 	 * kernel will only try for the value of sstep_tries before
+ 	 * giving up and continuing on.
+ 	 */
+-	if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
++	if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
+ 	    (kgdb_info[cpu].task &&
+ 	     kgdb_info[cpu].task->pid != kgdb_sstep_pid) && --sstep_tries) {
+ 		atomic_set(&kgdb_active, -1);
+@@ -636,8 +636,8 @@ cpu_master_loop:
+ 	}
+ 
+ kgdb_restore:
+-	if (atomic_read(&kgdb_cpu_doing_single_step) != -1) {
+-		int sstep_cpu = atomic_read(&kgdb_cpu_doing_single_step);
++	if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1) {
++		int sstep_cpu = atomic_read_unchecked(&kgdb_cpu_doing_single_step);
+ 		if (kgdb_info[sstep_cpu].task)
+ 			kgdb_sstep_pid = kgdb_info[sstep_cpu].task->pid;
+ 		else
+@@ -834,18 +834,18 @@ static void kgdb_unregister_callbacks(vo
+ static void kgdb_tasklet_bpt(unsigned long ing)
+ {
+ 	kgdb_breakpoint();
+-	atomic_set(&kgdb_break_tasklet_var, 0);
++	atomic_set_unchecked(&kgdb_break_tasklet_var, 0);
+ }
+ 
+ static DECLARE_TASKLET(kgdb_tasklet_breakpoint, kgdb_tasklet_bpt, 0);
+ 
+ void kgdb_schedule_breakpoint(void)
+ {
+-	if (atomic_read(&kgdb_break_tasklet_var) ||
++	if (atomic_read_unchecked(&kgdb_break_tasklet_var) ||
+ 		atomic_read(&kgdb_active) != -1 ||
+ 		atomic_read(&kgdb_setting_breakpoint))
+ 		return;
+-	atomic_inc(&kgdb_break_tasklet_var);
++	atomic_inc_unchecked(&kgdb_break_tasklet_var);
+ 	tasklet_schedule(&kgdb_tasklet_breakpoint);
+ }
+ EXPORT_SYMBOL_GPL(kgdb_schedule_breakpoint);
 @@ -864,7 +864,7 @@ static void kgdb_initial_breakpoint(void
   *
   *	Register it with the KGDB core.
@@ -49456,9 +58411,9 @@ diff -urNp linux-2.6.38.2/kernel/debug/debug_core.c linux-2.6.38.2/kernel/debug/
  {
  	BUG_ON(kgdb_connected);
  
-diff -urNp linux-2.6.38.2/kernel/debug/kdb/kdb_main.c linux-2.6.38.2/kernel/debug/kdb/kdb_main.c
---- linux-2.6.38.2/kernel/debug/kdb/kdb_main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/debug/kdb/kdb_main.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/debug/kdb/kdb_main.c linux-2.6.38.7/kernel/debug/kdb/kdb_main.c
+--- linux-2.6.38.7/kernel/debug/kdb/kdb_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/debug/kdb/kdb_main.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1980,7 +1980,7 @@ static int kdb_lsmod(int argc, const cha
  	list_for_each_entry(mod, kdb_modules, list) {
  
@@ -49477,9 +58432,9 @@ diff -urNp linux-2.6.38.2/kernel/debug/kdb/kdb_main.c linux-2.6.38.2/kernel/debu
  
  #ifdef CONFIG_MODULE_UNLOAD
  		{
-diff -urNp linux-2.6.38.2/kernel/exit.c linux-2.6.38.2/kernel/exit.c
---- linux-2.6.38.2/kernel/exit.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/exit.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/exit.c linux-2.6.38.7/kernel/exit.c
+--- linux-2.6.38.7/kernel/exit.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/kernel/exit.c	2011-05-22 23:06:04.000000000 -0400
 @@ -57,6 +57,10 @@
  #include <asm/pgtable.h>
  #include <asm/mmu_context.h>
@@ -49599,9 +58554,9 @@ diff -urNp linux-2.6.38.2/kernel/exit.c linux-2.6.38.2/kernel/exit.c
  	exit_mm(tsk);
  
  	if (group_dead)
-diff -urNp linux-2.6.38.2/kernel/fork.c linux-2.6.38.2/kernel/fork.c
---- linux-2.6.38.2/kernel/fork.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/fork.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/fork.c linux-2.6.38.7/kernel/fork.c
+--- linux-2.6.38.7/kernel/fork.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/fork.c	2011-04-28 19:34:15.000000000 -0400
 @@ -280,7 +280,7 @@ static struct task_struct *dup_task_stru
  	*stackend = STACK_END_MAGIC;	/* for overflow detection */
  
@@ -49898,9 +58853,9 @@ diff -urNp linux-2.6.38.2/kernel/fork.c linux-2.6.38.2/kernel/fork.c
  				new_fs = NULL;
  			else
  				new_fs = fs;
-diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
---- linux-2.6.38.2/kernel/futex.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/futex.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/futex.c linux-2.6.38.7/kernel/futex.c
+--- linux-2.6.38.7/kernel/futex.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/kernel/futex.c	2011-05-16 21:47:08.000000000 -0400
 @@ -54,6 +54,7 @@
  #include <linux/mount.h>
  #include <linux/pagemap.h>
@@ -49921,7 +58876,25 @@ diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
  	/*
  	 * The futex address must be "naturally" aligned.
  	 */
-@@ -2404,7 +2410,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+@@ -1833,6 +1839,8 @@ static int futex_wait(u32 __user *uaddr,
+ 	struct futex_q q = futex_q_init;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	if (!bitset)
+ 		return -EINVAL;
+ 	q.bitset = bitset;
+@@ -2232,6 +2240,8 @@ static int futex_wait_requeue_pi(u32 __u
+ 	struct futex_q q = futex_q_init;
+ 	int res, ret;
+ 
++	pax_track_stack();
++
+ 	if (!bitset)
+ 		return -EINVAL;
+ 
+@@ -2404,7 +2414,9 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
  {
  	struct robust_list_head __user *head;
  	unsigned long ret;
@@ -49931,7 +58904,7 @@ diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
  
  	if (!futex_cmpxchg_enabled)
  		return -ENOSYS;
-@@ -2420,11 +2428,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
+@@ -2420,11 +2432,16 @@ SYSCALL_DEFINE3(get_robust_list, int, pi
  		if (!p)
  			goto err_unlock;
  		ret = -EPERM;
@@ -49948,7 +58921,7 @@ diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
  		head = p->robust_list;
  		rcu_read_unlock();
  	}
-@@ -2667,6 +2680,7 @@ static int __init futex_init(void)
+@@ -2667,6 +2684,7 @@ static int __init futex_init(void)
  {
  	u32 curval;
  	int i;
@@ -49956,7 +58929,7 @@ diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
  
  	/*
  	 * This will fail and we want it. Some arch implementations do
-@@ -2678,7 +2692,10 @@ static int __init futex_init(void)
+@@ -2678,7 +2696,10 @@ static int __init futex_init(void)
  	 * implementation, the non-functional ones will return
  	 * -ENOSYS.
  	 */
@@ -49967,9 +58940,9 @@ diff -urNp linux-2.6.38.2/kernel/futex.c linux-2.6.38.2/kernel/futex.c
  	if (curval == -EFAULT)
  		futex_cmpxchg_enabled = 1;
  
-diff -urNp linux-2.6.38.2/kernel/futex_compat.c linux-2.6.38.2/kernel/futex_compat.c
---- linux-2.6.38.2/kernel/futex_compat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/futex_compat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/futex_compat.c linux-2.6.38.7/kernel/futex_compat.c
+--- linux-2.6.38.7/kernel/futex_compat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/futex_compat.c	2011-04-28 19:34:15.000000000 -0400
 @@ -10,6 +10,7 @@
  #include <linux/compat.h>
  #include <linux/nsproxy.h>
@@ -50007,9 +58980,9 @@ diff -urNp linux-2.6.38.2/kernel/futex_compat.c linux-2.6.38.2/kernel/futex_comp
  		head = p->compat_robust_list;
  		rcu_read_unlock();
  	}
-diff -urNp linux-2.6.38.2/kernel/gcov/base.c linux-2.6.38.2/kernel/gcov/base.c
---- linux-2.6.38.2/kernel/gcov/base.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/gcov/base.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/gcov/base.c linux-2.6.38.7/kernel/gcov/base.c
+--- linux-2.6.38.7/kernel/gcov/base.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/gcov/base.c	2011-04-28 19:34:15.000000000 -0400
 @@ -102,11 +102,6 @@ void gcov_enable_events(void)
  }
  
@@ -50031,9 +59004,9 @@ diff -urNp linux-2.6.38.2/kernel/gcov/base.c linux-2.6.38.2/kernel/gcov/base.c
  			if (prev)
  				prev->next = info->next;
  			else
-diff -urNp linux-2.6.38.2/kernel/hrtimer.c linux-2.6.38.2/kernel/hrtimer.c
---- linux-2.6.38.2/kernel/hrtimer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/hrtimer.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/hrtimer.c linux-2.6.38.7/kernel/hrtimer.c
+--- linux-2.6.38.7/kernel/hrtimer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/hrtimer.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1371,7 +1371,7 @@ void hrtimer_peek_ahead_timers(void)
  	local_irq_restore(flags);
  }
@@ -50043,9 +59016,9 @@ diff -urNp linux-2.6.38.2/kernel/hrtimer.c linux-2.6.38.2/kernel/hrtimer.c
  {
  	hrtimer_peek_ahead_timers();
  }
-diff -urNp linux-2.6.38.2/kernel/jump_label.c linux-2.6.38.2/kernel/jump_label.c
---- linux-2.6.38.2/kernel/jump_label.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/jump_label.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/jump_label.c linux-2.6.38.7/kernel/jump_label.c
+--- linux-2.6.38.7/kernel/jump_label.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/jump_label.c	2011-04-28 19:34:15.000000000 -0400
 @@ -49,6 +49,17 @@ void jump_label_unlock(void)
  	mutex_unlock(&jump_label_mutex);
  }
@@ -50086,9 +59059,9 @@ diff -urNp linux-2.6.38.2/kernel/jump_label.c linux-2.6.38.2/kernel/jump_label.c
  					iter++;
  				}
  			}
-diff -urNp linux-2.6.38.2/kernel/kallsyms.c linux-2.6.38.2/kernel/kallsyms.c
---- linux-2.6.38.2/kernel/kallsyms.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/kallsyms.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/kallsyms.c linux-2.6.38.7/kernel/kallsyms.c
+--- linux-2.6.38.7/kernel/kallsyms.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/kallsyms.c	2011-04-28 19:34:15.000000000 -0400
 @@ -11,6 +11,9 @@
   *      Changed the compression method from stem compression to "table lookup"
   *      compression (see scripts/kallsyms.c for a more complete description)
@@ -50191,31 +59164,108 @@ diff -urNp linux-2.6.38.2/kernel/kallsyms.c linux-2.6.38.2/kernel/kallsyms.c
  	if (!iter)
  		return -ENOMEM;
  	reset_iter(iter, 0);
-diff -urNp linux-2.6.38.2/kernel/kmod.c linux-2.6.38.2/kernel/kmod.c
---- linux-2.6.38.2/kernel/kmod.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/kmod.c	2011-03-26 13:28:34.000000000 -0400
-@@ -90,6 +90,18 @@ int __request_module(bool wait, const ch
+diff -urNp linux-2.6.38.7/kernel/kmod.c linux-2.6.38.7/kernel/kmod.c
+--- linux-2.6.38.7/kernel/kmod.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/kmod.c	2011-04-28 19:34:15.000000000 -0400
+@@ -65,13 +65,12 @@ char modprobe_path[KMOD_PATH_LEN] = "/sb
+  * If module auto-loading support is disabled then this function
+  * becomes a no-operation.
+  */
+-int __request_module(bool wait, const char *fmt, ...)
++static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
+ {
+-	va_list args;
+ 	char module_name[MODULE_NAME_LEN];
+ 	unsigned int max_modprobes;
+ 	int ret;
+-	char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
++	char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
+ 	static char *envp[] = { "HOME=/",
+ 				"TERM=linux",
+ 				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
+@@ -80,9 +79,7 @@ int __request_module(bool wait, const ch
+ #define MAX_KMOD_CONCURRENT 50	/* Completely arbitrary value - KAO */
+ 	static int kmod_loop_msg;
+ 
+-	va_start(args, fmt);
+-	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
+-	va_end(args);
++	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
+ 	if (ret >= MODULE_NAME_LEN)
+ 		return -ENAMETOOLONG;
+ 
+@@ -90,6 +87,20 @@ int __request_module(bool wait, const ch
  	if (ret)
  		return ret;
  
 +#ifdef CONFIG_GRKERNSEC_MODHARDEN
-+	/* we could do a tighter check here, but some distros
-+	   are taking it upon themselves to remove CAP_SYS_MODULE
-+	   from even root-running apps which cause modules to be
-+	   auto-loaded
-+	*/
-+	if (current_uid()) {
-+		gr_log_nonroot_mod_load(module_name);
-+		return -EPERM;
++	if (!current_uid()) {
++		/* hack to workaround consolekit/udisks stupidity */
++		read_lock(&tasklist_lock);
++		if (!strcmp(current->comm, "mount") &&
++		    current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
++			read_unlock(&tasklist_lock);
++			printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
++			return -EPERM;
++		}
++		read_unlock(&tasklist_lock);
 +	}
 +#endif
 +
  	/* If modprobe needs a service that is in a module, we get a recursive
  	 * loop.  Limit the number of running kmod threads to max_threads/2 or
  	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
-diff -urNp linux-2.6.38.2/kernel/kprobes.c linux-2.6.38.2/kernel/kprobes.c
---- linux-2.6.38.2/kernel/kprobes.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/kprobes.c	2011-03-21 18:31:35.000000000 -0400
+@@ -123,6 +134,47 @@ int __request_module(bool wait, const ch
+ 	atomic_dec(&kmod_concurrent);
+ 	return ret;
+ }
++
++int ___request_module(bool wait, char *module_param, const char *fmt, ...)
++{
++	va_list args;
++	int ret;
++
++	va_start(args, fmt);
++	ret = ____request_module(wait, module_param, fmt, args);
++	va_end(args);
++
++	return ret;
++}
++
++int __request_module(bool wait, const char *fmt, ...)
++{
++	va_list args;
++	int ret;
++
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	if (current_uid()) {
++		char module_param[MODULE_NAME_LEN];
++
++		memset(module_param, 0, sizeof(module_param));
++
++		snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
++
++		va_start(args, fmt);
++		ret = ____request_module(wait, module_param, fmt, args);
++		va_end(args);
++
++		return ret;
++	}
++#endif
++
++	va_start(args, fmt);
++	ret = ____request_module(wait, NULL, fmt, args);
++	va_end(args);
++
++	return ret;
++}
++
+ EXPORT_SYMBOL(__request_module);
+ #endif /* CONFIG_MODULES */
+ 
+diff -urNp linux-2.6.38.7/kernel/kprobes.c linux-2.6.38.7/kernel/kprobes.c
+--- linux-2.6.38.7/kernel/kprobes.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/kprobes.c	2011-04-28 19:34:15.000000000 -0400
 @@ -185,7 +185,7 @@ static kprobe_opcode_t __kprobes *__get_
  	 * kernel image and loaded module images reside. This is required
  	 * so x86_64 can correctly handle the %rip-relative fixups.
@@ -50252,9 +59302,9 @@ diff -urNp linux-2.6.38.2/kernel/kprobes.c linux-2.6.38.2/kernel/kprobes.c
  
  	head = &kprobe_table[i];
  	preempt_disable();
-diff -urNp linux-2.6.38.2/kernel/lockdep.c linux-2.6.38.2/kernel/lockdep.c
---- linux-2.6.38.2/kernel/lockdep.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/lockdep.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/lockdep.c linux-2.6.38.7/kernel/lockdep.c
+--- linux-2.6.38.7/kernel/lockdep.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/lockdep.c	2011-04-28 19:34:15.000000000 -0400
 @@ -571,6 +571,10 @@ static int static_obj(void *obj)
  		      end   = (unsigned long) &_end,
  		      addr  = (unsigned long) obj;
@@ -50283,9 +59333,9 @@ diff -urNp linux-2.6.38.2/kernel/lockdep.c linux-2.6.38.2/kernel/lockdep.c
  	if (very_verbose(class)) {
  		printk("\nacquire class [%p] %s", class->key, class->name);
  		if (class->name_version > 1)
-diff -urNp linux-2.6.38.2/kernel/lockdep_proc.c linux-2.6.38.2/kernel/lockdep_proc.c
---- linux-2.6.38.2/kernel/lockdep_proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/lockdep_proc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/lockdep_proc.c linux-2.6.38.7/kernel/lockdep_proc.c
+--- linux-2.6.38.7/kernel/lockdep_proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/lockdep_proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -39,7 +39,7 @@ static void l_stop(struct seq_file *m, v
  
  static void print_name(struct seq_file *m, struct lock_class *class)
@@ -50295,10 +59345,18 @@ diff -urNp linux-2.6.38.2/kernel/lockdep_proc.c linux-2.6.38.2/kernel/lockdep_pr
  	const char *name = class->name;
  
  	if (!name) {
-diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
---- linux-2.6.38.2/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/module.c	2011-03-21 18:31:35.000000000 -0400
-@@ -118,7 +118,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
+diff -urNp linux-2.6.38.7/kernel/module.c linux-2.6.38.7/kernel/module.c
+--- linux-2.6.38.7/kernel/module.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/module.c	2011-04-29 18:46:41.000000000 -0400
+@@ -57,6 +57,7 @@
+ #include <linux/kmemleak.h>
+ #include <linux/jump_label.h>
+ #include <linux/pfn.h>
++#include <linux/grsecurity.h>
+ 
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/module.h>
+@@ -118,7 +119,8 @@ static BLOCKING_NOTIFIER_HEAD(module_not
  
  /* Bounds of module allocation, for speeding __module_address.
   * Protected by module_mutex. */
@@ -50308,7 +59366,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  int register_module_notifier(struct notifier_block * nb)
  {
-@@ -282,7 +283,7 @@ bool each_symbol(bool (*fn)(const struct
+@@ -282,7 +284,7 @@ bool each_symbol(bool (*fn)(const struct
  		return true;
  
  	list_for_each_entry_rcu(mod, &modules, list) {
@@ -50317,7 +59375,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
  			  NOT_GPL_ONLY, false },
  			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
-@@ -304,7 +305,7 @@ bool each_symbol(bool (*fn)(const struct
+@@ -304,7 +306,7 @@ bool each_symbol(bool (*fn)(const struct
  #endif
  		};
  
@@ -50326,7 +59384,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  			return true;
  	}
  	return false;
-@@ -415,7 +416,7 @@ static inline void __percpu *mod_percpu(
+@@ -415,7 +417,7 @@ static inline void __percpu *mod_percpu(
  static int percpu_modalloc(struct module *mod,
  			   unsigned long size, unsigned long align)
  {
@@ -50335,7 +59393,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
  		       mod->name, align, PAGE_SIZE);
  		align = PAGE_SIZE;
-@@ -1143,7 +1144,7 @@ resolve_symbol_wait(struct module *mod,
+@@ -1143,7 +1145,7 @@ resolve_symbol_wait(struct module *mod,
   */
  #ifdef CONFIG_SYSFS
  
@@ -50344,7 +59402,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  static inline bool sect_empty(const Elf_Shdr *sect)
  {
  	return !(sect->sh_flags & SHF_ALLOC) || sect->sh_size == 0;
-@@ -1612,17 +1613,17 @@ void unset_section_ro_nx(struct module *
+@@ -1612,17 +1614,17 @@ void unset_section_ro_nx(struct module *
  {
  	unsigned long total_pages;
  
@@ -50370,7 +59428,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	}
  }
  
-@@ -1633,14 +1634,14 @@ void set_all_modules_text_rw()
+@@ -1633,14 +1635,14 @@ void set_all_modules_text_rw()
  
  	mutex_lock(&module_mutex);
  	list_for_each_entry_rcu(mod, &modules, list) {
@@ -50391,7 +59449,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  						set_memory_rw);
  		}
  	}
-@@ -1654,14 +1655,14 @@ void set_all_modules_text_ro()
+@@ -1654,14 +1656,14 @@ void set_all_modules_text_ro()
  
  	mutex_lock(&module_mutex);
  	list_for_each_entry_rcu(mod, &modules, list) {
@@ -50412,7 +59470,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  						set_memory_ro);
  		}
  	}
-@@ -1696,17 +1697,20 @@ static void free_module(struct module *m
+@@ -1696,17 +1698,20 @@ static void free_module(struct module *m
  	destroy_params(mod->kp, mod->num_kp);
  
  	/* This may be NULL, but that's OK */
@@ -50438,7 +59496,39 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  #ifdef CONFIG_MPU
  	update_protections(current->mm);
-@@ -1799,7 +1803,9 @@ static int simplify_symbols(struct modul
+@@ -1775,10 +1780,31 @@ static int simplify_symbols(struct modul
+ 	unsigned int i;
+ 	int ret = 0;
+ 	const struct kernel_symbol *ksym;
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	int is_fs_load = 0;
++	int register_filesystem_found = 0;
++	char *p;
++
++	p = strstr(mod->args, "grsec_modharden_fs");
++	if (p) {
++		char *endptr = p + strlen("grsec_modharden_fs");
++		/* copy \0 as well */
++		memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
++		is_fs_load = 1;
++	}
++#endif
+ 
+ 	for (i = 1; i < symsec->sh_size / sizeof(Elf_Sym); i++) {
+ 		const char *name = info->strtab + sym[i].st_name;
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++		/* it's a real shame this will never get ripped and copied
++		   upstream! ;(
++		*/
++		if (is_fs_load && !strcmp(name, "register_filesystem"))
++			register_filesystem_found = 1;
++#endif
++
+ 		switch (sym[i].st_shndx) {
+ 		case SHN_COMMON:
+ 			/* We compiled with -fno-common.  These are not
+@@ -1799,7 +1825,9 @@ static int simplify_symbols(struct modul
  			ksym = resolve_symbol_wait(mod, info, name);
  			/* Ok if resolved.  */
  			if (ksym && !IS_ERR(ksym)) {
@@ -50448,7 +59538,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  				break;
  			}
  
-@@ -1818,7 +1824,9 @@ static int simplify_symbols(struct modul
+@@ -1818,11 +1846,20 @@ static int simplify_symbols(struct modul
  				secbase = (unsigned long)mod_percpu(mod);
  			else
  				secbase = info->sechdrs[sym[i].st_shndx].sh_addr;
@@ -50458,7 +59548,18 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  			break;
  		}
  	}
-@@ -1906,22 +1914,12 @@ static void layout_sections(struct modul
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	if (is_fs_load && !register_filesystem_found) {
++		printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
++		ret = -EPERM;
++	}
++#endif
++
+ 	return ret;
+ }
+ 
+@@ -1906,22 +1943,12 @@ static void layout_sections(struct modul
  			    || s->sh_entsize != ~0UL
  			    || strstarts(sname, ".init"))
  				continue;
@@ -50485,7 +59586,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	}
  
  	DEBUGP("Init section allocation order:\n");
-@@ -1935,23 +1933,13 @@ static void layout_sections(struct modul
+@@ -1935,23 +1962,13 @@ static void layout_sections(struct modul
  			    || s->sh_entsize != ~0UL
  			    || !strstarts(sname, ".init"))
  				continue;
@@ -50514,7 +59615,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	}
  }
  
-@@ -2119,7 +2107,7 @@ static void layout_symtab(struct module 
+@@ -2119,7 +2136,7 @@ static void layout_symtab(struct module 
  
  	/* Put symbol section at end of init part of module. */
  	symsect->sh_flags |= SHF_ALLOC;
@@ -50523,7 +59624,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  					 info->index.sym) | INIT_OFFSET_MASK;
  	DEBUGP("\t%s\n", info->secstrings + symsect->sh_name);
  
-@@ -2136,19 +2124,19 @@ static void layout_symtab(struct module 
+@@ -2136,19 +2153,19 @@ static void layout_symtab(struct module 
  		}
  
  	/* Append room for core symbols at end of core part. */
@@ -50548,7 +59649,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  }
  
  static void add_kallsyms(struct module *mod, const struct load_info *info)
-@@ -2164,11 +2152,13 @@ static void add_kallsyms(struct module *
+@@ -2164,11 +2181,13 @@ static void add_kallsyms(struct module *
  	/* Make sure we get permanent strtab: don't use info->strtab. */
  	mod->strtab = (void *)info->sechdrs[info->index.str].sh_addr;
  
@@ -50563,7 +59664,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	src = mod->symtab;
  	*dst = *src;
  	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
-@@ -2181,10 +2171,12 @@ static void add_kallsyms(struct module *
+@@ -2181,10 +2200,12 @@ static void add_kallsyms(struct module *
  	}
  	mod->core_num_syms = ndst;
  
@@ -50577,7 +59678,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  }
  #else
  static inline void layout_symtab(struct module *mod, struct load_info *info)
-@@ -2213,17 +2205,33 @@ static void dynamic_debug_remove(struct 
+@@ -2213,17 +2234,33 @@ static void dynamic_debug_remove(struct 
  		ddebug_remove_module(debug->modname);
  }
  
@@ -50616,7 +59717,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  		mutex_unlock(&module_mutex);
  	}
  	return ret;
-@@ -2516,7 +2524,7 @@ static int move_module(struct module *mo
+@@ -2516,7 +2553,7 @@ static int move_module(struct module *mo
  	void *ptr;
  
  	/* Do the allocs. */
@@ -50625,7 +59726,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	/*
  	 * The pointer to this block is stored in the module structure
  	 * which is inside the block. Just mark it as not being a
-@@ -2526,23 +2534,50 @@ static int move_module(struct module *mo
+@@ -2526,23 +2563,50 @@ static int move_module(struct module *mo
  	if (!ptr)
  		return -ENOMEM;
  
@@ -50684,7 +59785,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  	/* Transfer each section which specifies SHF_ALLOC */
  	DEBUGP("final section addresses:\n");
-@@ -2553,16 +2588,45 @@ static int move_module(struct module *mo
+@@ -2553,16 +2617,45 @@ static int move_module(struct module *mo
  		if (!(shdr->sh_flags & SHF_ALLOC))
  			continue;
  
@@ -50737,7 +59838,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  		DEBUGP("\t0x%lx %s\n",
  		       shdr->sh_addr, info->secstrings + shdr->sh_name);
  	}
-@@ -2613,12 +2677,12 @@ static void flush_module_icache(const st
+@@ -2613,12 +2706,12 @@ static void flush_module_icache(const st
  	 * Do it before processing of module parameters, so the module
  	 * can provide parameter accessor functions of its own.
  	 */
@@ -50756,7 +59857,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  	set_fs(old_fs);
  }
-@@ -2690,8 +2754,10 @@ static void module_deallocate(struct mod
+@@ -2690,8 +2783,10 @@ static void module_deallocate(struct mod
  {
  	kfree(info->strmap);
  	percpu_modfree(mod);
@@ -50769,7 +59870,73 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  }
  
  static int post_relocation(struct module *mod, const struct load_info *info)
-@@ -2877,16 +2943,16 @@ SYSCALL_DEFINE3(init_module, void __user
+@@ -2748,9 +2843,38 @@ static struct module *load_module(void _
+ 	if (err)
+ 		goto free_unload;
+ 
++	/* Now copy in args */
++	mod->args = strndup_user(uargs, ~0UL >> 1);
++	if (IS_ERR(mod->args)) {
++		err = PTR_ERR(mod->args);
++		goto free_unload;
++	}
++
+ 	/* Set up MODINFO_ATTR fields */
+ 	setup_modinfo(mod, &info);
+ 
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++	{
++		char *p, *p2;
++
++		if (strstr(mod->args, "grsec_modharden_netdev")) {
++			printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
++			err = -EPERM;
++			goto free_modinfo;
++		} else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
++			p += strlen("grsec_modharden_normal");
++			p2 = strstr(p, "_");
++			if (p2) {
++				*p2 = '\0';
++				printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
++				*p2 = '_';
++			}
++			err = -EPERM;
++			goto free_modinfo;
++		}
++	}
++#endif
++
+ 	/* Fix up syms, so that st_value is a pointer to location. */
+ 	err = simplify_symbols(mod, &info);
+ 	if (err < 0)
+@@ -2766,13 +2890,6 @@ static struct module *load_module(void _
+ 
+ 	flush_module_icache(mod);
+ 
+-	/* Now copy in args */
+-	mod->args = strndup_user(uargs, ~0UL >> 1);
+-	if (IS_ERR(mod->args)) {
+-		err = PTR_ERR(mod->args);
+-		goto free_arch_cleanup;
+-	}
+-
+ 	/* Mark state as coming so strong_try_module_get() ignores us. */
+ 	mod->state = MODULE_STATE_COMING;
+ 
+@@ -2832,11 +2949,10 @@ static struct module *load_module(void _
+  unlock:
+ 	mutex_unlock(&module_mutex);
+ 	synchronize_sched();
+-	kfree(mod->args);
+- free_arch_cleanup:
+ 	module_arch_cleanup(mod);
+  free_modinfo:
+ 	free_modinfo(mod);
++	kfree(mod->args);
+  free_unload:
+ 	module_unload_free(mod);
+  free_module:
+@@ -2877,16 +2993,16 @@ SYSCALL_DEFINE3(init_module, void __user
  			MODULE_STATE_COMING, mod);
  
  	/* Set RO and NX regions for core */
@@ -50794,7 +59961,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  	do_mod_ctors(mod);
  	/* Start the module */
-@@ -2931,11 +2997,13 @@ SYSCALL_DEFINE3(init_module, void __user
+@@ -2931,11 +3047,13 @@ SYSCALL_DEFINE3(init_module, void __user
  	mod->symtab = mod->core_symtab;
  	mod->strtab = mod->core_strtab;
  #endif
@@ -50813,7 +59980,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	mutex_unlock(&module_mutex);
  
  	return 0;
-@@ -2966,10 +3034,16 @@ static const char *get_ksymbol(struct mo
+@@ -2966,10 +3084,16 @@ static const char *get_ksymbol(struct mo
  	unsigned long nextval;
  
  	/* At worse, next value is at end of module */
@@ -50833,7 +60000,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  	/* Scan for closest preceeding symbol, and next symbol. (ELF
  	   starts real symbols at 1). */
-@@ -3215,7 +3289,7 @@ static int m_show(struct seq_file *m, vo
+@@ -3215,7 +3339,7 @@ static int m_show(struct seq_file *m, vo
  	char buf[8];
  
  	seq_printf(m, "%s %u",
@@ -50842,7 +60009,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	print_unload_info(m, mod);
  
  	/* Informative for users. */
-@@ -3224,7 +3298,7 @@ static int m_show(struct seq_file *m, vo
+@@ -3224,7 +3348,7 @@ static int m_show(struct seq_file *m, vo
  		   mod->state == MODULE_STATE_COMING ? "Loading":
  		   "Live");
  	/* Used by oprofile and other similar tools. */
@@ -50851,7 +60018,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  
  	/* Taints info */
  	if (mod->taints)
-@@ -3260,7 +3334,17 @@ static const struct file_operations proc
+@@ -3260,7 +3384,17 @@ static const struct file_operations proc
  
  static int __init proc_modules_init(void)
  {
@@ -50869,7 +60036,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  	return 0;
  }
  module_init(proc_modules_init);
-@@ -3319,12 +3403,12 @@ struct module *__module_address(unsigned
+@@ -3319,12 +3453,12 @@ struct module *__module_address(unsigned
  {
  	struct module *mod;
  
@@ -50885,7 +60052,7 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  			return mod;
  	return NULL;
  }
-@@ -3358,11 +3442,20 @@ bool is_module_text_address(unsigned lon
+@@ -3358,11 +3492,20 @@ bool is_module_text_address(unsigned lon
   */
  struct module *__module_text_address(unsigned long addr)
  {
@@ -50909,9 +60076,150 @@ diff -urNp linux-2.6.38.2/kernel/module.c linux-2.6.38.2/kernel/module.c
  			mod = NULL;
  	}
  	return mod;
-diff -urNp linux-2.6.38.2/kernel/panic.c linux-2.6.38.2/kernel/panic.c
---- linux-2.6.38.2/kernel/panic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/panic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/mutex.c linux-2.6.38.7/kernel/mutex.c
+--- linux-2.6.38.7/kernel/mutex.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/mutex.c	2011-05-22 13:38:03.000000000 -0400
+@@ -160,7 +160,7 @@ __mutex_lock_common(struct mutex *lock, 
+ 	 */
+ 
+ 	for (;;) {
+-		struct thread_info *owner;
++		struct task_struct *owner;
+ 
+ 		/*
+ 		 * If we own the BKL, then don't spin. The owner of
+@@ -205,7 +205,7 @@ __mutex_lock_common(struct mutex *lock, 
+ 	spin_lock_mutex(&lock->wait_lock, flags);
+ 
+ 	debug_mutex_lock_common(lock, &waiter);
+-	debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
++	debug_mutex_add_waiter(lock, &waiter, task);
+ 
+ 	/* add waiting tasks to the end of the waitqueue (FIFO): */
+ 	list_add_tail(&waiter.list, &lock->wait_list);
+@@ -234,8 +234,7 @@ __mutex_lock_common(struct mutex *lock, 
+ 		 * TASK_UNINTERRUPTIBLE case.)
+ 		 */
+ 		if (unlikely(signal_pending_state(state, task))) {
+-			mutex_remove_waiter(lock, &waiter,
+-					    task_thread_info(task));
++			mutex_remove_waiter(lock, &waiter, task);
+ 			mutex_release(&lock->dep_map, 1, ip);
+ 			spin_unlock_mutex(&lock->wait_lock, flags);
+ 
+@@ -256,7 +255,7 @@ __mutex_lock_common(struct mutex *lock, 
+ done:
+ 	lock_acquired(&lock->dep_map, ip);
+ 	/* got the lock - rejoice! */
+-	mutex_remove_waiter(lock, &waiter, current_thread_info());
++	mutex_remove_waiter(lock, &waiter, task);
+ 	mutex_set_owner(lock);
+ 
+ 	/* set it to 0 if there are no waiters left: */
+diff -urNp linux-2.6.38.7/kernel/mutex-debug.c linux-2.6.38.7/kernel/mutex-debug.c
+--- linux-2.6.38.7/kernel/mutex-debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/mutex-debug.c	2011-05-22 13:31:07.000000000 -0400
+@@ -49,21 +49,21 @@ void debug_mutex_free_waiter(struct mute
+ }
+ 
+ void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+-			    struct thread_info *ti)
++			    struct task_struct *task)
+ {
+ 	SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
+ 
+ 	/* Mark the current thread as blocked on the lock: */
+-	ti->task->blocked_on = waiter;
++	task->blocked_on = waiter;
+ }
+ 
+ void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+-			 struct thread_info *ti)
++			 struct task_struct *task)
+ {
+ 	DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
+-	DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
+-	DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
+-	ti->task->blocked_on = NULL;
++	DEBUG_LOCKS_WARN_ON(waiter->task != task);
++	DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
++	task->blocked_on = NULL;
+ 
+ 	list_del_init(&waiter->list);
+ 	waiter->task = NULL;
+@@ -75,7 +75,7 @@ void debug_mutex_unlock(struct mutex *lo
+ 		return;
+ 
+ 	DEBUG_LOCKS_WARN_ON(lock->magic != lock);
+-	DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
++	DEBUG_LOCKS_WARN_ON(lock->owner != current);
+ 	DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
+ 	mutex_clear_owner(lock);
+ }
+diff -urNp linux-2.6.38.7/kernel/mutex-debug.h linux-2.6.38.7/kernel/mutex-debug.h
+--- linux-2.6.38.7/kernel/mutex-debug.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/mutex-debug.h	2011-04-28 19:34:15.000000000 -0400
+@@ -20,16 +20,16 @@ extern void debug_mutex_wake_waiter(stru
+ extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
+ extern void debug_mutex_add_waiter(struct mutex *lock,
+ 				   struct mutex_waiter *waiter,
+-				   struct thread_info *ti);
++				   struct task_struct *task);
+ extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
+-				struct thread_info *ti);
++				struct task_struct *task);
+ extern void debug_mutex_unlock(struct mutex *lock);
+ extern void debug_mutex_init(struct mutex *lock, const char *name,
+ 			     struct lock_class_key *key);
+ 
+ static inline void mutex_set_owner(struct mutex *lock)
+ {
+-	lock->owner = current_thread_info();
++	lock->owner = current;
+ }
+ 
+ static inline void mutex_clear_owner(struct mutex *lock)
+diff -urNp linux-2.6.38.7/kernel/mutex.h linux-2.6.38.7/kernel/mutex.h
+--- linux-2.6.38.7/kernel/mutex.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/mutex.h	2011-04-28 19:34:15.000000000 -0400
+@@ -19,7 +19,7 @@
+ #ifdef CONFIG_SMP
+ static inline void mutex_set_owner(struct mutex *lock)
+ {
+-	lock->owner = current_thread_info();
++	lock->owner = current;
+ }
+ 
+ static inline void mutex_clear_owner(struct mutex *lock)
+diff -urNp linux-2.6.38.7/kernel/padata.c linux-2.6.38.7/kernel/padata.c
+--- linux-2.6.38.7/kernel/padata.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/padata.c	2011-04-28 19:57:25.000000000 -0400
+@@ -132,10 +132,10 @@ int padata_do_parallel(struct padata_ins
+ 	padata->pd = pd;
+ 	padata->cb_cpu = cb_cpu;
+ 
+-	if (unlikely(atomic_read(&pd->seq_nr) == pd->max_seq_nr))
+-		atomic_set(&pd->seq_nr, -1);
++	if (unlikely(atomic_read_unchecked(&pd->seq_nr) == pd->max_seq_nr))
++		atomic_set_unchecked(&pd->seq_nr, -1);
+ 
+-	padata->seq_nr = atomic_inc_return(&pd->seq_nr);
++	padata->seq_nr = atomic_inc_return_unchecked(&pd->seq_nr);
+ 
+ 	target_cpu = padata_cpu_hash(padata);
+ 	queue = per_cpu_ptr(pd->pqueue, target_cpu);
+@@ -444,7 +444,7 @@ static struct parallel_data *padata_allo
+ 	padata_init_pqueues(pd);
+ 	padata_init_squeues(pd);
+ 	setup_timer(&pd->timer, padata_reorder_timer, (unsigned long)pd);
+-	atomic_set(&pd->seq_nr, -1);
++	atomic_set_unchecked(&pd->seq_nr, -1);
+ 	atomic_set(&pd->reorder_objects, 0);
+ 	atomic_set(&pd->refcnt, 0);
+ 	pd->pinst = pinst;
+diff -urNp linux-2.6.38.7/kernel/panic.c linux-2.6.38.7/kernel/panic.c
+--- linux-2.6.38.7/kernel/panic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/panic.c	2011-04-28 19:34:15.000000000 -0400
 @@ -369,7 +369,7 @@ static void warn_slowpath_common(const c
  	const char *board;
  
@@ -50931,9 +60239,92 @@ diff -urNp linux-2.6.38.2/kernel/panic.c linux-2.6.38.2/kernel/panic.c
  		__builtin_return_address(0));
  }
  EXPORT_SYMBOL(__stack_chk_fail);
-diff -urNp linux-2.6.38.2/kernel/pid.c linux-2.6.38.2/kernel/pid.c
---- linux-2.6.38.2/kernel/pid.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/pid.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/perf_event.c linux-2.6.38.7/kernel/perf_event.c
+--- linux-2.6.38.7/kernel/perf_event.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/kernel/perf_event.c	2011-04-28 19:57:25.000000000 -0400
+@@ -70,7 +70,7 @@ int sysctl_perf_event_mlock __read_mostl
+  */
+ int sysctl_perf_event_sample_rate __read_mostly = 100000;
+ 
+-static atomic64_t perf_event_id;
++static atomic64_unchecked_t perf_event_id;
+ 
+ static void cpu_ctx_sched_out(struct perf_cpu_context *cpuctx,
+ 			      enum event_type_t event_type);
+@@ -1923,7 +1923,7 @@ static void __perf_event_read(void *info
+ 
+ static inline u64 perf_event_count(struct perf_event *event)
+ {
+-	return local64_read(&event->count) + atomic64_read(&event->child_count);
++	return local64_read(&event->count) + atomic64_read_unchecked(&event->child_count);
+ }
+ 
+ static u64 perf_event_read(struct perf_event *event)
+@@ -2442,9 +2442,9 @@ u64 perf_event_read_value(struct perf_ev
+ 	mutex_lock(&event->child_mutex);
+ 	total += perf_event_read(event);
+ 	*enabled += event->total_time_enabled +
+-			atomic64_read(&event->child_total_time_enabled);
++			atomic64_read_unchecked(&event->child_total_time_enabled);
+ 	*running += event->total_time_running +
+-			atomic64_read(&event->child_total_time_running);
++			atomic64_read_unchecked(&event->child_total_time_running);
+ 
+ 	list_for_each_entry(child, &event->child_list, child_list) {
+ 		total += perf_event_read(child);
+@@ -2807,10 +2807,10 @@ void perf_event_update_userpage(struct p
+ 		userpg->offset -= local64_read(&event->hw.prev_count);
+ 
+ 	userpg->time_enabled = event->total_time_enabled +
+-			atomic64_read(&event->child_total_time_enabled);
++			atomic64_read_unchecked(&event->child_total_time_enabled);
+ 
+ 	userpg->time_running = event->total_time_running +
+-			atomic64_read(&event->child_total_time_running);
++			atomic64_read_unchecked(&event->child_total_time_running);
+ 
+ 	barrier();
+ 	++userpg->lock;
+@@ -3607,11 +3607,11 @@ static void perf_output_read_one(struct 
+ 	values[n++] = perf_event_count(event);
+ 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
+ 		values[n++] = enabled +
+-			atomic64_read(&event->child_total_time_enabled);
++			atomic64_read_unchecked(&event->child_total_time_enabled);
+ 	}
+ 	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
+ 		values[n++] = running +
+-			atomic64_read(&event->child_total_time_running);
++			atomic64_read_unchecked(&event->child_total_time_running);
+ 	}
+ 	if (read_format & PERF_FORMAT_ID)
+ 		values[n++] = primary_event_id(event);
+@@ -5597,7 +5597,7 @@ perf_event_alloc(struct perf_event_attr 
+ 	event->parent		= parent_event;
+ 
+ 	event->ns		= get_pid_ns(current->nsproxy->pid_ns);
+-	event->id		= atomic64_inc_return(&perf_event_id);
++	event->id		= atomic64_inc_return_unchecked(&perf_event_id);
+ 
+ 	event->state		= PERF_EVENT_STATE_INACTIVE;
+ 
+@@ -6095,10 +6095,10 @@ static void sync_child_event(struct perf
+ 	/*
+ 	 * Add back the child's count to the parent's count:
+ 	 */
+-	atomic64_add(child_val, &parent_event->child_count);
+-	atomic64_add(child_event->total_time_enabled,
++	atomic64_add_unchecked(child_val, &parent_event->child_count);
++	atomic64_add_unchecked(child_event->total_time_enabled,
+ 		     &parent_event->child_total_time_enabled);
+-	atomic64_add(child_event->total_time_running,
++	atomic64_add_unchecked(child_event->total_time_running,
+ 		     &parent_event->child_total_time_running);
+ 
+ 	/*
+diff -urNp linux-2.6.38.7/kernel/pid.c linux-2.6.38.7/kernel/pid.c
+--- linux-2.6.38.7/kernel/pid.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/kernel/pid.c	2011-04-28 19:34:15.000000000 -0400
 @@ -33,6 +33,7 @@
  #include <linux/rculist.h>
  #include <linux/bootmem.h>
@@ -50951,7 +60342,7 @@ diff -urNp linux-2.6.38.2/kernel/pid.c linux-2.6.38.2/kernel/pid.c
  
  int pid_max_min = RESERVED_PIDS + 1;
  int pid_max_max = PID_MAX_LIMIT;
-@@ -416,8 +417,15 @@ EXPORT_SYMBOL(pid_task);
+@@ -419,8 +420,15 @@ EXPORT_SYMBOL(pid_task);
   */
  struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
  {
@@ -50968,9 +60359,9 @@ diff -urNp linux-2.6.38.2/kernel/pid.c linux-2.6.38.2/kernel/pid.c
  }
  
  struct task_struct *find_task_by_vpid(pid_t vnr)
-diff -urNp linux-2.6.38.2/kernel/posix-cpu-timers.c linux-2.6.38.2/kernel/posix-cpu-timers.c
---- linux-2.6.38.2/kernel/posix-cpu-timers.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/posix-cpu-timers.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/posix-cpu-timers.c linux-2.6.38.7/kernel/posix-cpu-timers.c
+--- linux-2.6.38.7/kernel/posix-cpu-timers.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/posix-cpu-timers.c	2011-04-28 19:34:15.000000000 -0400
 @@ -6,6 +6,7 @@
  #include <linux/posix-timers.h>
  #include <linux/errno.h>
@@ -50979,9 +60370,9 @@ diff -urNp linux-2.6.38.2/kernel/posix-cpu-timers.c linux-2.6.38.2/kernel/posix-
  #include <asm/uaccess.h>
  #include <linux/kernel_stat.h>
  #include <trace/events/timer.h>
-diff -urNp linux-2.6.38.2/kernel/posix-timers.c linux-2.6.38.2/kernel/posix-timers.c
---- linux-2.6.38.2/kernel/posix-timers.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/posix-timers.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/posix-timers.c linux-2.6.38.7/kernel/posix-timers.c
+--- linux-2.6.38.7/kernel/posix-timers.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/posix-timers.c	2011-05-16 21:47:09.000000000 -0400
 @@ -42,6 +42,7 @@
  #include <linux/compiler.h>
  #include <linux/idr.h>
@@ -50990,7 +60381,16 @@ diff -urNp linux-2.6.38.2/kernel/posix-timers.c linux-2.6.38.2/kernel/posix-time
  #include <linux/syscalls.h>
  #include <linux/wait.h>
  #include <linux/workqueue.h>
-@@ -955,6 +956,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
+@@ -302,6 +303,8 @@ static __init int init_posix_timers(void
+ 		.nsleep = no_nsleep,
+ 	};
+ 
++	pax_track_stack();
++
+ 	register_posix_clock(CLOCK_REALTIME, &clock_realtime);
+ 	register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
+ 	register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
+@@ -955,6 +958,13 @@ SYSCALL_DEFINE2(clock_settime, const clo
  	if (copy_from_user(&new_tp, tp, sizeof (*tp)))
  		return -EFAULT;
  
@@ -51004,9 +60404,9 @@ diff -urNp linux-2.6.38.2/kernel/posix-timers.c linux-2.6.38.2/kernel/posix-time
  	return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
  }
  
-diff -urNp linux-2.6.38.2/kernel/power/poweroff.c linux-2.6.38.2/kernel/power/poweroff.c
---- linux-2.6.38.2/kernel/power/poweroff.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/power/poweroff.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/power/poweroff.c linux-2.6.38.7/kernel/power/poweroff.c
+--- linux-2.6.38.7/kernel/power/poweroff.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/power/poweroff.c	2011-04-28 19:34:15.000000000 -0400
 @@ -37,7 +37,7 @@ static struct sysrq_key_op	sysrq_powerof
  	.enable_mask	= SYSRQ_ENABLE_BOOT,
  };
@@ -51016,9 +60416,9 @@ diff -urNp linux-2.6.38.2/kernel/power/poweroff.c linux-2.6.38.2/kernel/power/po
  {
  	register_sysrq_key('o', &sysrq_poweroff_op);
  	return 0;
-diff -urNp linux-2.6.38.2/kernel/power/process.c linux-2.6.38.2/kernel/power/process.c
---- linux-2.6.38.2/kernel/power/process.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/power/process.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/power/process.c linux-2.6.38.7/kernel/power/process.c
+--- linux-2.6.38.7/kernel/power/process.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/power/process.c	2011-04-28 19:34:15.000000000 -0400
 @@ -41,6 +41,7 @@ static int try_to_freeze_tasks(bool sig_
  	u64 elapsed_csecs64;
  	unsigned int elapsed_csecs;
@@ -51061,9 +60461,9 @@ diff -urNp linux-2.6.38.2/kernel/power/process.c linux-2.6.38.2/kernel/power/pro
  			break;
  
  		if (pm_wakeup_pending()) {
-diff -urNp linux-2.6.38.2/kernel/printk.c linux-2.6.38.2/kernel/printk.c
---- linux-2.6.38.2/kernel/printk.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/printk.c	2011-03-23 22:30:08.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/printk.c linux-2.6.38.7/kernel/printk.c
+--- linux-2.6.38.7/kernel/printk.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/printk.c	2011-04-28 19:34:15.000000000 -0400
 @@ -279,12 +279,17 @@ static int check_syslog_permissions(int 
  	if (from_file && type != SYSLOG_ACTION_OPEN)
  		return 0;
@@ -51083,10 +60483,70 @@ diff -urNp linux-2.6.38.2/kernel/printk.c linux-2.6.38.2/kernel/printk.c
  				 "but no CAP_SYSLOG (deprecated).\n");
  			return 0;
  		}
-diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
---- linux-2.6.38.2/kernel/ptrace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/ptrace.c	2011-03-26 11:42:34.000000000 -0400
-@@ -116,7 +116,8 @@ int ptrace_check_attach(struct task_stru
+diff -urNp linux-2.6.38.7/kernel/profile.c linux-2.6.38.7/kernel/profile.c
+--- linux-2.6.38.7/kernel/profile.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/profile.c	2011-04-28 19:57:25.000000000 -0400
+@@ -39,7 +39,7 @@ struct profile_hit {
+ /* Oprofile timer tick hook */
+ static int (*timer_hook)(struct pt_regs *) __read_mostly;
+ 
+-static atomic_t *prof_buffer;
++static atomic_unchecked_t *prof_buffer;
+ static unsigned long prof_len, prof_shift;
+ 
+ int prof_on __read_mostly;
+@@ -283,7 +283,7 @@ static void profile_flip_buffers(void)
+ 					hits[i].pc = 0;
+ 				continue;
+ 			}
+-			atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
++			atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
+ 			hits[i].hits = hits[i].pc = 0;
+ 		}
+ 	}
+@@ -346,9 +346,9 @@ void profile_hits(int type, void *__pc, 
+ 	 * Add the current hit(s) and flush the write-queue out
+ 	 * to the global buffer:
+ 	 */
+-	atomic_add(nr_hits, &prof_buffer[pc]);
++	atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
+ 	for (i = 0; i < NR_PROFILE_HIT; ++i) {
+-		atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
++		atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
+ 		hits[i].pc = hits[i].hits = 0;
+ 	}
+ out:
+@@ -426,7 +426,7 @@ void profile_hits(int type, void *__pc, 
+ 	if (prof_on != type || !prof_buffer)
+ 		return;
+ 	pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
+-	atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
++	atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
+ }
+ #endif /* !CONFIG_SMP */
+ EXPORT_SYMBOL_GPL(profile_hits);
+@@ -517,7 +517,7 @@ read_profile(struct file *file, char __u
+ 			return -EFAULT;
+ 		buf++; p++; count--; read++;
+ 	}
+-	pnt = (char *)prof_buffer + p - sizeof(atomic_t);
++	pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
+ 	if (copy_to_user(buf, (void *)pnt, count))
+ 		return -EFAULT;
+ 	read += count;
+@@ -548,7 +548,7 @@ static ssize_t write_profile(struct file
+ 	}
+ #endif
+ 	profile_discard_flip_buffers();
+-	memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
++	memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
+ 	return count;
+ }
+ 
+diff -urNp linux-2.6.38.7/kernel/ptrace.c linux-2.6.38.7/kernel/ptrace.c
+--- linux-2.6.38.7/kernel/ptrace.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/kernel/ptrace.c	2011-05-22 23:06:04.000000000 -0400
+@@ -117,7 +117,8 @@ int ptrace_check_attach(struct task_stru
  	return ret;
  }
  
@@ -51096,7 +60556,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  {
  	const struct cred *cred = current_cred(), *tcred;
  
-@@ -140,7 +141,9 @@ int __ptrace_may_access(struct task_stru
+@@ -141,7 +142,9 @@ int __ptrace_may_access(struct task_stru
  	     cred->gid != tcred->egid ||
  	     cred->gid != tcred->sgid ||
  	     cred->gid != tcred->gid) &&
@@ -51107,7 +60567,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  		rcu_read_unlock();
  		return -EPERM;
  	}
-@@ -148,7 +151,9 @@ int __ptrace_may_access(struct task_stru
+@@ -149,7 +152,9 @@ int __ptrace_may_access(struct task_stru
  	smp_rmb();
  	if (task->mm)
  		dumpable = get_dumpable(task->mm);
@@ -51118,7 +60578,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  		return -EPERM;
  
  	return security_ptrace_access_check(task, mode);
-@@ -158,7 +163,16 @@ bool ptrace_may_access(struct task_struc
+@@ -159,7 +164,16 @@ bool ptrace_may_access(struct task_struc
  {
  	int err;
  	task_lock(task);
@@ -51136,7 +60596,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  	task_unlock(task);
  	return !err;
  }
-@@ -185,7 +199,7 @@ static int ptrace_attach(struct task_str
+@@ -186,7 +200,7 @@ static int ptrace_attach(struct task_str
  		goto out;
  
  	task_lock(task);
@@ -51145,7 +60605,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  	task_unlock(task);
  	if (retval)
  		goto unlock_creds;
-@@ -198,7 +212,7 @@ static int ptrace_attach(struct task_str
+@@ -199,7 +213,7 @@ static int ptrace_attach(struct task_str
  		goto unlock_tasklist;
  
  	task->ptrace = PT_PTRACED;
@@ -51154,7 +60614,16 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  		task->ptrace |= PT_PTRACE_CAP;
  
  	__ptrace_link(task, current);
-@@ -369,7 +383,7 @@ int ptrace_readdata(struct task_struct *
+@@ -359,6 +373,8 @@ int ptrace_readdata(struct task_struct *
+ {
+ 	int copied = 0;
+ 
++	pax_track_stack();
++
+ 	while (len > 0) {
+ 		char buf[128];
+ 		int this_len, retval;
+@@ -370,7 +386,7 @@ int ptrace_readdata(struct task_struct *
  				break;
  			return -EIO;
  		}
@@ -51163,7 +60632,16 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  			return -EFAULT;
  		copied += retval;
  		src += retval;
-@@ -565,7 +579,7 @@ int ptrace_request(struct task_struct *c
+@@ -384,6 +400,8 @@ int ptrace_writedata(struct task_struct 
+ {
+ 	int copied = 0;
+ 
++	pax_track_stack();
++
+ 	while (len > 0) {
+ 		char buf[128];
+ 		int this_len, retval;
+@@ -566,9 +584,11 @@ int ptrace_request(struct task_struct *c
  {
  	int ret = -EIO;
  	siginfo_t siginfo;
@@ -51171,8 +60649,12 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
 +	void __user *datavp = (__force void __user *) data;
  	unsigned long __user *datalp = datavp;
  
++	pax_track_stack();
++
  	switch (request) {
-@@ -713,14 +727,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
+ 	case PTRACE_PEEKTEXT:
+ 	case PTRACE_PEEKDATA:
+@@ -714,14 +734,21 @@ SYSCALL_DEFINE4(ptrace, long, request, l
  		goto out;
  	}
  
@@ -51195,7 +60677,7 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  		goto out_put_task_struct;
  	}
  
-@@ -745,7 +766,7 @@ int generic_ptrace_peekdata(struct task_
+@@ -746,7 +773,7 @@ int generic_ptrace_peekdata(struct task_
  	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
  	if (copied != sizeof(tmp))
  		return -EIO;
@@ -51204,7 +60686,16 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  }
  
  int generic_ptrace_pokedata(struct task_struct *tsk, unsigned long addr,
-@@ -855,14 +876,21 @@ asmlinkage long compat_sys_ptrace(compat
+@@ -769,6 +796,8 @@ int compat_ptrace_request(struct task_st
+ 	siginfo_t siginfo;
+ 	int ret;
+ 
++	pax_track_stack();
++
+ 	switch (request) {
+ 	case PTRACE_PEEKTEXT:
+ 	case PTRACE_PEEKDATA:
+@@ -856,14 +885,21 @@ asmlinkage long compat_sys_ptrace(compat
  		goto out;
  	}
  
@@ -51227,9 +60718,176 @@ diff -urNp linux-2.6.38.2/kernel/ptrace.c linux-2.6.38.2/kernel/ptrace.c
  		goto out_put_task_struct;
  	}
  
-diff -urNp linux-2.6.38.2/kernel/rcutree.c linux-2.6.38.2/kernel/rcutree.c
---- linux-2.6.38.2/kernel/rcutree.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/rcutree.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/rcutorture.c linux-2.6.38.7/kernel/rcutorture.c
+--- linux-2.6.38.7/kernel/rcutorture.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/rcutorture.c	2011-04-28 19:57:25.000000000 -0400
+@@ -139,12 +139,12 @@ static DEFINE_PER_CPU(long [RCU_TORTURE_
+ 	{ 0 };
+ static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
+ 	{ 0 };
+-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
+-static atomic_t n_rcu_torture_alloc;
+-static atomic_t n_rcu_torture_alloc_fail;
+-static atomic_t n_rcu_torture_free;
+-static atomic_t n_rcu_torture_mberror;
+-static atomic_t n_rcu_torture_error;
++static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
++static atomic_unchecked_t n_rcu_torture_alloc;
++static atomic_unchecked_t n_rcu_torture_alloc_fail;
++static atomic_unchecked_t n_rcu_torture_free;
++static atomic_unchecked_t n_rcu_torture_mberror;
++static atomic_unchecked_t n_rcu_torture_error;
+ static long n_rcu_torture_boost_ktrerror;
+ static long n_rcu_torture_boost_rterror;
+ static long n_rcu_torture_boost_allocerror;
+@@ -226,11 +226,11 @@ rcu_torture_alloc(void)
+ 
+ 	spin_lock_bh(&rcu_torture_lock);
+ 	if (list_empty(&rcu_torture_freelist)) {
+-		atomic_inc(&n_rcu_torture_alloc_fail);
++		atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
+ 		spin_unlock_bh(&rcu_torture_lock);
+ 		return NULL;
+ 	}
+-	atomic_inc(&n_rcu_torture_alloc);
++	atomic_inc_unchecked(&n_rcu_torture_alloc);
+ 	p = rcu_torture_freelist.next;
+ 	list_del_init(p);
+ 	spin_unlock_bh(&rcu_torture_lock);
+@@ -243,7 +243,7 @@ rcu_torture_alloc(void)
+ static void
+ rcu_torture_free(struct rcu_torture *p)
+ {
+-	atomic_inc(&n_rcu_torture_free);
++	atomic_inc_unchecked(&n_rcu_torture_free);
+ 	spin_lock_bh(&rcu_torture_lock);
+ 	list_add_tail(&p->rtort_free, &rcu_torture_freelist);
+ 	spin_unlock_bh(&rcu_torture_lock);
+@@ -363,7 +363,7 @@ rcu_torture_cb(struct rcu_head *p)
+ 	i = rp->rtort_pipe_count;
+ 	if (i > RCU_TORTURE_PIPE_LEN)
+ 		i = RCU_TORTURE_PIPE_LEN;
+-	atomic_inc(&rcu_torture_wcount[i]);
++	atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ 	if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
+ 		rp->rtort_mbtest = 0;
+ 		rcu_torture_free(rp);
+@@ -410,7 +410,7 @@ static void rcu_sync_torture_deferred_fr
+ 		i = rp->rtort_pipe_count;
+ 		if (i > RCU_TORTURE_PIPE_LEN)
+ 			i = RCU_TORTURE_PIPE_LEN;
+-		atomic_inc(&rcu_torture_wcount[i]);
++		atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ 		if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
+ 			rp->rtort_mbtest = 0;
+ 			list_del(&rp->rtort_free);
+@@ -883,7 +883,7 @@ rcu_torture_writer(void *arg)
+ 			i = old_rp->rtort_pipe_count;
+ 			if (i > RCU_TORTURE_PIPE_LEN)
+ 				i = RCU_TORTURE_PIPE_LEN;
+-			atomic_inc(&rcu_torture_wcount[i]);
++			atomic_inc_unchecked(&rcu_torture_wcount[i]);
+ 			old_rp->rtort_pipe_count++;
+ 			cur_ops->deferred_free(old_rp);
+ 		}
+@@ -952,7 +952,7 @@ static void rcu_torture_timer(unsigned l
+ 		return;
+ 	}
+ 	if (p->rtort_mbtest == 0)
+-		atomic_inc(&n_rcu_torture_mberror);
++		atomic_inc_unchecked(&n_rcu_torture_mberror);
+ 	spin_lock(&rand_lock);
+ 	cur_ops->read_delay(&rand);
+ 	n_rcu_torture_timers++;
+@@ -1014,7 +1014,7 @@ rcu_torture_reader(void *arg)
+ 			continue;
+ 		}
+ 		if (p->rtort_mbtest == 0)
+-			atomic_inc(&n_rcu_torture_mberror);
++			atomic_inc_unchecked(&n_rcu_torture_mberror);
+ 		cur_ops->read_delay(&rand);
+ 		preempt_disable();
+ 		pipe_count = p->rtort_pipe_count;
+@@ -1073,10 +1073,10 @@ rcu_torture_printk(char *page)
+ 		       rcu_torture_current,
+ 		       rcu_torture_current_version,
+ 		       list_empty(&rcu_torture_freelist),
+-		       atomic_read(&n_rcu_torture_alloc),
+-		       atomic_read(&n_rcu_torture_alloc_fail),
+-		       atomic_read(&n_rcu_torture_free),
+-		       atomic_read(&n_rcu_torture_mberror),
++		       atomic_read_unchecked(&n_rcu_torture_alloc),
++		       atomic_read_unchecked(&n_rcu_torture_alloc_fail),
++		       atomic_read_unchecked(&n_rcu_torture_free),
++		       atomic_read_unchecked(&n_rcu_torture_mberror),
+ 		       n_rcu_torture_boost_ktrerror,
+ 		       n_rcu_torture_boost_rterror,
+ 		       n_rcu_torture_boost_allocerror,
+@@ -1084,7 +1084,7 @@ rcu_torture_printk(char *page)
+ 		       n_rcu_torture_boost_failure,
+ 		       n_rcu_torture_boosts,
+ 		       n_rcu_torture_timers);
+-	if (atomic_read(&n_rcu_torture_mberror) != 0 ||
++	if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0 ||
+ 	    n_rcu_torture_boost_ktrerror != 0 ||
+ 	    n_rcu_torture_boost_rterror != 0 ||
+ 	    n_rcu_torture_boost_allocerror != 0 ||
+@@ -1094,7 +1094,7 @@ rcu_torture_printk(char *page)
+ 	cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
+ 	if (i > 1) {
+ 		cnt += sprintf(&page[cnt], "!!! ");
+-		atomic_inc(&n_rcu_torture_error);
++		atomic_inc_unchecked(&n_rcu_torture_error);
+ 		WARN_ON_ONCE(1);
+ 	}
+ 	cnt += sprintf(&page[cnt], "Reader Pipe: ");
+@@ -1108,7 +1108,7 @@ rcu_torture_printk(char *page)
+ 	cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
+ 	for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
+ 		cnt += sprintf(&page[cnt], " %d",
+-			       atomic_read(&rcu_torture_wcount[i]));
++			       atomic_read_unchecked(&rcu_torture_wcount[i]));
+ 	}
+ 	cnt += sprintf(&page[cnt], "\n");
+ 	if (cur_ops->stats)
+@@ -1416,7 +1416,7 @@ rcu_torture_cleanup(void)
+ 
+ 	if (cur_ops->cleanup)
+ 		cur_ops->cleanup();
+-	if (atomic_read(&n_rcu_torture_error))
++	if (atomic_read_unchecked(&n_rcu_torture_error))
+ 		rcu_torture_print_module_parms(cur_ops, "End of test: FAILURE");
+ 	else
+ 		rcu_torture_print_module_parms(cur_ops, "End of test: SUCCESS");
+@@ -1480,11 +1480,11 @@ rcu_torture_init(void)
+ 
+ 	rcu_torture_current = NULL;
+ 	rcu_torture_current_version = 0;
+-	atomic_set(&n_rcu_torture_alloc, 0);
+-	atomic_set(&n_rcu_torture_alloc_fail, 0);
+-	atomic_set(&n_rcu_torture_free, 0);
+-	atomic_set(&n_rcu_torture_mberror, 0);
+-	atomic_set(&n_rcu_torture_error, 0);
++	atomic_set_unchecked(&n_rcu_torture_alloc, 0);
++	atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
++	atomic_set_unchecked(&n_rcu_torture_free, 0);
++	atomic_set_unchecked(&n_rcu_torture_mberror, 0);
++	atomic_set_unchecked(&n_rcu_torture_error, 0);
+ 	n_rcu_torture_boost_ktrerror = 0;
+ 	n_rcu_torture_boost_rterror = 0;
+ 	n_rcu_torture_boost_allocerror = 0;
+@@ -1492,7 +1492,7 @@ rcu_torture_init(void)
+ 	n_rcu_torture_boost_failure = 0;
+ 	n_rcu_torture_boosts = 0;
+ 	for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
+-		atomic_set(&rcu_torture_wcount[i], 0);
++		atomic_set_unchecked(&rcu_torture_wcount[i], 0);
+ 	for_each_possible_cpu(cpu) {
+ 		for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
+ 			per_cpu(rcu_torture_count, cpu)[i] = 0;
+diff -urNp linux-2.6.38.7/kernel/rcutree.c linux-2.6.38.7/kernel/rcutree.c
+--- linux-2.6.38.7/kernel/rcutree.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/rcutree.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1389,7 +1389,7 @@ __rcu_process_callbacks(struct rcu_state
  /*
   * Do softirq processing for the current CPU.
@@ -51239,9 +60897,9 @@ diff -urNp linux-2.6.38.2/kernel/rcutree.c linux-2.6.38.2/kernel/rcutree.c
  {
  	/*
  	 * Memory references from any prior RCU read-side critical sections
-diff -urNp linux-2.6.38.2/kernel/rcutree_plugin.h linux-2.6.38.2/kernel/rcutree_plugin.h
---- linux-2.6.38.2/kernel/rcutree_plugin.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/rcutree_plugin.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/rcutree_plugin.h linux-2.6.38.7/kernel/rcutree_plugin.h
+--- linux-2.6.38.7/kernel/rcutree_plugin.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/rcutree_plugin.h	2011-04-28 19:57:25.000000000 -0400
 @@ -730,7 +730,7 @@ void synchronize_rcu_expedited(void)
  
  	/* Clean up and exit. */
@@ -51251,9 +60909,74 @@ diff -urNp linux-2.6.38.2/kernel/rcutree_plugin.h linux-2.6.38.2/kernel/rcutree_
  unlock_mb_ret:
  	mutex_unlock(&sync_rcu_preempt_exp_mutex);
  mb_ret:
-diff -urNp linux-2.6.38.2/kernel/resource.c linux-2.6.38.2/kernel/resource.c
---- linux-2.6.38.2/kernel/resource.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/resource.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1025,8 +1025,8 @@ EXPORT_SYMBOL_GPL(synchronize_sched_expe
+ 
+ #else /* #ifndef CONFIG_SMP */
+ 
+-static atomic_t sync_sched_expedited_started = ATOMIC_INIT(0);
+-static atomic_t sync_sched_expedited_done = ATOMIC_INIT(0);
++static atomic_unchecked_t sync_sched_expedited_started = ATOMIC_INIT(0);
++static atomic_unchecked_t sync_sched_expedited_done = ATOMIC_INIT(0);
+ 
+ static int synchronize_sched_expedited_cpu_stop(void *data)
+ {
+@@ -1081,7 +1081,7 @@ void synchronize_sched_expedited(void)
+ 	int firstsnap, s, snap, trycount = 0;
+ 
+ 	/* Note that atomic_inc_return() implies full memory barrier. */
+-	firstsnap = snap = atomic_inc_return(&sync_sched_expedited_started);
++	firstsnap = snap = atomic_inc_return_unchecked(&sync_sched_expedited_started);
+ 	get_online_cpus();
+ 
+ 	/*
+@@ -1102,7 +1102,7 @@ void synchronize_sched_expedited(void)
+ 		}
+ 
+ 		/* Check to see if someone else did our work for us. */
+-		s = atomic_read(&sync_sched_expedited_done);
++		s = atomic_read_unchecked(&sync_sched_expedited_done);
+ 		if (UINT_CMP_GE((unsigned)s, (unsigned)firstsnap)) {
+ 			smp_mb(); /* ensure test happens before caller kfree */
+ 			return;
+@@ -1117,7 +1117,7 @@ void synchronize_sched_expedited(void)
+ 		 * grace period works for us.
+ 		 */
+ 		get_online_cpus();
+-		snap = atomic_read(&sync_sched_expedited_started) - 1;
++		snap = atomic_read_unchecked(&sync_sched_expedited_started) - 1;
+ 		smp_mb(); /* ensure read is before try_stop_cpus(). */
+ 	}
+ 
+@@ -1128,12 +1128,12 @@ void synchronize_sched_expedited(void)
+ 	 * than we did beat us to the punch.
+ 	 */
+ 	do {
+-		s = atomic_read(&sync_sched_expedited_done);
++		s = atomic_read_unchecked(&sync_sched_expedited_done);
+ 		if (UINT_CMP_GE((unsigned)s, (unsigned)snap)) {
+ 			smp_mb(); /* ensure test happens before caller kfree */
+ 			break;
+ 		}
+-	} while (atomic_cmpxchg(&sync_sched_expedited_done, s, snap) != s);
++	} while (atomic_cmpxchg_unchecked(&sync_sched_expedited_done, s, snap) != s);
+ 
+ 	put_online_cpus();
+ }
+diff -urNp linux-2.6.38.7/kernel/relay.c linux-2.6.38.7/kernel/relay.c
+--- linux-2.6.38.7/kernel/relay.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/relay.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1236,6 +1236,8 @@ static ssize_t subbuf_splice_actor(struc
+ 	};
+ 	ssize_t ret;
+ 
++	pax_track_stack();
++
+ 	if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
+ 		return 0;
+ 	if (splice_grow_spd(pipe, &spd))
+diff -urNp linux-2.6.38.7/kernel/resource.c linux-2.6.38.7/kernel/resource.c
+--- linux-2.6.38.7/kernel/resource.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/resource.c	2011-04-28 19:34:15.000000000 -0400
 @@ -133,8 +133,18 @@ static const struct file_operations proc
  
  static int __init ioresources_init(void)
@@ -51273,9 +60996,9 @@ diff -urNp linux-2.6.38.2/kernel/resource.c linux-2.6.38.2/kernel/resource.c
  	return 0;
  }
  __initcall(ioresources_init);
-diff -urNp linux-2.6.38.2/kernel/rtmutex.c linux-2.6.38.2/kernel/rtmutex.c
---- linux-2.6.38.2/kernel/rtmutex.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/rtmutex.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/rtmutex.c linux-2.6.38.7/kernel/rtmutex.c
+--- linux-2.6.38.7/kernel/rtmutex.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/rtmutex.c	2011-04-28 19:34:15.000000000 -0400
 @@ -511,7 +511,7 @@ static void wakeup_next_waiter(struct rt
  	 */
  	raw_spin_lock_irqsave(&pendowner->pi_lock, flags);
@@ -51285,10 +61008,164 @@ diff -urNp linux-2.6.38.2/kernel/rtmutex.c linux-2.6.38.2/kernel/rtmutex.c
  	WARN_ON(pendowner->pi_blocked_on != waiter);
  	WARN_ON(pendowner->pi_blocked_on->lock != lock);
  
-diff -urNp linux-2.6.38.2/kernel/sched.c linux-2.6.38.2/kernel/sched.c
---- linux-2.6.38.2/kernel/sched.c	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/kernel/sched.c	2011-03-23 17:21:51.000000000 -0400
-@@ -4638,6 +4638,8 @@ int can_nice(const struct task_struct *p
+diff -urNp linux-2.6.38.7/kernel/rtmutex-tester.c linux-2.6.38.7/kernel/rtmutex-tester.c
+--- linux-2.6.38.7/kernel/rtmutex-tester.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/rtmutex-tester.c	2011-04-28 19:57:25.000000000 -0400
+@@ -21,7 +21,7 @@
+ #define MAX_RT_TEST_MUTEXES	8
+ 
+ static spinlock_t rttest_lock;
+-static atomic_t rttest_event;
++static atomic_unchecked_t rttest_event;
+ 
+ struct test_thread_data {
+ 	int			opcode;
+@@ -64,7 +64,7 @@ static int handle_op(struct test_thread_
+ 
+ 	case RTTEST_LOCKCONT:
+ 		td->mutexes[td->opdata] = 1;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		return 0;
+ 
+ 	case RTTEST_RESET:
+@@ -84,7 +84,7 @@ static int handle_op(struct test_thread_
+ 		return 0;
+ 
+ 	case RTTEST_RESETEVENT:
+-		atomic_set(&rttest_event, 0);
++		atomic_set_unchecked(&rttest_event, 0);
+ 		return 0;
+ 
+ 	default:
+@@ -101,9 +101,9 @@ static int handle_op(struct test_thread_
+ 			return ret;
+ 
+ 		td->mutexes[id] = 1;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		rt_mutex_lock(&mutexes[id]);
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		td->mutexes[id] = 4;
+ 		return 0;
+ 
+@@ -114,9 +114,9 @@ static int handle_op(struct test_thread_
+ 			return ret;
+ 
+ 		td->mutexes[id] = 1;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		td->mutexes[id] = ret ? 0 : 4;
+ 		return ret ? -EINTR : 0;
+ 
+@@ -125,9 +125,9 @@ static int handle_op(struct test_thread_
+ 		if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
+ 			return ret;
+ 
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		rt_mutex_unlock(&mutexes[id]);
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		td->mutexes[id] = 0;
+ 		return 0;
+ 
+@@ -193,7 +193,7 @@ void schedule_rt_mutex_test(struct rt_mu
+ 			break;
+ 
+ 		td->mutexes[dat] = 2;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		break;
+ 
+ 	case RTTEST_LOCKBKL:
+@@ -214,7 +214,7 @@ void schedule_rt_mutex_test(struct rt_mu
+ 			return;
+ 
+ 		td->mutexes[dat] = 3;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		break;
+ 
+ 	case RTTEST_LOCKNOWAIT:
+@@ -226,7 +226,7 @@ void schedule_rt_mutex_test(struct rt_mu
+ 			return;
+ 
+ 		td->mutexes[dat] = 1;
+-		td->event = atomic_add_return(1, &rttest_event);
++		td->event = atomic_add_return_unchecked(1, &rttest_event);
+ 		return;
+ 
+ 	case RTTEST_LOCKBKL:
+diff -urNp linux-2.6.38.7/kernel/sched_autogroup.c linux-2.6.38.7/kernel/sched_autogroup.c
+--- linux-2.6.38.7/kernel/sched_autogroup.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/sched_autogroup.c	2011-04-28 19:57:25.000000000 -0400
+@@ -7,7 +7,7 @@
+ 
+ unsigned int __read_mostly sysctl_sched_autogroup_enabled = 1;
+ static struct autogroup autogroup_default;
+-static atomic_t autogroup_seq_nr;
++static atomic_unchecked_t autogroup_seq_nr;
+ 
+ static void __init autogroup_init(struct task_struct *init_task)
+ {
+@@ -79,7 +79,7 @@ static inline struct autogroup *autogrou
+ 
+ 	kref_init(&ag->kref);
+ 	init_rwsem(&ag->lock);
+-	ag->id = atomic_inc_return(&autogroup_seq_nr);
++	ag->id = atomic_inc_return_unchecked(&autogroup_seq_nr);
+ 	ag->tg = tg;
+ #ifdef CONFIG_RT_GROUP_SCHED
+ 	/*
+diff -urNp linux-2.6.38.7/kernel/sched.c linux-2.6.38.7/kernel/sched.c
+--- linux-2.6.38.7/kernel/sched.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/kernel/sched.c	2011-05-22 23:03:34.000000000 -0400
+@@ -3938,6 +3938,8 @@ asmlinkage void __sched schedule(void)
+ 	struct rq *rq;
+ 	int cpu;
+ 
++	pax_track_stack();
++
+ need_resched:
+ 	preempt_disable();
+ 	cpu = smp_processor_id();
+@@ -4024,7 +4026,7 @@ EXPORT_SYMBOL(schedule);
+  * Look out! "owner" is an entirely speculative pointer
+  * access and not reliable.
+  */
+-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
++int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
+ {
+ 	unsigned int cpu;
+ 	struct rq *rq;
+@@ -4038,10 +4040,10 @@ int mutex_spin_on_owner(struct mutex *lo
+ 	 * DEBUG_PAGEALLOC could have unmapped it if
+ 	 * the mutex owner just released it and exited.
+ 	 */
+-	if (probe_kernel_address(&owner->cpu, cpu))
++	if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
+ 		return 0;
+ #else
+-	cpu = owner->cpu;
++	cpu = task_thread_info(owner)->cpu;
+ #endif
+ 
+ 	/*
+@@ -4078,7 +4080,7 @@ int mutex_spin_on_owner(struct mutex *lo
+ 		/*
+ 		 * Is that owner really running on that cpu?
+ 		 */
+-		if (task_thread_info(rq->curr) != owner || need_resched())
++		if (rq->curr != owner || need_resched())
+ 			return 0;
+ 
+ 		arch_mutex_cpu_relax();
+@@ -4638,6 +4640,8 @@ int can_nice(const struct task_struct *p
  	/* convert nice value [19,-20] to rlimit style value [1,40] */
  	int nice_rlim = 20 - nice;
  
@@ -51297,7 +61174,7 @@ diff -urNp linux-2.6.38.2/kernel/sched.c linux-2.6.38.2/kernel/sched.c
  	return (nice_rlim <= task_rlimit(p, RLIMIT_NICE) ||
  		capable(CAP_SYS_NICE));
  }
-@@ -4671,7 +4673,8 @@ SYSCALL_DEFINE1(nice, int, increment)
+@@ -4671,7 +4675,8 @@ SYSCALL_DEFINE1(nice, int, increment)
  	if (nice > 19)
  		nice = 19;
  
@@ -51307,7 +61184,7 @@ diff -urNp linux-2.6.38.2/kernel/sched.c linux-2.6.38.2/kernel/sched.c
  		return -EPERM;
  
  	retval = security_task_setnice(current, nice);
-@@ -4814,6 +4817,7 @@ recheck:
+@@ -4814,6 +4819,7 @@ recheck:
  			unsigned long rlim_rtprio =
  					task_rlimit(p, RLIMIT_RTPRIO);
  
@@ -51315,7 +61192,7 @@ diff -urNp linux-2.6.38.2/kernel/sched.c linux-2.6.38.2/kernel/sched.c
  			/* can't set/change the rt policy */
  			if (policy != p->policy && !rlim_rtprio)
  				return -EPERM;
-@@ -6942,7 +6946,7 @@ static void init_sched_groups_power(int 
+@@ -6942,7 +6948,7 @@ static void init_sched_groups_power(int 
  	long power;
  	int weight;
  
@@ -51324,10 +61201,10 @@ diff -urNp linux-2.6.38.2/kernel/sched.c linux-2.6.38.2/kernel/sched.c
  
  	if (cpu != group_first_cpu(sd->groups))
  		return;
-diff -urNp linux-2.6.38.2/kernel/sched_fair.c linux-2.6.38.2/kernel/sched_fair.c
---- linux-2.6.38.2/kernel/sched_fair.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/sched_fair.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3960,7 +3960,7 @@ static void nohz_idle_balance(int this_c
+diff -urNp linux-2.6.38.7/kernel/sched_fair.c linux-2.6.38.7/kernel/sched_fair.c
+--- linux-2.6.38.7/kernel/sched_fair.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/kernel/sched_fair.c	2011-04-28 19:34:15.000000000 -0400
+@@ -3957,7 +3957,7 @@ static void nohz_idle_balance(int this_c
   * run_rebalance_domains is triggered when needed from the scheduler tick.
   * Also triggered for nohz idle balancing (with nohz_balancing_kick set).
   */
@@ -51336,9 +61213,9 @@ diff -urNp linux-2.6.38.2/kernel/sched_fair.c linux-2.6.38.2/kernel/sched_fair.c
  {
  	int this_cpu = smp_processor_id();
  	struct rq *this_rq = cpu_rq(this_cpu);
-diff -urNp linux-2.6.38.2/kernel/signal.c linux-2.6.38.2/kernel/signal.c
---- linux-2.6.38.2/kernel/signal.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/kernel/signal.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/signal.c linux-2.6.38.7/kernel/signal.c
+--- linux-2.6.38.7/kernel/signal.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/kernel/signal.c	2011-05-22 23:03:34.000000000 -0400
 @@ -45,12 +45,12 @@ static struct kmem_cache *sigqueue_cache
  
  int print_fatal_signals __read_mostly;
@@ -51441,9 +61318,18 @@ diff -urNp linux-2.6.38.2/kernel/signal.c linux-2.6.38.2/kernel/signal.c
  
  	return ret;
  }
-diff -urNp linux-2.6.38.2/kernel/smp.c linux-2.6.38.2/kernel/smp.c
---- linux-2.6.38.2/kernel/smp.c	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/kernel/smp.c	2011-03-26 20:50:44.000000000 -0400
+@@ -1704,6 +1723,8 @@ void ptrace_notify(int exit_code)
+ {
+ 	siginfo_t info;
+ 
++	pax_track_stack();
++
+ 	BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
+ 
+ 	memset(&info, 0, sizeof info);
+diff -urNp linux-2.6.38.7/kernel/smp.c linux-2.6.38.7/kernel/smp.c
+--- linux-2.6.38.7/kernel/smp.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/kernel/smp.c	2011-04-28 19:34:15.000000000 -0400
 @@ -583,22 +583,22 @@ int smp_call_function(smp_call_func_t fu
  }
  EXPORT_SYMBOL(smp_call_function);
@@ -51471,9 +61357,9 @@ diff -urNp linux-2.6.38.2/kernel/smp.c linux-2.6.38.2/kernel/smp.c
  {
  	raw_spin_unlock_irq(&call_function.lock);
  }
-diff -urNp linux-2.6.38.2/kernel/softirq.c linux-2.6.38.2/kernel/softirq.c
---- linux-2.6.38.2/kernel/softirq.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/softirq.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/softirq.c linux-2.6.38.7/kernel/softirq.c
+--- linux-2.6.38.7/kernel/softirq.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/softirq.c	2011-04-28 19:34:15.000000000 -0400
 @@ -56,7 +56,7 @@ static struct softirq_action softirq_vec
  
  static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
@@ -51528,9 +61414,9 @@ diff -urNp linux-2.6.38.2/kernel/softirq.c linux-2.6.38.2/kernel/softirq.c
  {
  	struct tasklet_struct *list;
  
-diff -urNp linux-2.6.38.2/kernel/sys.c linux-2.6.38.2/kernel/sys.c
---- linux-2.6.38.2/kernel/sys.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/sys.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/sys.c linux-2.6.38.7/kernel/sys.c
+--- linux-2.6.38.7/kernel/sys.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/sys.c	2011-04-28 19:34:15.000000000 -0400
 @@ -136,6 +136,12 @@ static int set_one_prio(struct task_stru
  		error = -EACCES;
  		goto out;
@@ -51652,9 +61538,9 @@ diff -urNp linux-2.6.38.2/kernel/sys.c linux-2.6.38.2/kernel/sys.c
  				error = -EINVAL;
  				break;
  			}
-diff -urNp linux-2.6.38.2/kernel/sysctl.c linux-2.6.38.2/kernel/sysctl.c
---- linux-2.6.38.2/kernel/sysctl.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/kernel/sysctl.c	2011-03-28 17:49:17.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/sysctl.c linux-2.6.38.7/kernel/sysctl.c
+--- linux-2.6.38.7/kernel/sysctl.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/kernel/sysctl.c	2011-04-28 19:34:15.000000000 -0400
 @@ -84,6 +84,13 @@
  
  
@@ -51843,9 +61729,9 @@ diff -urNp linux-2.6.38.2/kernel/sysctl.c linux-2.6.38.2/kernel/sysctl.c
  EXPORT_SYMBOL(proc_doulongvec_minmax);
  EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
  EXPORT_SYMBOL(register_sysctl_table);
-diff -urNp linux-2.6.38.2/kernel/sysctl_check.c linux-2.6.38.2/kernel/sysctl_check.c
---- linux-2.6.38.2/kernel/sysctl_check.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/sysctl_check.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/sysctl_check.c linux-2.6.38.7/kernel/sysctl_check.c
+--- linux-2.6.38.7/kernel/sysctl_check.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/sysctl_check.c	2011-04-28 19:34:15.000000000 -0400
 @@ -131,6 +131,7 @@ int sysctl_check_table(struct nsproxy *n
  				set_fail(&fail, table, "Directory with extra2");
  		} else {
@@ -51854,9 +61740,9 @@ diff -urNp linux-2.6.38.2/kernel/sysctl_check.c linux-2.6.38.2/kernel/sysctl_che
  			    (table->proc_handler == proc_dointvec) ||
  			    (table->proc_handler == proc_dointvec_minmax) ||
  			    (table->proc_handler == proc_dointvec_jiffies) ||
-diff -urNp linux-2.6.38.2/kernel/taskstats.c linux-2.6.38.2/kernel/taskstats.c
---- linux-2.6.38.2/kernel/taskstats.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/taskstats.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/taskstats.c linux-2.6.38.7/kernel/taskstats.c
+--- linux-2.6.38.7/kernel/taskstats.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/taskstats.c	2011-04-28 19:34:15.000000000 -0400
 @@ -27,9 +27,12 @@
  #include <linux/cgroup.h>
  #include <linux/fs.h>
@@ -51880,9 +61766,9 @@ diff -urNp linux-2.6.38.2/kernel/taskstats.c linux-2.6.38.2/kernel/taskstats.c
  	if (info->attrs[TASKSTATS_CMD_ATTR_REGISTER_CPUMASK])
  		return cmd_attr_register_cpumask(info);
  	else if (info->attrs[TASKSTATS_CMD_ATTR_DEREGISTER_CPUMASK])
-diff -urNp linux-2.6.38.2/kernel/time/tick-broadcast.c linux-2.6.38.2/kernel/time/tick-broadcast.c
---- linux-2.6.38.2/kernel/time/tick-broadcast.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/time/tick-broadcast.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/time/tick-broadcast.c linux-2.6.38.7/kernel/time/tick-broadcast.c
+--- linux-2.6.38.7/kernel/time/tick-broadcast.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/kernel/time/tick-broadcast.c	2011-05-22 23:06:04.000000000 -0400
 @@ -116,7 +116,7 @@ int tick_device_uses_broadcast(struct cl
  		 * then clear the broadcast bit.
  		 */
@@ -51892,9 +61778,9 @@ diff -urNp linux-2.6.38.2/kernel/time/tick-broadcast.c linux-2.6.38.2/kernel/tim
  
  			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
  			tick_broadcast_clear_oneshot(cpu);
-diff -urNp linux-2.6.38.2/kernel/time/timekeeping.c linux-2.6.38.2/kernel/time/timekeeping.c
---- linux-2.6.38.2/kernel/time/timekeeping.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/time/timekeeping.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/time/timekeeping.c linux-2.6.38.7/kernel/time/timekeeping.c
+--- linux-2.6.38.7/kernel/time/timekeeping.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/time/timekeeping.c	2011-04-28 19:34:15.000000000 -0400
 @@ -14,6 +14,7 @@
  #include <linux/init.h>
  #include <linux/mm.h>
@@ -51912,9 +61798,9 @@ diff -urNp linux-2.6.38.2/kernel/time/timekeeping.c linux-2.6.38.2/kernel/time/t
  	write_seqlock_irqsave(&xtime_lock, flags);
  
  	timekeeping_forward_now();
-diff -urNp linux-2.6.38.2/kernel/time/timer_list.c linux-2.6.38.2/kernel/time/timer_list.c
---- linux-2.6.38.2/kernel/time/timer_list.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/time/timer_list.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/time/timer_list.c linux-2.6.38.7/kernel/time/timer_list.c
+--- linux-2.6.38.7/kernel/time/timer_list.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/time/timer_list.c	2011-04-28 19:34:15.000000000 -0400
 @@ -38,12 +38,16 @@ DECLARE_PER_CPU(struct hrtimer_cpu_base,
  
  static void print_name_offset(struct seq_file *m, void *sym)
@@ -51956,9 +61842,36 @@ diff -urNp linux-2.6.38.2/kernel/time/timer_list.c linux-2.6.38.2/kernel/time/ti
  	if (!pe)
  		return -ENOMEM;
  	return 0;
-diff -urNp linux-2.6.38.2/kernel/time/timer_stats.c linux-2.6.38.2/kernel/time/timer_stats.c
---- linux-2.6.38.2/kernel/time/timer_stats.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/time/timer_stats.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/time/timer_stats.c linux-2.6.38.7/kernel/time/timer_stats.c
+--- linux-2.6.38.7/kernel/time/timer_stats.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/time/timer_stats.c	2011-04-28 19:57:25.000000000 -0400
+@@ -116,7 +116,7 @@ static ktime_t time_start, time_stop;
+ static unsigned long nr_entries;
+ static struct entry entries[MAX_ENTRIES];
+ 
+-static atomic_t overflow_count;
++static atomic_unchecked_t overflow_count;
+ 
+ /*
+  * The entries are in a hash-table, for fast lookup:
+@@ -140,7 +140,7 @@ static void reset_entries(void)
+ 	nr_entries = 0;
+ 	memset(entries, 0, sizeof(entries));
+ 	memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
+-	atomic_set(&overflow_count, 0);
++	atomic_set_unchecked(&overflow_count, 0);
+ }
+ 
+ static struct entry *alloc_entry(void)
+@@ -261,7 +261,7 @@ void timer_stats_update_stats(void *time
+ 	if (likely(entry))
+ 		entry->count++;
+ 	else
+-		atomic_inc(&overflow_count);
++		atomic_inc_unchecked(&overflow_count);
+ 
+  out_unlock:
+ 	raw_spin_unlock_irqrestore(lock, flags);
 @@ -269,12 +269,16 @@ void timer_stats_update_stats(void *time
  
  static void print_name_offset(struct seq_file *m, unsigned long addr)
@@ -51976,6 +61889,18 @@ diff -urNp linux-2.6.38.2/kernel/time/timer_stats.c linux-2.6.38.2/kernel/time/t
  }
  
  static int tstats_show(struct seq_file *m, void *v)
+@@ -300,9 +304,9 @@ static int tstats_show(struct seq_file *
+ 
+ 	seq_puts(m, "Timer Stats Version: v0.2\n");
+ 	seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
+-	if (atomic_read(&overflow_count))
++	if (atomic_read_unchecked(&overflow_count))
+ 		seq_printf(m, "Overflow: %d entries\n",
+-			atomic_read(&overflow_count));
++			atomic_read_unchecked(&overflow_count));
+ 
+ 	for (i = 0; i < nr_entries; i++) {
+ 		entry = entries + i;
 @@ -417,7 +421,11 @@ static int __init init_tstats_procfs(voi
  {
  	struct proc_dir_entry *pe;
@@ -51988,9 +61913,9 @@ diff -urNp linux-2.6.38.2/kernel/time/timer_stats.c linux-2.6.38.2/kernel/time/t
  	if (!pe)
  		return -ENOMEM;
  	return 0;
-diff -urNp linux-2.6.38.2/kernel/time.c linux-2.6.38.2/kernel/time.c
---- linux-2.6.38.2/kernel/time.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/time.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/time.c linux-2.6.38.7/kernel/time.c
+--- linux-2.6.38.7/kernel/time.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/time.c	2011-04-28 19:34:15.000000000 -0400
 @@ -163,6 +163,11 @@ int do_sys_settimeofday(struct timespec 
  		return error;
  
@@ -52003,9 +61928,9 @@ diff -urNp linux-2.6.38.2/kernel/time.c linux-2.6.38.2/kernel/time.c
  		/* SMP safe, global irq locking makes it work. */
  		sys_tz = *tz;
  		update_vsyscall_tz();
-diff -urNp linux-2.6.38.2/kernel/timer.c linux-2.6.38.2/kernel/timer.c
---- linux-2.6.38.2/kernel/timer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/timer.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/timer.c linux-2.6.38.7/kernel/timer.c
+--- linux-2.6.38.7/kernel/timer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/timer.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1276,7 +1276,7 @@ void update_process_times(int user_tick)
  /*
   * This function runs timers and the timer-tq in bottom half context.
@@ -52015,9 +61940,39 @@ diff -urNp linux-2.6.38.2/kernel/timer.c linux-2.6.38.2/kernel/timer.c
  {
  	struct tvec_base *base = __this_cpu_read(tvec_bases);
  
-diff -urNp linux-2.6.38.2/kernel/trace/ftrace.c linux-2.6.38.2/kernel/trace/ftrace.c
---- linux-2.6.38.2/kernel/trace/ftrace.c	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/ftrace.c	2011-03-23 17:21:51.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/blktrace.c linux-2.6.38.7/kernel/trace/blktrace.c
+--- linux-2.6.38.7/kernel/trace/blktrace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/blktrace.c	2011-04-28 19:57:25.000000000 -0400
+@@ -321,7 +321,7 @@ static ssize_t blk_dropped_read(struct f
+ 	struct blk_trace *bt = filp->private_data;
+ 	char buf[16];
+ 
+-	snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
++	snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
+ 
+ 	return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
+ }
+@@ -386,7 +386,7 @@ static int blk_subbuf_start_callback(str
+ 		return 1;
+ 
+ 	bt = buf->chan->private_data;
+-	atomic_inc(&bt->dropped);
++	atomic_inc_unchecked(&bt->dropped);
+ 	return 0;
+ }
+ 
+@@ -487,7 +487,7 @@ int do_blk_trace_setup(struct request_qu
+ 
+ 	bt->dir = dir;
+ 	bt->dev = dev;
+-	atomic_set(&bt->dropped, 0);
++	atomic_set_unchecked(&bt->dropped, 0);
+ 
+ 	ret = -EIO;
+ 	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
+diff -urNp linux-2.6.38.7/kernel/trace/ftrace.c linux-2.6.38.7/kernel/trace/ftrace.c
+--- linux-2.6.38.7/kernel/trace/ftrace.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/ftrace.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1107,13 +1107,18 @@ ftrace_code_disable(struct module *mod, 
  
  	ip = rec->ip;
@@ -52039,9 +61994,9 @@ diff -urNp linux-2.6.38.2/kernel/trace/ftrace.c linux-2.6.38.2/kernel/trace/ftra
  }
  
  /*
-diff -urNp linux-2.6.38.2/kernel/trace/ring_buffer.c linux-2.6.38.2/kernel/trace/ring_buffer.c
---- linux-2.6.38.2/kernel/trace/ring_buffer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/ring_buffer.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/ring_buffer.c linux-2.6.38.7/kernel/trace/ring_buffer.c
+--- linux-2.6.38.7/kernel/trace/ring_buffer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/ring_buffer.c	2011-04-28 19:34:15.000000000 -0400
 @@ -669,7 +669,7 @@ static struct list_head *rb_list_head(st
   * the reader page). But if the next page is a header page,
   * its flags will be non zero.
@@ -52051,10 +62006,28 @@ diff -urNp linux-2.6.38.2/kernel/trace/ring_buffer.c linux-2.6.38.2/kernel/trace
  rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
  		struct buffer_page *page, struct list_head *list)
  {
-diff -urNp linux-2.6.38.2/kernel/trace/trace.c linux-2.6.38.2/kernel/trace/trace.c
---- linux-2.6.38.2/kernel/trace/trace.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/trace.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3967,10 +3967,9 @@ static const struct file_operations trac
+diff -urNp linux-2.6.38.7/kernel/trace/trace.c linux-2.6.38.7/kernel/trace/trace.c
+--- linux-2.6.38.7/kernel/trace/trace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace.c	2011-05-16 21:47:08.000000000 -0400
+@@ -3316,6 +3316,8 @@ static ssize_t tracing_splice_read_pipe(
+ 	size_t rem;
+ 	unsigned int i;
+ 
++	pax_track_stack();
++
+ 	if (splice_grow_spd(pipe, &spd))
+ 		return -ENOMEM;
+ 
+@@ -3799,6 +3801,8 @@ tracing_buffers_splice_read(struct file 
+ 	int entries, size, i;
+ 	size_t ret;
+ 
++	pax_track_stack();
++
+ 	if (splice_grow_spd(pipe, &spd))
+ 		return -ENOMEM;
+ 
+@@ -3967,10 +3971,9 @@ static const struct file_operations trac
  };
  #endif
  
@@ -52066,7 +62039,7 @@ diff -urNp linux-2.6.38.2/kernel/trace/trace.c linux-2.6.38.2/kernel/trace/trace
  	static int once;
  
  	if (d_tracer)
-@@ -3990,10 +3989,9 @@ struct dentry *tracing_init_dentry(void)
+@@ -3990,10 +3993,9 @@ struct dentry *tracing_init_dentry(void)
  	return d_tracer;
  }
  
@@ -52078,9 +62051,9 @@ diff -urNp linux-2.6.38.2/kernel/trace/trace.c linux-2.6.38.2/kernel/trace/trace
  	static int once;
  	struct dentry *d_tracer;
  
-diff -urNp linux-2.6.38.2/kernel/trace/trace_events.c linux-2.6.38.2/kernel/trace/trace_events.c
---- linux-2.6.38.2/kernel/trace/trace_events.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/trace_events.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/trace_events.c linux-2.6.38.7/kernel/trace/trace_events.c
+--- linux-2.6.38.7/kernel/trace/trace_events.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace_events.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1240,10 +1240,10 @@ static LIST_HEAD(ftrace_module_file_list
  struct ftrace_module_file_ops {
  	struct list_head		list;
@@ -52096,9 +62069,48 @@ diff -urNp linux-2.6.38.2/kernel/trace/trace_events.c linux-2.6.38.2/kernel/trac
  };
  
  static struct ftrace_module_file_ops *
-diff -urNp linux-2.6.38.2/kernel/trace/trace_output.c linux-2.6.38.2/kernel/trace/trace_output.c
---- linux-2.6.38.2/kernel/trace/trace_output.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/trace_output.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/trace_mmiotrace.c linux-2.6.38.7/kernel/trace/trace_mmiotrace.c
+--- linux-2.6.38.7/kernel/trace/trace_mmiotrace.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace_mmiotrace.c	2011-04-28 19:57:25.000000000 -0400
+@@ -24,7 +24,7 @@ struct header_iter {
+ static struct trace_array *mmio_trace_array;
+ static bool overrun_detected;
+ static unsigned long prev_overruns;
+-static atomic_t dropped_count;
++static atomic_unchecked_t dropped_count;
+ 
+ static void mmio_reset_data(struct trace_array *tr)
+ {
+@@ -127,7 +127,7 @@ static void mmio_close(struct trace_iter
+ 
+ static unsigned long count_overruns(struct trace_iterator *iter)
+ {
+-	unsigned long cnt = atomic_xchg(&dropped_count, 0);
++	unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
+ 	unsigned long over = ring_buffer_overruns(iter->tr->buffer);
+ 
+ 	if (over > prev_overruns)
+@@ -317,7 +317,7 @@ static void __trace_mmiotrace_rw(struct 
+ 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
+ 					  sizeof(*entry), 0, pc);
+ 	if (!event) {
+-		atomic_inc(&dropped_count);
++		atomic_inc_unchecked(&dropped_count);
+ 		return;
+ 	}
+ 	entry	= ring_buffer_event_data(event);
+@@ -347,7 +347,7 @@ static void __trace_mmiotrace_map(struct
+ 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
+ 					  sizeof(*entry), 0, pc);
+ 	if (!event) {
+-		atomic_inc(&dropped_count);
++		atomic_inc_unchecked(&dropped_count);
+ 		return;
+ 	}
+ 	entry	= ring_buffer_event_data(event);
+diff -urNp linux-2.6.38.7/kernel/trace/trace_output.c linux-2.6.38.7/kernel/trace/trace_output.c
+--- linux-2.6.38.7/kernel/trace/trace_output.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace_output.c	2011-04-28 19:34:15.000000000 -0400
 @@ -278,7 +278,7 @@ int trace_seq_path(struct trace_seq *s, 
  
  	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
@@ -52108,9 +62120,9 @@ diff -urNp linux-2.6.38.2/kernel/trace/trace_output.c linux-2.6.38.2/kernel/trac
  		if (p) {
  			s->len = p - s->buffer;
  			return 1;
-diff -urNp linux-2.6.38.2/kernel/trace/trace_stack.c linux-2.6.38.2/kernel/trace/trace_stack.c
---- linux-2.6.38.2/kernel/trace/trace_stack.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/kernel/trace/trace_stack.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/trace_stack.c linux-2.6.38.7/kernel/trace/trace_stack.c
+--- linux-2.6.38.7/kernel/trace/trace_stack.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace_stack.c	2011-04-28 19:34:15.000000000 -0400
 @@ -50,7 +50,7 @@ static inline void check_stack(void)
  		return;
  
@@ -52120,9 +62132,39 @@ diff -urNp linux-2.6.38.2/kernel/trace/trace_stack.c linux-2.6.38.2/kernel/trace
  		return;
  
  	local_irq_save(flags);
-diff -urNp linux-2.6.38.2/lib/bug.c linux-2.6.38.2/lib/bug.c
---- linux-2.6.38.2/lib/bug.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/bug.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/kernel/trace/trace_workqueue.c linux-2.6.38.7/kernel/trace/trace_workqueue.c
+--- linux-2.6.38.7/kernel/trace/trace_workqueue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/kernel/trace/trace_workqueue.c	2011-04-28 19:34:15.000000000 -0400
+@@ -22,7 +22,7 @@ struct cpu_workqueue_stats {
+ 	int		            cpu;
+ 	pid_t			    pid;
+ /* Can be inserted from interrupt or user context, need to be atomic */
+-	atomic_t	            inserted;
++	atomic_unchecked_t          inserted;
+ /*
+  *  Don't need to be atomic, works are serialized in a single workqueue thread
+  *  on a single CPU.
+@@ -60,7 +60,7 @@ probe_workqueue_insertion(void *ignore,
+ 	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
+ 	list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
+ 		if (node->pid == wq_thread->pid) {
+-			atomic_inc(&node->inserted);
++			atomic_inc_unchecked(&node->inserted);
+ 			goto found;
+ 		}
+ 	}
+@@ -210,7 +210,7 @@ static int workqueue_stat_show(struct se
+ 		tsk = get_pid_task(pid, PIDTYPE_PID);
+ 		if (tsk) {
+ 			seq_printf(s, "%3d %6d     %6u       %s\n", cws->cpu,
+-				   atomic_read(&cws->inserted), cws->executed,
++				   atomic_read_unchecked(&cws->inserted), cws->executed,
+ 				   tsk->comm);
+ 			put_task_struct(tsk);
+ 		}
+diff -urNp linux-2.6.38.7/lib/bug.c linux-2.6.38.7/lib/bug.c
+--- linux-2.6.38.7/lib/bug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/bug.c	2011-04-28 19:34:15.000000000 -0400
 @@ -133,6 +133,8 @@ enum bug_trap_type report_bug(unsigned l
  		return BUG_TRAP_TYPE_NONE;
  
@@ -52132,9 +62174,9 @@ diff -urNp linux-2.6.38.2/lib/bug.c linux-2.6.38.2/lib/bug.c
  
  	file = NULL;
  	line = 0;
-diff -urNp linux-2.6.38.2/lib/debugobjects.c linux-2.6.38.2/lib/debugobjects.c
---- linux-2.6.38.2/lib/debugobjects.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/debugobjects.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/debugobjects.c linux-2.6.38.7/lib/debugobjects.c
+--- linux-2.6.38.7/lib/debugobjects.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/debugobjects.c	2011-04-28 19:34:15.000000000 -0400
 @@ -281,7 +281,7 @@ static void debug_object_is_on_stack(voi
  	if (limit > 4)
  		return;
@@ -52144,9 +62186,9 @@ diff -urNp linux-2.6.38.2/lib/debugobjects.c linux-2.6.38.2/lib/debugobjects.c
  	if (is_on_stack == onstack)
  		return;
  
-diff -urNp linux-2.6.38.2/lib/dma-debug.c linux-2.6.38.2/lib/dma-debug.c
---- linux-2.6.38.2/lib/dma-debug.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/dma-debug.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/dma-debug.c linux-2.6.38.7/lib/dma-debug.c
+--- linux-2.6.38.7/lib/dma-debug.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/dma-debug.c	2011-04-28 19:34:15.000000000 -0400
 @@ -862,7 +862,7 @@ out:
  
  static void check_for_stack(struct device *dev, void *addr)
@@ -52156,9 +62198,9 @@ diff -urNp linux-2.6.38.2/lib/dma-debug.c linux-2.6.38.2/lib/dma-debug.c
  		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
  				"stack [addr=%p]\n", addr);
  }
-diff -urNp linux-2.6.38.2/lib/inflate.c linux-2.6.38.2/lib/inflate.c
---- linux-2.6.38.2/lib/inflate.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/inflate.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/inflate.c linux-2.6.38.7/lib/inflate.c
+--- linux-2.6.38.7/lib/inflate.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/inflate.c	2011-04-28 19:34:15.000000000 -0400
 @@ -269,7 +269,7 @@ static void free(void *where)
  		malloc_ptr = free_mem_ptr;
  }
@@ -52168,9 +62210,9 @@ diff -urNp linux-2.6.38.2/lib/inflate.c linux-2.6.38.2/lib/inflate.c
  #define free(a) kfree(a)
  #endif
  
-diff -urNp linux-2.6.38.2/lib/Kconfig.debug linux-2.6.38.2/lib/Kconfig.debug
---- linux-2.6.38.2/lib/Kconfig.debug	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/Kconfig.debug	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/Kconfig.debug linux-2.6.38.7/lib/Kconfig.debug
+--- linux-2.6.38.7/lib/Kconfig.debug	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/lib/Kconfig.debug	2011-04-28 19:34:15.000000000 -0400
 @@ -1066,6 +1066,7 @@ config LATENCYTOP
  	depends on DEBUG_KERNEL
  	depends on STACKTRACE_SUPPORT
@@ -52179,9 +62221,9 @@ diff -urNp linux-2.6.38.2/lib/Kconfig.debug linux-2.6.38.2/lib/Kconfig.debug
  	select FRAME_POINTER if !MIPS && !PPC && !S390 && !MICROBLAZE
  	select KALLSYMS
  	select KALLSYMS_ALL
-diff -urNp linux-2.6.38.2/lib/kref.c linux-2.6.38.2/lib/kref.c
---- linux-2.6.38.2/lib/kref.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/kref.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/kref.c linux-2.6.38.7/lib/kref.c
+--- linux-2.6.38.7/lib/kref.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/kref.c	2011-04-28 19:34:15.000000000 -0400
 @@ -52,7 +52,7 @@ void kref_get(struct kref *kref)
   */
  int kref_put(struct kref *kref, void (*release)(struct kref *kref))
@@ -52191,9 +62233,9 @@ diff -urNp linux-2.6.38.2/lib/kref.c linux-2.6.38.2/lib/kref.c
  	WARN_ON(release == (void (*)(struct kref *))kfree);
  
  	if (atomic_dec_and_test(&kref->refcount)) {
-diff -urNp linux-2.6.38.2/lib/radix-tree.c linux-2.6.38.2/lib/radix-tree.c
---- linux-2.6.38.2/lib/radix-tree.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/radix-tree.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/radix-tree.c linux-2.6.38.7/lib/radix-tree.c
+--- linux-2.6.38.7/lib/radix-tree.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/lib/radix-tree.c	2011-04-28 19:34:15.000000000 -0400
 @@ -80,7 +80,7 @@ struct radix_tree_preload {
  	int nr;
  	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
@@ -52203,9 +62245,9 @@ diff -urNp linux-2.6.38.2/lib/radix-tree.c linux-2.6.38.2/lib/radix-tree.c
  
  static inline void *ptr_to_indirect(void *ptr)
  {
-diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
---- linux-2.6.38.2/lib/vsprintf.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/lib/vsprintf.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/lib/vsprintf.c linux-2.6.38.7/lib/vsprintf.c
+--- linux-2.6.38.7/lib/vsprintf.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/lib/vsprintf.c	2011-04-28 19:34:15.000000000 -0400
 @@ -16,6 +16,9 @@
   * - scnprintf and vscnprintf
   */
@@ -52216,7 +62258,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  #include <stdarg.h>
  #include <linux/module.h>
  #include <linux/types.h>
-@@ -574,7 +577,7 @@ char *symbol_string(char *buf, char *end
+@@ -433,7 +436,7 @@ char *symbol_string(char *buf, char *end
  	unsigned long value = (unsigned long) ptr;
  #ifdef CONFIG_KALLSYMS
  	char sym[KSYM_SYMBOL_LEN];
@@ -52225,7 +62267,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  		sprint_symbol(sym, value);
  	else
  		kallsyms_lookup(value, NULL, NULL, NULL, sym);
-@@ -936,7 +939,11 @@ char *uuid_string(char *buf, char *end, 
+@@ -795,7 +798,11 @@ char *uuid_string(char *buf, char *end, 
  	return string(buf, end, uuid, spec);
  }
  
@@ -52237,7 +62279,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  
  /*
   * Show a '%p' thing.  A kernel extension is that the '%p' is followed
-@@ -949,6 +956,8 @@ int kptr_restrict = 1;
+@@ -808,6 +815,8 @@ int kptr_restrict = 1;
   * - 'f' For simple symbolic function names without offset
   * - 'S' For symbolic direct pointers with offset
   * - 's' For symbolic direct pointers without offset
@@ -52246,7 +62288,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
   * - 'R' For decoded struct resource, e.g., [mem 0x0-0x1f 64bit pref]
   * - 'r' For raw struct resource, e.g., [mem 0x0-0x1f flags 0x201]
   * - 'M' For a 6-byte MAC address, it prints the address in the
-@@ -993,12 +1002,12 @@ char *pointer(const char *fmt, char *buf
+@@ -852,12 +861,12 @@ char *pointer(const char *fmt, char *buf
  {
  	if (!ptr) {
  		/*
@@ -52261,7 +62303,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  	}
  
  	switch (*fmt) {
-@@ -1008,6 +1017,13 @@ char *pointer(const char *fmt, char *buf
+@@ -867,6 +876,13 @@ char *pointer(const char *fmt, char *buf
  		/* Fallthrough */
  	case 'S':
  	case 's':
@@ -52275,7 +62317,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  		return symbol_string(buf, end, ptr, spec, *fmt);
  	case 'R':
  	case 'r':
-@@ -1772,11 +1788,11 @@ int bstr_printf(char *buf, size_t size, 
+@@ -1631,11 +1647,11 @@ int bstr_printf(char *buf, size_t size, 
  	typeof(type) value;						\
  	if (sizeof(type) == 8) {					\
  		args = PTR_ALIGN(args, sizeof(u32));			\
@@ -52290,7 +62332,7 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  	}								\
  	args += sizeof(type);						\
  	value;								\
-@@ -1839,7 +1855,7 @@ int bstr_printf(char *buf, size_t size, 
+@@ -1698,7 +1714,7 @@ int bstr_printf(char *buf, size_t size, 
  		case FORMAT_TYPE_STR: {
  			const char *str_arg = args;
  			args += strlen(str_arg) + 1;
@@ -52299,26 +62341,34 @@ diff -urNp linux-2.6.38.2/lib/vsprintf.c linux-2.6.38.2/lib/vsprintf.c
  			break;
  		}
  
-diff -urNp linux-2.6.38.2/localversion-grsec linux-2.6.38.2/localversion-grsec
---- linux-2.6.38.2/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/localversion-grsec	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/localversion-grsec linux-2.6.38.7/localversion-grsec
+--- linux-2.6.38.7/localversion-grsec	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/localversion-grsec	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1 @@
 +-grsec
-diff -urNp linux-2.6.38.2/Makefile linux-2.6.38.2/Makefile
---- linux-2.6.38.2/Makefile	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/Makefile	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/Makefile linux-2.6.38.7/Makefile
+--- linux-2.6.38.7/Makefile	2011-05-22 23:05:17.000000000 -0400
++++ linux-2.6.38.7/Makefile	2011-05-22 23:05:53.000000000 -0400
 @@ -233,8 +233,8 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH"
  
  HOSTCC       = gcc
  HOSTCXX      = g++
 -HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
 -HOSTCXXFLAGS = -O2
-+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
++HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
 +HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
  
  # Decide whether to build built-in, modular, or both.
  # Normally, just do built-in.
-@@ -681,7 +681,7 @@ export mod_strip_cmd
+@@ -352,6 +352,7 @@ LINUXINCLUDE    := -I$(srctree)/arch/$(h
+ KBUILD_CPPFLAGS := -D__KERNEL__
+ 
+ KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
++		   -W -Wno-empty-body -Wno-unused-parameter -Wno-missing-field-initializers \
+ 		   -fno-strict-aliasing -fno-common \
+ 		   -Werror-implicit-function-declaration \
+ 		   -Wno-format-security \
+@@ -681,7 +682,7 @@ export mod_strip_cmd
  
  
  ifeq ($(KBUILD_EXTMOD),)
@@ -52327,9 +62377,9 @@ diff -urNp linux-2.6.38.2/Makefile linux-2.6.38.2/Makefile
  
  vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
  		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
-diff -urNp linux-2.6.38.2/mm/bootmem.c linux-2.6.38.2/mm/bootmem.c
---- linux-2.6.38.2/mm/bootmem.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/bootmem.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/bootmem.c linux-2.6.38.7/mm/bootmem.c
+--- linux-2.6.38.7/mm/bootmem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/bootmem.c	2011-04-28 19:34:15.000000000 -0400
 @@ -201,19 +201,30 @@ static void __init __free_pages_memory(u
  unsigned long __init free_all_memory_core_early(int nodeid)
  {
@@ -52363,9 +62413,9 @@ diff -urNp linux-2.6.38.2/mm/bootmem.c linux-2.6.38.2/mm/bootmem.c
  
  	return count;
  }
-diff -urNp linux-2.6.38.2/mm/filemap.c linux-2.6.38.2/mm/filemap.c
---- linux-2.6.38.2/mm/filemap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/filemap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/filemap.c linux-2.6.38.7/mm/filemap.c
+--- linux-2.6.38.7/mm/filemap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/filemap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1664,7 +1664,7 @@ int generic_file_mmap(struct file * file
  	struct address_space *mapping = file->f_mapping;
  
@@ -52383,9 +62433,9 @@ diff -urNp linux-2.6.38.2/mm/filemap.c linux-2.6.38.2/mm/filemap.c
  			if (*pos >= limit) {
  				send_sig(SIGXFSZ, current, 0);
  				return -EFBIG;
-diff -urNp linux-2.6.38.2/mm/fremap.c linux-2.6.38.2/mm/fremap.c
---- linux-2.6.38.2/mm/fremap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/fremap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/fremap.c linux-2.6.38.7/mm/fremap.c
+--- linux-2.6.38.7/mm/fremap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/fremap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -156,6 +156,11 @@ SYSCALL_DEFINE5(remap_file_pages, unsign
   retry:
  	vma = find_vma(mm, start);
@@ -52407,9 +62457,9 @@ diff -urNp linux-2.6.38.2/mm/fremap.c linux-2.6.38.2/mm/fremap.c
  		munlock_vma_pages_range(vma, start, start + size);
  		vma->vm_flags = saved_flags;
  	}
-diff -urNp linux-2.6.38.2/mm/highmem.c linux-2.6.38.2/mm/highmem.c
---- linux-2.6.38.2/mm/highmem.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/highmem.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/highmem.c linux-2.6.38.7/mm/highmem.c
+--- linux-2.6.38.7/mm/highmem.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/highmem.c	2011-04-28 19:34:15.000000000 -0400
 @@ -125,9 +125,10 @@ static void flush_all_zero_pkmaps(void)
  		 * So no dangers, even with speculative execution.
  		 */
@@ -52435,9 +62485,21 @@ diff -urNp linux-2.6.38.2/mm/highmem.c linux-2.6.38.2/mm/highmem.c
  	pkmap_count[last_pkmap_nr] = 1;
  	set_page_address(page, (void *)vaddr);
  
-diff -urNp linux-2.6.38.2/mm/hugetlb.c linux-2.6.38.2/mm/hugetlb.c
---- linux-2.6.38.2/mm/hugetlb.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/hugetlb.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/huge_memory.c linux-2.6.38.7/mm/huge_memory.c
+--- linux-2.6.38.7/mm/huge_memory.c	2011-05-10 22:06:27.000000000 -0400
++++ linux-2.6.38.7/mm/huge_memory.c	2011-05-10 22:06:56.000000000 -0400
+@@ -698,7 +698,7 @@ out:
+ 	 * run pte_offset_map on the pmd, if an huge pmd could
+ 	 * materialize from under us from a different thread.
+ 	 */
+-	if (unlikely(__pte_alloc(mm, vma, pmd, address)))
++	if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
+ 		return VM_FAULT_OOM;
+ 	/* if an huge pmd materialized from under us just retry later */
+ 	if (unlikely(pmd_trans_huge(*pmd)))
+diff -urNp linux-2.6.38.7/mm/hugetlb.c linux-2.6.38.7/mm/hugetlb.c
+--- linux-2.6.38.7/mm/hugetlb.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/hugetlb.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2333,6 +2333,27 @@ static int unmap_ref_private(struct mm_s
  	return 1;
  }
@@ -52527,9 +62589,9 @@ diff -urNp linux-2.6.38.2/mm/hugetlb.c linux-2.6.38.2/mm/hugetlb.c
  	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
  	if (!ptep)
  		return VM_FAULT_OOM;
-diff -urNp linux-2.6.38.2/mm/Kconfig linux-2.6.38.2/mm/Kconfig
---- linux-2.6.38.2/mm/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/Kconfig linux-2.6.38.7/mm/Kconfig
+--- linux-2.6.38.7/mm/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/Kconfig	2011-04-28 19:34:15.000000000 -0400
 @@ -240,7 +240,7 @@ config KSM
  config DEFAULT_MMAP_MIN_ADDR
          int "Low address space to protect from user allocation"
@@ -52539,9 +62601,9 @@ diff -urNp linux-2.6.38.2/mm/Kconfig linux-2.6.38.2/mm/Kconfig
          help
  	  This is the portion of low virtual memory which should be protected
  	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.38.2/mm/kmemleak.c linux-2.6.38.2/mm/kmemleak.c
---- linux-2.6.38.2/mm/kmemleak.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/kmemleak.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/kmemleak.c linux-2.6.38.7/mm/kmemleak.c
+--- linux-2.6.38.7/mm/kmemleak.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/kmemleak.c	2011-04-28 19:34:15.000000000 -0400
 @@ -357,7 +357,7 @@ static void print_unreferenced(struct se
  
  	for (i = 0; i < object->trace_len; i++) {
@@ -52551,9 +62613,9 @@ diff -urNp linux-2.6.38.2/mm/kmemleak.c linux-2.6.38.2/mm/kmemleak.c
  	}
  }
  
-diff -urNp linux-2.6.38.2/mm/maccess.c linux-2.6.38.2/mm/maccess.c
---- linux-2.6.38.2/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/maccess.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/maccess.c linux-2.6.38.7/mm/maccess.c
+--- linux-2.6.38.7/mm/maccess.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/maccess.c	2011-04-28 19:34:15.000000000 -0400
 @@ -15,10 +15,10 @@
   * happens, handle that and return -EFAULT.
   */
@@ -52580,9 +62642,9 @@ diff -urNp linux-2.6.38.2/mm/maccess.c linux-2.6.38.2/mm/maccess.c
  {
  	long ret;
  	mm_segment_t old_fs = get_fs();
-diff -urNp linux-2.6.38.2/mm/madvise.c linux-2.6.38.2/mm/madvise.c
---- linux-2.6.38.2/mm/madvise.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/madvise.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/madvise.c linux-2.6.38.7/mm/madvise.c
+--- linux-2.6.38.7/mm/madvise.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/madvise.c	2011-04-28 19:34:15.000000000 -0400
 @@ -45,6 +45,10 @@ static long madvise_behavior(struct vm_a
  	pgoff_t pgoff;
  	unsigned long new_flags = vma->vm_flags;
@@ -52659,9 +62721,9 @@ diff -urNp linux-2.6.38.2/mm/madvise.c linux-2.6.38.2/mm/madvise.c
  	error = 0;
  	if (end == start)
  		goto out;
-diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
---- linux-2.6.38.2/mm/memory.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/memory.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/memory.c linux-2.6.38.7/mm/memory.c
+--- linux-2.6.38.7/mm/memory.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/mm/memory.c	2011-05-22 23:08:56.000000000 -0400
 @@ -259,8 +259,12 @@ static inline void free_pmd_range(struct
  		return;
  
@@ -52688,7 +62750,20 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  }
  
  /*
-@@ -1433,10 +1440,10 @@ int __get_user_pages(struct task_struct 
+@@ -1410,12 +1417,6 @@ no_page_table:
+ 	return page;
+ }
+ 
+-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
+-{
+-	return stack_guard_page_start(vma, addr) ||
+-	       stack_guard_page_end(vma, addr+PAGE_SIZE);
+-}
+-
+ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long start, int nr_pages, unsigned int gup_flags,
+ 		     struct page **pages, struct vm_area_struct **vmas,
+@@ -1439,10 +1440,10 @@ int __get_user_pages(struct task_struct 
  			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
  	i = 0;
  
@@ -52700,9 +62775,9 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
 +		vma = find_vma(mm, start);
  		if (!vma && in_gate_area(tsk, start)) {
  			unsigned long pg = start & PAGE_MASK;
- 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
-@@ -1489,7 +1496,7 @@ int __get_user_pages(struct task_struct 
- 			continue;
+ 			pgd_t *pgd;
+@@ -1490,7 +1491,7 @@ int __get_user_pages(struct task_struct 
+ 			goto next_page;
  		}
  
 -		if (!vma ||
@@ -52710,7 +62785,19 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
  		    !(vm_flags & vma->vm_flags))
  			return i ? : -EFAULT;
-@@ -1575,7 +1582,7 @@ int __get_user_pages(struct task_struct 
+@@ -1517,11 +1518,6 @@ int __get_user_pages(struct task_struct 
+ 				int ret;
+ 				unsigned int fault_flags = 0;
+ 
+-				/* For mlock, just skip the stack guard page. */
+-				if (foll_flags & FOLL_MLOCK) {
+-					if (stack_guard_page(vma, start))
+-						goto next_page;
+-				}
+ 				if (foll_flags & FOLL_WRITE)
+ 					fault_flags |= FAULT_FLAG_WRITE;
+ 				if (nonblocking)
+@@ -1582,7 +1578,7 @@ next_page:
  			start += PAGE_SIZE;
  			nr_pages--;
  		} while (nr_pages && start < vma->vm_end);
@@ -52719,7 +62806,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	return i;
  }
  
-@@ -1724,6 +1731,10 @@ static int insert_page(struct vm_area_st
+@@ -1731,6 +1727,10 @@ static int insert_page(struct vm_area_st
  	page_add_file_rmap(page);
  	set_pte_at(mm, addr, pte, mk_pte(page, prot));
  
@@ -52730,7 +62817,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	retval = 0;
  	pte_unmap_unlock(pte, ptl);
  	return retval;
-@@ -1758,10 +1769,22 @@ out:
+@@ -1765,10 +1765,22 @@ out:
  int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
  			struct page *page)
  {
@@ -52753,7 +62840,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	vma->vm_flags |= VM_INSERTPAGE;
  	return insert_page(vma, addr, page, vma->vm_page_prot);
  }
-@@ -1847,6 +1870,7 @@ int vm_insert_mixed(struct vm_area_struc
+@@ -1854,6 +1866,7 @@ int vm_insert_mixed(struct vm_area_struc
  			unsigned long pfn)
  {
  	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
@@ -52761,7 +62848,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  
  	if (addr < vma->vm_start || addr >= vma->vm_end)
  		return -EFAULT;
-@@ -2162,6 +2186,186 @@ static inline void cow_user_page(struct 
+@@ -2169,6 +2182,186 @@ static inline void cow_user_page(struct 
  		copy_user_highpage(dst, src, va, vma);
  }
  
@@ -52948,7 +63035,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  /*
   * This routine handles present pages, when users try to write
   * to a shared page. It is done by copying the page to a new address
-@@ -2373,6 +2577,12 @@ gotten:
+@@ -2380,6 +2573,12 @@ gotten:
  	 */
  	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -52961,7 +63048,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  		if (old_page) {
  			if (!PageAnon(old_page)) {
  				dec_mm_counter_fast(mm, MM_FILEPAGES);
-@@ -2424,6 +2634,10 @@ gotten:
+@@ -2431,6 +2630,10 @@ gotten:
  			page_remove_rmap(old_page);
  		}
  
@@ -52972,7 +63059,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  		/* Free the old page.. */
  		new_page = old_page;
  		ret |= VM_FAULT_WRITE;
-@@ -2834,6 +3048,11 @@ static int do_swap_page(struct mm_struct
+@@ -2841,6 +3044,11 @@ static int do_swap_page(struct mm_struct
  	swap_free(entry);
  	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
  		try_to_free_swap(page);
@@ -52984,7 +63071,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	unlock_page(page);
  	if (swapcache) {
  		/*
-@@ -2857,6 +3076,11 @@ static int do_swap_page(struct mm_struct
+@@ -2864,6 +3072,11 @@ static int do_swap_page(struct mm_struct
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -52996,7 +63083,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  out:
-@@ -2876,40 +3100,6 @@ out_release:
+@@ -2883,40 +3096,6 @@ out_release:
  }
  
  /*
@@ -53037,7 +63124,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
   * We enter with non-exclusive mmap_sem (to exclude vma changes,
   * but allow concurrent faults), and pte mapped but not yet locked.
   * We return with mmap_sem still held, but pte unmapped and unlocked.
-@@ -2918,27 +3108,23 @@ static int do_anonymous_page(struct mm_s
+@@ -2925,27 +3104,23 @@ static int do_anonymous_page(struct mm_s
  		unsigned long address, pte_t *page_table, pmd_t *pmd,
  		unsigned int flags)
  {
@@ -53070,7 +63157,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	if (unlikely(anon_vma_prepare(vma)))
  		goto oom;
  	page = alloc_zeroed_user_highpage_movable(vma, address);
-@@ -2957,6 +3143,11 @@ static int do_anonymous_page(struct mm_s
+@@ -2964,6 +3139,11 @@ static int do_anonymous_page(struct mm_s
  	if (!pte_none(*page_table))
  		goto release;
  
@@ -53082,7 +63169,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	inc_mm_counter_fast(mm, MM_ANONPAGES);
  	page_add_new_anon_rmap(page, vma, address);
  setpte:
-@@ -2964,6 +3155,12 @@ setpte:
+@@ -2971,6 +3151,12 @@ setpte:
  
  	/* No need to invalidate - it was non-present before */
  	update_mmu_cache(vma, address, page_table);
@@ -53095,7 +63182,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  unlock:
  	pte_unmap_unlock(page_table, ptl);
  	return 0;
-@@ -3101,6 +3298,12 @@ static int __do_fault(struct mm_struct *
+@@ -3108,6 +3294,12 @@ static int __do_fault(struct mm_struct *
  	 */
  	/* Only go through if we didn't race with anybody else... */
  	if (likely(pte_same(*page_table, orig_pte))) {
@@ -53108,7 +63195,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  		flush_icache_page(vma, page);
  		entry = mk_pte(page, vma->vm_page_prot);
  		if (flags & FAULT_FLAG_WRITE)
-@@ -3120,6 +3323,14 @@ static int __do_fault(struct mm_struct *
+@@ -3127,6 +3319,14 @@ static int __do_fault(struct mm_struct *
  
  		/* no need to invalidate: a not-present page won't be cached */
  		update_mmu_cache(vma, address, page_table);
@@ -53123,7 +63210,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	} else {
  		if (charged)
  			mem_cgroup_uncharge_page(page);
-@@ -3267,6 +3478,12 @@ int handle_pte_fault(struct mm_struct *m
+@@ -3274,6 +3474,12 @@ int handle_pte_fault(struct mm_struct *m
  		if (flags & FAULT_FLAG_WRITE)
  			flush_tlb_fix_spurious_fault(vma, address);
  	}
@@ -53136,7 +63223,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  unlock:
  	pte_unmap_unlock(pte, ptl);
  	return 0;
-@@ -3283,6 +3500,10 @@ int handle_mm_fault(struct mm_struct *mm
+@@ -3290,6 +3496,10 @@ int handle_mm_fault(struct mm_struct *mm
  	pmd_t *pmd;
  	pte_t *pte;
  
@@ -53147,7 +63234,7 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	__set_current_state(TASK_RUNNING);
  
  	count_vm_event(PGFAULT);
-@@ -3293,6 +3514,34 @@ int handle_mm_fault(struct mm_struct *mm
+@@ -3300,6 +3510,34 @@ int handle_mm_fault(struct mm_struct *mm
  	if (unlikely(is_vm_hugetlb_page(vma)))
  		return hugetlb_fault(mm, vma, address, flags);
  
@@ -53182,7 +63269,16 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	pgd = pgd_offset(mm, address);
  	pud = pud_alloc(mm, pgd, address);
  	if (!pud)
-@@ -3426,7 +3675,7 @@ static int __init gate_vma_init(void)
+@@ -3329,7 +3567,7 @@ int handle_mm_fault(struct mm_struct *mm
+ 	 * run pte_offset_map on the pmd, if an huge pmd could
+ 	 * materialize from under us from a different thread.
+ 	 */
+-	if (unlikely(pmd_none(*pmd)) && __pte_alloc(mm, vma, pmd, address))
++	if (unlikely(pmd_none(*pmd) && __pte_alloc(mm, vma, pmd, address)))
+ 		return VM_FAULT_OOM;
+ 	/* if an huge pmd materialized from under us just retry later */
+ 	if (unlikely(pmd_trans_huge(*pmd)))
+@@ -3433,7 +3671,7 @@ static int __init gate_vma_init(void)
  	gate_vma.vm_start = FIXADDR_USER_START;
  	gate_vma.vm_end = FIXADDR_USER_END;
  	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
@@ -53191,9 +63287,9 @@ diff -urNp linux-2.6.38.2/mm/memory.c linux-2.6.38.2/mm/memory.c
  	/*
  	 * Make sure the vDSO gets into every core dump.
  	 * Dumping its contents makes post-mortem fully interpretable later
-diff -urNp linux-2.6.38.2/mm/memory-failure.c linux-2.6.38.2/mm/memory-failure.c
---- linux-2.6.38.2/mm/memory-failure.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/memory-failure.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/memory-failure.c linux-2.6.38.7/mm/memory-failure.c
+--- linux-2.6.38.7/mm/memory-failure.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/memory-failure.c	2011-04-28 19:34:15.000000000 -0400
 @@ -58,7 +58,7 @@ int sysctl_memory_failure_early_kill __r
  
  int sysctl_memory_failure_recovery __read_mostly = 1;
@@ -53266,9 +63362,9 @@ diff -urNp linux-2.6.38.2/mm/memory-failure.c linux-2.6.38.2/mm/memory-failure.c
  	SetPageHWPoison(page);
  	/* keep elevated page count for bad page */
  	return ret;
-diff -urNp linux-2.6.38.2/mm/mempolicy.c linux-2.6.38.2/mm/mempolicy.c
---- linux-2.6.38.2/mm/mempolicy.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/mempolicy.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/mempolicy.c linux-2.6.38.7/mm/mempolicy.c
+--- linux-2.6.38.7/mm/mempolicy.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/mempolicy.c	2011-04-28 19:34:15.000000000 -0400
 @@ -643,6 +643,10 @@ static int mbind_range(struct mm_struct 
  	unsigned long vmstart;
  	unsigned long vmend;
@@ -53349,10 +63445,19 @@ diff -urNp linux-2.6.38.2/mm/mempolicy.c linux-2.6.38.2/mm/mempolicy.c
  	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
  		seq_printf(m, " heap");
  	} else if (vma->vm_start <= mm->start_stack &&
-diff -urNp linux-2.6.38.2/mm/migrate.c linux-2.6.38.2/mm/migrate.c
---- linux-2.6.38.2/mm/migrate.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/migrate.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1299,6 +1299,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+diff -urNp linux-2.6.38.7/mm/migrate.c linux-2.6.38.7/mm/migrate.c
+--- linux-2.6.38.7/mm/migrate.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/migrate.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1115,6 +1115,8 @@ static int do_pages_move(struct mm_struc
+ 	unsigned long chunk_start;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	task_nodes = cpuset_mems_allowed(task);
+ 
+ 	err = -ENOMEM;
+@@ -1299,6 +1301,14 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
  	if (!mm)
  		return -EINVAL;
  
@@ -53367,7 +63472,7 @@ diff -urNp linux-2.6.38.2/mm/migrate.c linux-2.6.38.2/mm/migrate.c
  	/*
  	 * Check if this process has the right to modify the specified
  	 * process. The right exists if the process has administrative
-@@ -1308,8 +1316,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
+@@ -1308,8 +1318,7 @@ SYSCALL_DEFINE6(move_pages, pid_t, pid, 
  	rcu_read_lock();
  	tcred = __task_cred(task);
  	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
@@ -53377,9 +63482,9 @@ diff -urNp linux-2.6.38.2/mm/migrate.c linux-2.6.38.2/mm/migrate.c
  		rcu_read_unlock();
  		err = -EPERM;
  		goto out;
-diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
---- linux-2.6.38.2/mm/mlock.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/mlock.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/mlock.c linux-2.6.38.7/mm/mlock.c
+--- linux-2.6.38.7/mm/mlock.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/mm/mlock.c	2011-05-10 22:09:01.000000000 -0400
 @@ -13,6 +13,7 @@
  #include <linux/pagemap.h>
  #include <linux/mempolicy.h>
@@ -53388,34 +63493,7 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  #include <linux/sched.h>
  #include <linux/module.h>
  #include <linux/rmap.h>
-@@ -135,13 +136,6 @@ void munlock_vma_page(struct page *page)
- 	}
- }
- 
--static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
--{
--	return (vma->vm_flags & VM_GROWSDOWN) &&
--		(vma->vm_start == addr) &&
--		!vma_stack_continue(vma->vm_prev, addr);
--}
--
- /**
-  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
-  * @vma:   target vma
-@@ -188,12 +182,6 @@ static long __mlock_vma_pages_range(stru
- 	if (vma->vm_flags & VM_LOCKED)
- 		gup_flags |= FOLL_MLOCK;
- 
--	/* We don't try to access the guard page of a stack vma */
--	if (stack_guard_page(vma, start)) {
--		addr += PAGE_SIZE;
--		nr_pages--;
--	}
--
- 	return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
- 				NULL, NULL, nonblocking);
- }
-@@ -393,6 +381,9 @@ static int do_mlock(unsigned long start,
+@@ -377,6 +378,9 @@ static int do_mlock(unsigned long start,
  		return -EINVAL;
  	if (end == start)
  		return 0;
@@ -53425,7 +63503,7 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  	vma = find_vma_prev(current->mm, start, &prev);
  	if (!vma || vma->vm_start > start)
  		return -ENOMEM;
-@@ -403,6 +394,11 @@ static int do_mlock(unsigned long start,
+@@ -387,6 +391,11 @@ static int do_mlock(unsigned long start,
  	for (nstart = start ; ; ) {
  		unsigned int newflags;
  
@@ -53437,7 +63515,7 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  		/* Here we know that  vma->vm_start <= nstart < vma->vm_end. */
  
  		newflags = vma->vm_flags | VM_LOCKED;
-@@ -508,6 +504,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
+@@ -492,6 +501,7 @@ SYSCALL_DEFINE2(mlock, unsigned long, st
  	lock_limit >>= PAGE_SHIFT;
  
  	/* check against resource limits */
@@ -53445,7 +63523,7 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
  		error = do_mlock(start, len, 1);
  	up_write(&current->mm->mmap_sem);
-@@ -531,17 +528,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
+@@ -515,17 +525,23 @@ SYSCALL_DEFINE2(munlock, unsigned long, 
  static int do_mlockall(int flags)
  {
  	struct vm_area_struct * vma, * prev = NULL;
@@ -53473,7 +63551,7 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  		newflags = vma->vm_flags | VM_LOCKED;
  		if (!(flags & MCL_CURRENT))
  			newflags &= ~VM_LOCKED;
-@@ -573,6 +576,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
+@@ -557,6 +573,7 @@ SYSCALL_DEFINE1(mlockall, int, flags)
  	lock_limit >>= PAGE_SHIFT;
  
  	ret = -ENOMEM;
@@ -53481,9 +63559,9 @@ diff -urNp linux-2.6.38.2/mm/mlock.c linux-2.6.38.2/mm/mlock.c
  	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
  	    capable(CAP_IPC_LOCK))
  		ret = do_mlockall(flags);
-diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
---- linux-2.6.38.2/mm/mmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/mmap.c	2011-03-21 23:47:41.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/mmap.c linux-2.6.38.7/mm/mmap.c
+--- linux-2.6.38.7/mm/mmap.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/mm/mmap.c	2011-05-22 23:06:04.000000000 -0400
 @@ -46,6 +46,16 @@
  #define arch_rebalance_pgtables(addr, len)		(addr)
  #endif
@@ -54212,8 +64290,8 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		unsigned long size, grow;
  
  		size = address - vma->vm_start;
-@@ -1773,6 +2034,8 @@ int expand_upwards(struct vm_area_struct
- 			perf_event_mmap(vma);
+@@ -1776,6 +2037,8 @@ int expand_upwards(struct vm_area_struct
+ 			}
  		}
  	}
 +	if (locknext)
@@ -54221,7 +64299,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	vma_unlock_anon_vma(vma);
  	khugepaged_enter_vma_merge(vma);
  	return error;
-@@ -1786,6 +2049,8 @@ static int expand_downwards(struct vm_ar
+@@ -1789,6 +2052,8 @@ static int expand_downwards(struct vm_ar
  				   unsigned long address)
  {
  	int error;
@@ -54230,7 +64308,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  
  	/*
  	 * We must make sure the anon_vma is allocated
-@@ -1799,6 +2064,15 @@ static int expand_downwards(struct vm_ar
+@@ -1802,6 +2067,15 @@ static int expand_downwards(struct vm_ar
  	if (error)
  		return error;
  
@@ -54246,7 +64324,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	vma_lock_anon_vma(vma);
  
  	/*
-@@ -1808,9 +2082,17 @@ static int expand_downwards(struct vm_ar
+@@ -1811,9 +2085,17 @@ static int expand_downwards(struct vm_ar
  	 */
  
  	/* Somebody else might have raced and expanded it already */
@@ -54265,20 +64343,21 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		size = vma->vm_end - address;
  		grow = (vma->vm_start - address) >> PAGE_SHIFT;
  
-@@ -1818,10 +2100,21 @@ static int expand_downwards(struct vm_ar
- 		if (!error) {
- 			vma->vm_start = address;
- 			vma->vm_pgoff -= grow;
-+			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
+@@ -1823,11 +2105,22 @@ static int expand_downwards(struct vm_ar
+ 			if (!error) {
+ 				vma->vm_start = address;
+ 				vma->vm_pgoff -= grow;
++				track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
 +
 +#ifdef CONFIG_PAX_SEGMEXEC
-+			if (vma_m) {
-+				vma_m->vm_start -= grow << PAGE_SHIFT;
-+				vma_m->vm_pgoff -= grow;
-+			}
++				if (vma_m) {
++					vma_m->vm_start -= grow << PAGE_SHIFT;
++					vma_m->vm_pgoff -= grow;
++				}
 +#endif
 +
- 			perf_event_mmap(vma);
+ 				perf_event_mmap(vma);
+ 			}
  		}
  	}
  	vma_unlock_anon_vma(vma);
@@ -54287,7 +64366,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	khugepaged_enter_vma_merge(vma);
  	return error;
  }
-@@ -1896,6 +2189,13 @@ static void remove_vma_list(struct mm_st
+@@ -1902,6 +2195,13 @@ static void remove_vma_list(struct mm_st
  	do {
  		long nrpages = vma_pages(vma);
  
@@ -54301,7 +64380,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		mm->total_vm -= nrpages;
  		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
  		vma = remove_vma(vma);
-@@ -1941,6 +2241,16 @@ detach_vmas_to_be_unmapped(struct mm_str
+@@ -1947,6 +2247,16 @@ detach_vmas_to_be_unmapped(struct mm_str
  	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
  	vma->vm_prev = NULL;
  	do {
@@ -54318,7 +64397,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		rb_erase(&vma->vm_rb, &mm->mm_rb);
  		mm->map_count--;
  		tail_vma = vma;
-@@ -1969,14 +2279,33 @@ static int __split_vma(struct mm_struct 
+@@ -1975,14 +2285,33 @@ static int __split_vma(struct mm_struct 
  	struct vm_area_struct *new;
  	int err = -ENOMEM;
  
@@ -54352,7 +64431,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	/* most fields are the same, copy all, and then fixup */
  	*new = *vma;
  
-@@ -1989,6 +2318,22 @@ static int __split_vma(struct mm_struct 
+@@ -1995,6 +2324,22 @@ static int __split_vma(struct mm_struct 
  		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
  	}
  
@@ -54375,7 +64454,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	pol = mpol_dup(vma_policy(vma));
  	if (IS_ERR(pol)) {
  		err = PTR_ERR(pol);
-@@ -2014,6 +2359,42 @@ static int __split_vma(struct mm_struct 
+@@ -2020,6 +2365,42 @@ static int __split_vma(struct mm_struct 
  	else
  		err = vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
  
@@ -54418,7 +64497,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	/* Success. */
  	if (!err)
  		return 0;
-@@ -2026,10 +2407,18 @@ static int __split_vma(struct mm_struct 
+@@ -2032,10 +2413,18 @@ static int __split_vma(struct mm_struct 
  			removed_exe_file_vma(mm);
  		fput(new->vm_file);
  	}
@@ -54438,7 +64517,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	kmem_cache_free(vm_area_cachep, new);
   out_err:
  	return err;
-@@ -2042,6 +2431,15 @@ static int __split_vma(struct mm_struct 
+@@ -2048,6 +2437,15 @@ static int __split_vma(struct mm_struct 
  int split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
  	      unsigned long addr, int new_below)
  {
@@ -54454,13 +64533,13 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	if (mm->map_count >= sysctl_max_map_count)
  		return -ENOMEM;
  
-@@ -2053,11 +2451,30 @@ int split_vma(struct mm_struct *mm, stru
+@@ -2059,11 +2457,30 @@ int split_vma(struct mm_struct *mm, stru
   * work.  This now handles partial unmappings.
   * Jeremy Fitzhardinge <jeremy@goop.org>
   */
 +#ifdef CONFIG_PAX_SEGMEXEC
- int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
- {
++int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
++{
 +	int ret = __do_munmap(mm, start, len);
 +	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
 +		return ret;
@@ -54470,9 +64549,9 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
 +
 +int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
 +#else
-+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+ int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
 +#endif
-+{
+ {
  	unsigned long end;
  	struct vm_area_struct *vma, *prev, *last;
  
@@ -54485,7 +64564,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
  		return -EINVAL;
  
-@@ -2131,6 +2548,8 @@ int do_munmap(struct mm_struct *mm, unsi
+@@ -2137,6 +2554,8 @@ int do_munmap(struct mm_struct *mm, unsi
  	/* Fix up all other VM information */
  	remove_vma_list(mm, vma);
  
@@ -54494,7 +64573,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	return 0;
  }
  
-@@ -2143,22 +2562,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
+@@ -2149,22 +2568,18 @@ SYSCALL_DEFINE2(munmap, unsigned long, a
  
  	profile_munmap(addr);
  
@@ -54523,7 +64602,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  /*
   *  this is really a simplified "do_mmap".  it only handles
   *  anonymous maps.  eventually we may be able to do some
-@@ -2172,6 +2587,7 @@ unsigned long do_brk(unsigned long addr,
+@@ -2178,6 +2593,7 @@ unsigned long do_brk(unsigned long addr,
  	struct rb_node ** rb_link, * rb_parent;
  	pgoff_t pgoff = addr >> PAGE_SHIFT;
  	int error;
@@ -54531,7 +64610,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  
  	len = PAGE_ALIGN(len);
  	if (!len)
-@@ -2183,16 +2599,30 @@ unsigned long do_brk(unsigned long addr,
+@@ -2189,16 +2605,30 @@ unsigned long do_brk(unsigned long addr,
  
  	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
  
@@ -54563,7 +64642,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		locked += mm->locked_vm;
  		lock_limit = rlimit(RLIMIT_MEMLOCK);
  		lock_limit >>= PAGE_SHIFT;
-@@ -2209,22 +2639,22 @@ unsigned long do_brk(unsigned long addr,
+@@ -2215,22 +2645,22 @@ unsigned long do_brk(unsigned long addr,
  	/*
  	 * Clear old maps.  this also does some error checking for us
  	 */
@@ -54590,7 +64669,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		return -ENOMEM;
  
  	/* Can we just expand an old private anonymous mapping? */
-@@ -2238,7 +2668,7 @@ unsigned long do_brk(unsigned long addr,
+@@ -2244,7 +2674,7 @@ unsigned long do_brk(unsigned long addr,
  	 */
  	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
  	if (!vma) {
@@ -54599,7 +64678,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  		return -ENOMEM;
  	}
  
-@@ -2252,11 +2682,12 @@ unsigned long do_brk(unsigned long addr,
+@@ -2258,11 +2688,12 @@ unsigned long do_brk(unsigned long addr,
  	vma_link(mm, vma, prev, rb_link, rb_parent);
  out:
  	perf_event_mmap(vma);
@@ -54614,7 +64693,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	return addr;
  }
  
-@@ -2303,8 +2734,10 @@ void exit_mmap(struct mm_struct *mm)
+@@ -2309,8 +2740,10 @@ void exit_mmap(struct mm_struct *mm)
  	 * Walk the list again, actually closing and freeing it,
  	 * with preemption enabled, without holding any MM locks.
  	 */
@@ -54626,7 +64705,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  
  	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
  }
-@@ -2318,6 +2751,13 @@ int insert_vm_struct(struct mm_struct * 
+@@ -2324,6 +2757,13 @@ int insert_vm_struct(struct mm_struct * 
  	struct vm_area_struct * __vma, * prev;
  	struct rb_node ** rb_link, * rb_parent;
  
@@ -54640,7 +64719,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	/*
  	 * The vm_pgoff of a purely anonymous vma should be irrelevant
  	 * until its first write fault, when page's anon_vma and index
-@@ -2340,7 +2780,22 @@ int insert_vm_struct(struct mm_struct * 
+@@ -2346,7 +2786,22 @@ int insert_vm_struct(struct mm_struct * 
  	if ((vma->vm_flags & VM_ACCOUNT) &&
  	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
  		return -ENOMEM;
@@ -54663,7 +64742,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	return 0;
  }
  
-@@ -2358,6 +2813,8 @@ struct vm_area_struct *copy_vma(struct v
+@@ -2364,6 +2819,8 @@ struct vm_area_struct *copy_vma(struct v
  	struct rb_node **rb_link, *rb_parent;
  	struct mempolicy *pol;
  
@@ -54672,7 +64751,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	/*
  	 * If anonymous vma has not yet been faulted, update new pgoff
  	 * to match new location, to increase its chance of merging.
-@@ -2407,6 +2864,39 @@ struct vm_area_struct *copy_vma(struct v
+@@ -2413,6 +2870,39 @@ struct vm_area_struct *copy_vma(struct v
  	kmem_cache_free(vm_area_cachep, new_vma);
  	return NULL;
  }
@@ -54712,7 +64791,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  
  /*
   * Return true if the calling process may expand its vm space by the passed
-@@ -2418,7 +2908,7 @@ int may_expand_vm(struct mm_struct *mm, 
+@@ -2424,7 +2914,7 @@ int may_expand_vm(struct mm_struct *mm, 
  	unsigned long lim;
  
  	lim = rlimit(RLIMIT_AS) >> PAGE_SHIFT;
@@ -54721,7 +64800,7 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	if (cur + npages > lim)
  		return 0;
  	return 1;
-@@ -2489,6 +2979,22 @@ int install_special_mapping(struct mm_st
+@@ -2495,6 +2985,22 @@ int install_special_mapping(struct mm_st
  	vma->vm_start = addr;
  	vma->vm_end = addr + len;
  
@@ -54744,9 +64823,9 @@ diff -urNp linux-2.6.38.2/mm/mmap.c linux-2.6.38.2/mm/mmap.c
  	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
  	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
  
-diff -urNp linux-2.6.38.2/mm/mprotect.c linux-2.6.38.2/mm/mprotect.c
---- linux-2.6.38.2/mm/mprotect.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/mprotect.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/mprotect.c linux-2.6.38.7/mm/mprotect.c
+--- linux-2.6.38.7/mm/mprotect.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/mprotect.c	2011-04-28 19:34:15.000000000 -0400
 @@ -23,10 +23,16 @@
  #include <linux/mmu_notifier.h>
  #include <linux/migrate.h>
@@ -54973,9 +65052,9 @@ diff -urNp linux-2.6.38.2/mm/mprotect.c linux-2.6.38.2/mm/mprotect.c
  		nstart = tmp;
  
  		if (nstart < prev->vm_end)
-diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
---- linux-2.6.38.2/mm/mremap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/mremap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/mremap.c linux-2.6.38.7/mm/mremap.c
+--- linux-2.6.38.7/mm/mremap.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/mm/mremap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
  			continue;
  		pte = ptep_clear_flush(vma, old_addr, old_pte);
@@ -55001,7 +65080,7 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  	/* We can't remap across vm area boundaries */
  	if (old_len > vma->vm_end - addr)
  		goto Efault;
-@@ -322,20 +333,25 @@ static unsigned long mremap_to(unsigned 
+@@ -329,20 +340,25 @@ static unsigned long mremap_to(unsigned 
  	unsigned long ret = -EINVAL;
  	unsigned long charged = 0;
  	unsigned long map_flags;
@@ -55032,7 +65111,7 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  		goto out;
  
  	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +423,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -414,6 +430,7 @@ unsigned long do_mremap(unsigned long ad
  	struct vm_area_struct *vma;
  	unsigned long ret = -EINVAL;
  	unsigned long charged = 0;
@@ -55040,7 +65119,7 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  
  	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
  		goto out;
-@@ -425,6 +442,17 @@ unsigned long do_mremap(unsigned long ad
+@@ -432,6 +449,17 @@ unsigned long do_mremap(unsigned long ad
  	if (!new_len)
  		goto out;
  
@@ -55058,7 +65137,7 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  	if (flags & MREMAP_FIXED) {
  		if (flags & MREMAP_MAYMOVE)
  			ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -474,6 +502,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -481,6 +509,7 @@ unsigned long do_mremap(unsigned long ad
  						   addr + new_len);
  			}
  			ret = addr;
@@ -55066,7 +65145,7 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  			goto out;
  		}
  	}
-@@ -500,7 +529,13 @@ unsigned long do_mremap(unsigned long ad
+@@ -507,7 +536,13 @@ unsigned long do_mremap(unsigned long ad
  		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
  		if (ret)
  			goto out;
@@ -55080,9 +65159,9 @@ diff -urNp linux-2.6.38.2/mm/mremap.c linux-2.6.38.2/mm/mremap.c
  	}
  out:
  	if (ret & ~PAGE_MASK)
-diff -urNp linux-2.6.38.2/mm/nommu.c linux-2.6.38.2/mm/nommu.c
---- linux-2.6.38.2/mm/nommu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/nommu.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/nommu.c linux-2.6.38.7/mm/nommu.c
+--- linux-2.6.38.7/mm/nommu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/nommu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -63,7 +63,6 @@ int sysctl_overcommit_memory = OVERCOMMI
  int sysctl_overcommit_ratio = 50; /* default is 50% */
  int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
@@ -55115,9 +65194,9 @@ diff -urNp linux-2.6.38.2/mm/nommu.c linux-2.6.38.2/mm/nommu.c
  	*region = *vma->vm_region;
  	new->vm_region = region;
  
-diff -urNp linux-2.6.38.2/mm/page_alloc.c linux-2.6.38.2/mm/page_alloc.c
---- linux-2.6.38.2/mm/page_alloc.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/mm/page_alloc.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/page_alloc.c linux-2.6.38.7/mm/page_alloc.c
+--- linux-2.6.38.7/mm/page_alloc.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/mm/page_alloc.c	2011-05-22 23:06:04.000000000 -0400
 @@ -644,6 +644,10 @@ static bool free_pages_prepare(struct pa
  	int i;
  	int bad = 0;
@@ -55153,9 +65232,18 @@ diff -urNp linux-2.6.38.2/mm/page_alloc.c linux-2.6.38.2/mm/page_alloc.c
  
  	if (order && (gfp_flags & __GFP_COMP))
  		prep_compound_page(page, order);
-diff -urNp linux-2.6.38.2/mm/percpu.c linux-2.6.38.2/mm/percpu.c
---- linux-2.6.38.2/mm/percpu.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/percpu.c	2011-03-21 18:31:35.000000000 -0400
+@@ -2423,6 +2435,8 @@ void show_free_areas(void)
+ 	int cpu;
+ 	struct zone *zone;
+ 
++	pax_track_stack();
++
+ 	for_each_populated_zone(zone) {
+ 		show_node(zone);
+ 		printk("%s per-cpu:\n", zone->name);
+diff -urNp linux-2.6.38.7/mm/percpu.c linux-2.6.38.7/mm/percpu.c
+--- linux-2.6.38.7/mm/percpu.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/percpu.c	2011-04-28 19:34:15.000000000 -0400
 @@ -121,7 +121,7 @@ static unsigned int pcpu_first_unit_cpu 
  static unsigned int pcpu_last_unit_cpu __read_mostly;
  
@@ -55165,9 +65253,9 @@ diff -urNp linux-2.6.38.2/mm/percpu.c linux-2.6.38.2/mm/percpu.c
  EXPORT_SYMBOL_GPL(pcpu_base_addr);
  
  static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
-diff -urNp linux-2.6.38.2/mm/rmap.c linux-2.6.38.2/mm/rmap.c
---- linux-2.6.38.2/mm/rmap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/rmap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/rmap.c linux-2.6.38.7/mm/rmap.c
+--- linux-2.6.38.7/mm/rmap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/rmap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -117,6 +117,10 @@ int anon_vma_prepare(struct vm_area_stru
  	struct anon_vma *anon_vma = vma->anon_vma;
  	struct anon_vma_chain *avc;
@@ -55257,9 +65345,9 @@ diff -urNp linux-2.6.38.2/mm/rmap.c linux-2.6.38.2/mm/rmap.c
  {
  	struct anon_vma_chain *avc;
  	struct anon_vma *anon_vma;
-diff -urNp linux-2.6.38.2/mm/shmem.c linux-2.6.38.2/mm/shmem.c
---- linux-2.6.38.2/mm/shmem.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/mm/shmem.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/shmem.c linux-2.6.38.7/mm/shmem.c
+--- linux-2.6.38.7/mm/shmem.c	2011-05-22 23:05:20.000000000 -0400
++++ linux-2.6.38.7/mm/shmem.c	2011-05-22 23:06:04.000000000 -0400
 @@ -31,7 +31,7 @@
  #include <linux/percpu_counter.h>
  #include <linux/swap.h>
@@ -55269,7 +65357,7 @@ diff -urNp linux-2.6.38.2/mm/shmem.c linux-2.6.38.2/mm/shmem.c
  
  #ifdef CONFIG_SHMEM
  /*
-@@ -1070,6 +1070,8 @@ static int shmem_writepage(struct page *
+@@ -1088,6 +1088,8 @@ static int shmem_writepage(struct page *
  		goto unlock;
  	}
  	entry = shmem_swp_entry(info, index, NULL);
@@ -55278,9 +65366,55 @@ diff -urNp linux-2.6.38.2/mm/shmem.c linux-2.6.38.2/mm/shmem.c
  	if (entry->val) {
  		/*
  		 * The more uptodate page coming down from a stacked
-diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
---- linux-2.6.38.2/mm/slab.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/mm/slab.c	2011-03-28 17:42:53.000000000 -0400
+@@ -1160,6 +1162,8 @@ static struct page *shmem_swapin(swp_ent
+ 	struct vm_area_struct pvma;
+ 	struct page *page;
+ 
++	pax_track_stack();
++
+ 	spol = mpol_cond_copy(&mpol,
+ 				mpol_shared_policy_lookup(&info->policy, idx));
+ 
+@@ -2015,7 +2019,7 @@ static int shmem_symlink(struct inode *d
+ 
+ 	info = SHMEM_I(inode);
+ 	inode->i_size = len-1;
+-	if (len <= (char *)inode - (char *)info) {
++	if (len <= (char *)inode - (char *)info && len <= 64) {
+ 		/* do it inline */
+ 		memcpy(info, symname, len);
+ 		inode->i_op = &shmem_symlink_inline_operations;
+@@ -2361,8 +2365,7 @@ int shmem_fill_super(struct super_block 
+ 	int err = -ENOMEM;
+ 
+ 	/* Round up to L1_CACHE_BYTES to resist false sharing */
+-	sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
+-				L1_CACHE_BYTES), GFP_KERNEL);
++	sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
+ 	if (!sbinfo)
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.38.7/mm/slab.c linux-2.6.38.7/mm/slab.c
+--- linux-2.6.38.7/mm/slab.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/mm/slab.c	2011-04-28 19:57:25.000000000 -0400
+@@ -150,7 +150,7 @@
+ 
+ /* Legal flag mask for kmem_cache_create(). */
+ #if DEBUG
+-# define CREATE_MASK	(SLAB_RED_ZONE | \
++# define CREATE_MASK	(SLAB_USERCOPY | SLAB_RED_ZONE | \
+ 			 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
+ 			 SLAB_CACHE_DMA | \
+ 			 SLAB_STORE_USER | \
+@@ -158,7 +158,7 @@
+ 			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
+ 			 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
+ #else
+-# define CREATE_MASK	(SLAB_HWCACHE_ALIGN | \
++# define CREATE_MASK	(SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
+ 			 SLAB_CACHE_DMA | \
+ 			 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
+ 			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
 @@ -284,7 +284,7 @@ struct kmem_list3 {
   * Need this for bootstrapping a per node allocator.
   */
@@ -55290,6 +65424,21 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
  #define	CACHE_CACHE 0
  #define	SIZE_AC MAX_NUMNODES
  #define	SIZE_L3 (2 * MAX_NUMNODES)
+@@ -385,10 +385,10 @@ static void kmem_list3_init(struct kmem_
+ 		if ((x)->max_freeable < i)				\
+ 			(x)->max_freeable = i;				\
+ 	} while (0)
+-#define STATS_INC_ALLOCHIT(x)	atomic_inc(&(x)->allochit)
+-#define STATS_INC_ALLOCMISS(x)	atomic_inc(&(x)->allocmiss)
+-#define STATS_INC_FREEHIT(x)	atomic_inc(&(x)->freehit)
+-#define STATS_INC_FREEMISS(x)	atomic_inc(&(x)->freemiss)
++#define STATS_INC_ALLOCHIT(x)	atomic_inc_unchecked(&(x)->allochit)
++#define STATS_INC_ALLOCMISS(x)	atomic_inc_unchecked(&(x)->allocmiss)
++#define STATS_INC_FREEHIT(x)	atomic_inc_unchecked(&(x)->freehit)
++#define STATS_INC_FREEMISS(x)	atomic_inc_unchecked(&(x)->freemiss)
+ #else
+ #define	STATS_INC_ACTIVE(x)	do { } while (0)
+ #define	STATS_DEC_ACTIVE(x)	do { } while (0)
 @@ -534,7 +534,7 @@ static inline void *index_to_obj(struct 
   *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
   */
@@ -55299,24 +65448,57 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
  {
  	u32 offset = (obj - slab->s_mem);
  	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
-@@ -560,14 +560,14 @@ struct cache_names {
+@@ -560,7 +560,7 @@ struct cache_names {
  static struct cache_names __initdata cache_names[] = {
  #define CACHE(x) { .name = "size-" #x, .name_dma = "size-" #x "(DMA)" },
  #include <linux/kmalloc_sizes.h>
 -	{NULL,}
-+	{NULL, NULL}
++	{NULL}
  #undef CACHE
  };
  
- static struct arraycache_init initarray_cache __initdata =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
- static struct arraycache_init initarray_generic =
--    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0} };
-+    { {0, BOOT_CPUCACHE_ENTRIES, 1, 0}, {NULL} };
+@@ -1526,7 +1526,7 @@ void __init kmem_cache_init(void)
+ 	sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
+ 					sizes[INDEX_AC].cs_size,
+ 					ARCH_KMALLOC_MINALIGN,
+-					ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++					ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ 					NULL);
+ 
+ 	if (INDEX_AC != INDEX_L3) {
+@@ -1534,7 +1534,7 @@ void __init kmem_cache_init(void)
+ 			kmem_cache_create(names[INDEX_L3].name,
+ 				sizes[INDEX_L3].cs_size,
+ 				ARCH_KMALLOC_MINALIGN,
+-				ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++				ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ 				NULL);
+ 	}
  
- /* internal cache of cache description objs */
- static struct kmem_cache cache_cache = {
+@@ -1552,7 +1552,7 @@ void __init kmem_cache_init(void)
+ 			sizes->cs_cachep = kmem_cache_create(names->name,
+ 					sizes->cs_size,
+ 					ARCH_KMALLOC_MINALIGN,
+-					ARCH_KMALLOC_FLAGS|SLAB_PANIC,
++					ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
+ 					NULL);
+ 		}
+ #ifdef CONFIG_ZONE_DMA
+@@ -4275,10 +4275,10 @@ static int s_show(struct seq_file *m, vo
+ 	}
+ 	/* cpu stats */
+ 	{
+-		unsigned long allochit = atomic_read(&cachep->allochit);
+-		unsigned long allocmiss = atomic_read(&cachep->allocmiss);
+-		unsigned long freehit = atomic_read(&cachep->freehit);
+-		unsigned long freemiss = atomic_read(&cachep->freemiss);
++		unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
++		unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
++		unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
++		unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
+ 
+ 		seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
+ 			   allochit, allocmiss, freehit, freemiss);
 @@ -4535,15 +4535,66 @@ static const struct file_operations proc
  
  static int __init slab_proc_init(void)
@@ -55342,9 +65524,9 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
 +{
 +
 +#ifdef CONFIG_PAX_USERCOPY
-+	struct kmem_cache *cachep;
-+	struct slab *slabp;
 +	struct page *page;
++	struct kmem_cache *cachep = NULL;
++	struct slab *slabp;
 +	unsigned int objnr;
 +	unsigned long offset;
 +
@@ -55366,6 +65548,9 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
 +	}
 +
 +	cachep = page_get_cache(page);
++	if (!(cachep->flags & SLAB_USERCOPY))
++		goto report;
++
 +	slabp = page_get_slab(page);
 +	objnr = obj_to_index(cachep, slabp, ptr);
 +	BUG_ON(objnr >= cachep->num);
@@ -55374,10 +65559,7 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
 +		return;
 +
 +report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
++	pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
 +#endif
 +
 +}
@@ -55386,9 +65568,9 @@ diff -urNp linux-2.6.38.2/mm/slab.c linux-2.6.38.2/mm/slab.c
  /**
   * ksize - get the actual amount of memory allocated for a given object
   * @objp: Pointer to the object
-diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
---- linux-2.6.38.2/mm/slob.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/slob.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/slob.c linux-2.6.38.7/mm/slob.c
+--- linux-2.6.38.7/mm/slob.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/slob.c	2011-04-28 19:34:15.000000000 -0400
 @@ -29,7 +29,7 @@
   * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
   * alloc_pages() directly, allocating compound pages so the page order
@@ -55534,7 +65716,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  EXPORT_SYMBOL(__kmalloc_node);
  
  void kfree(const void *block)
-@@ -531,13 +543,84 @@ void kfree(const void *block)
+@@ -531,13 +543,81 @@ void kfree(const void *block)
  	sp = slob_page(block);
  	if (is_slob_page(sp)) {
  		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
@@ -55610,10 +65792,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
 +	}
 +
 +report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
++	pax_report_usercopy(ptr, n, to, NULL);
 +#endif
 +
 +}
@@ -55622,7 +65801,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
  size_t ksize(const void *block)
  {
-@@ -550,10 +633,10 @@ size_t ksize(const void *block)
+@@ -550,10 +630,10 @@ size_t ksize(const void *block)
  	sp = slob_page(block);
  	if (is_slob_page(sp)) {
  		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
@@ -55636,7 +65815,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  }
  EXPORT_SYMBOL(ksize);
  
-@@ -608,17 +691,25 @@ void *kmem_cache_alloc_node(struct kmem_
+@@ -608,17 +688,25 @@ void *kmem_cache_alloc_node(struct kmem_
  {
  	void *b;
  
@@ -55662,7 +65841,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  
  	if (c->ctor)
  		c->ctor(b);
-@@ -630,10 +721,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
+@@ -630,10 +718,16 @@ EXPORT_SYMBOL(kmem_cache_alloc_node);
  
  static void __kmem_cache_free(void *b, int size)
  {
@@ -55681,7 +65860,7 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  }
  
  static void kmem_rcu_free(struct rcu_head *head)
-@@ -646,14 +743,23 @@ static void kmem_rcu_free(struct rcu_hea
+@@ -646,14 +740,23 @@ static void kmem_rcu_free(struct rcu_hea
  
  void kmem_cache_free(struct kmem_cache *c, void *b)
  {
@@ -55708,9 +65887,9 @@ diff -urNp linux-2.6.38.2/mm/slob.c linux-2.6.38.2/mm/slob.c
  	}
  
  	trace_kmem_cache_free(_RET_IP_, b);
-diff -urNp linux-2.6.38.2/mm/slub.c linux-2.6.38.2/mm/slub.c
---- linux-2.6.38.2/mm/slub.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/slub.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/slub.c linux-2.6.38.7/mm/slub.c
+--- linux-2.6.38.7/mm/slub.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/slub.c	2011-04-28 19:34:15.000000000 -0400
 @@ -390,7 +390,7 @@ static void print_track(const char *s, s
  	if (!t->addr)
  		return;
@@ -55766,7 +65945,7 @@ diff -urNp linux-2.6.38.2/mm/slub.c linux-2.6.38.2/mm/slub.c
 +
 +#ifdef CONFIG_PAX_USERCOPY
 +	struct page *page;
-+	struct kmem_cache *s;
++	struct kmem_cache *s = NULL;
 +	unsigned long offset;
 +
 +	if (!n)
@@ -55787,15 +65966,15 @@ diff -urNp linux-2.6.38.2/mm/slub.c linux-2.6.38.2/mm/slub.c
 +	}
 +
 +	s = page->slab;
++	if (!(s->flags & SLAB_USERCOPY))
++		goto report;
++
 +	offset = (ptr - page_address(page)) % s->size;
 +	if (offset <= s->objsize && n <= s->objsize - offset)
 +		return;
 +
 +report:
-+	if (to)
-+		pax_report_leak_to_user(ptr, n);
-+	else
-+		pax_report_overflow_from_user(ptr, n);
++	pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
 +#endif
 +
 +}
@@ -55813,6 +65992,27 @@ diff -urNp linux-2.6.38.2/mm/slub.c linux-2.6.38.2/mm/slub.c
  
  	for_each_node_state(node, N_NORMAL_MEMORY) {
  		struct kmem_cache_node *n = get_node(s, node);
+@@ -3075,17 +3116,17 @@ void __init kmem_cache_init(void)
+ 
+ 	/* Caches that are not of the two-to-the-power-of size */
+ 	if (KMALLOC_MIN_SIZE <= 32) {
+-		kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, 0);
++		kmalloc_caches[1] = create_kmalloc_cache("kmalloc-96", 96, SLAB_USERCOPY);
+ 		caches++;
+ 	}
+ 
+ 	if (KMALLOC_MIN_SIZE <= 64) {
+-		kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, 0);
++		kmalloc_caches[2] = create_kmalloc_cache("kmalloc-192", 192, SLAB_USERCOPY);
+ 		caches++;
+ 	}
+ 
+ 	for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
+-		kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, 0);
++		kmalloc_caches[i] = create_kmalloc_cache("kmalloc", 1 << i, SLAB_USERCOPY);
+ 		caches++;
+ 	}
+ 
 @@ -3153,7 +3194,7 @@ static int slab_unmergeable(struct kmem_
  	/*
  	 * We may have set a slab to be unmergeable during bootstrap.
@@ -55864,9 +66064,59 @@ diff -urNp linux-2.6.38.2/mm/slub.c linux-2.6.38.2/mm/slub.c
  	return 0;
  }
  module_init(slab_proc_init);
-diff -urNp linux-2.6.38.2/mm/util.c linux-2.6.38.2/mm/util.c
---- linux-2.6.38.2/mm/util.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/util.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/swapfile.c linux-2.6.38.7/mm/swapfile.c
+--- linux-2.6.38.7/mm/swapfile.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/mm/swapfile.c	2011-04-28 19:57:25.000000000 -0400
+@@ -61,7 +61,7 @@ static DEFINE_MUTEX(swapon_mutex);
+ 
+ static DECLARE_WAIT_QUEUE_HEAD(proc_poll_wait);
+ /* Activity counter to indicate that a swapon or swapoff has occurred */
+-static atomic_t proc_poll_event = ATOMIC_INIT(0);
++static atomic_unchecked_t proc_poll_event = ATOMIC_INIT(0);
+ 
+ static inline unsigned char swap_count(unsigned char ent)
+ {
+@@ -1687,7 +1687,7 @@ SYSCALL_DEFINE1(swapoff, const char __us
+ 	}
+ 	filp_close(swap_file, NULL);
+ 	err = 0;
+-	atomic_inc(&proc_poll_event);
++	atomic_inc_unchecked(&proc_poll_event);
+ 	wake_up_interruptible(&proc_poll_wait);
+ 
+ out_dput:
+@@ -1708,8 +1708,8 @@ static unsigned swaps_poll(struct file *
+ 
+ 	poll_wait(file, &proc_poll_wait, wait);
+ 
+-	if (s->event != atomic_read(&proc_poll_event)) {
+-		s->event = atomic_read(&proc_poll_event);
++	if (s->event != atomic_read_unchecked(&proc_poll_event)) {
++		s->event = atomic_read_unchecked(&proc_poll_event);
+ 		return POLLIN | POLLRDNORM | POLLERR | POLLPRI;
+ 	}
+ 
+@@ -1815,7 +1815,7 @@ static int swaps_open(struct inode *inod
+ 	}
+ 
+ 	s->seq.private = s;
+-	s->event = atomic_read(&proc_poll_event);
++	s->event = atomic_read_unchecked(&proc_poll_event);
+ 	return ret;
+ }
+ 
+@@ -2131,7 +2131,7 @@ SYSCALL_DEFINE2(swapon, const char __use
+ 		swap_info[prev]->next = type;
+ 	spin_unlock(&swap_lock);
+ 	mutex_unlock(&swapon_mutex);
+-	atomic_inc(&proc_poll_event);
++	atomic_inc_unchecked(&proc_poll_event);
+ 	wake_up_interruptible(&proc_poll_wait);
+ 
+ 	error = 0;
+diff -urNp linux-2.6.38.7/mm/util.c linux-2.6.38.7/mm/util.c
+--- linux-2.6.38.7/mm/util.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/util.c	2011-04-28 19:34:15.000000000 -0400
 @@ -219,6 +219,12 @@ EXPORT_SYMBOL(strndup_user);
  void arch_pick_mmap_layout(struct mm_struct *mm)
  {
@@ -55880,9 +66130,9 @@ diff -urNp linux-2.6.38.2/mm/util.c linux-2.6.38.2/mm/util.c
  	mm->get_unmapped_area = arch_get_unmapped_area;
  	mm->unmap_area = arch_unmap_area;
  }
-diff -urNp linux-2.6.38.2/mm/vmalloc.c linux-2.6.38.2/mm/vmalloc.c
---- linux-2.6.38.2/mm/vmalloc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/vmalloc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/vmalloc.c linux-2.6.38.7/mm/vmalloc.c
+--- linux-2.6.38.7/mm/vmalloc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/vmalloc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -39,8 +39,19 @@ static void vunmap_pte_range(pmd_t *pmd,
  
  	pte = pte_offset_kernel(pmd, addr);
@@ -56115,9 +66365,9 @@ diff -urNp linux-2.6.38.2/mm/vmalloc.c linux-2.6.38.2/mm/vmalloc.c
  	if ((PAGE_SIZE-1) & (unsigned long)addr)
  		return -EINVAL;
  
-diff -urNp linux-2.6.38.2/mm/vmstat.c linux-2.6.38.2/mm/vmstat.c
---- linux-2.6.38.2/mm/vmstat.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/mm/vmstat.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/mm/vmstat.c linux-2.6.38.7/mm/vmstat.c
+--- linux-2.6.38.7/mm/vmstat.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/mm/vmstat.c	2011-04-28 19:34:15.000000000 -0400
 @@ -78,7 +78,7 @@ void vm_events_fold_cpu(int cpu)
   *
   * vm_stat contains the global counters
@@ -56170,9 +66420,9 @@ diff -urNp linux-2.6.38.2/mm/vmstat.c linux-2.6.38.2/mm/vmstat.c
  #endif
  	return 0;
  }
-diff -urNp linux-2.6.38.2/net/8021q/vlan.c linux-2.6.38.2/net/8021q/vlan.c
---- linux-2.6.38.2/net/8021q/vlan.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/8021q/vlan.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/8021q/vlan.c linux-2.6.38.7/net/8021q/vlan.c
+--- linux-2.6.38.7/net/8021q/vlan.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/8021q/vlan.c	2011-04-28 19:34:15.000000000 -0400
 @@ -589,8 +589,7 @@ static int vlan_ioctl_handler(struct net
  		err = -EPERM;
  		if (!capable(CAP_NET_ADMIN))
@@ -56183,9 +66433,9 @@ diff -urNp linux-2.6.38.2/net/8021q/vlan.c linux-2.6.38.2/net/8021q/vlan.c
  			struct vlan_net *vn;
  
  			vn = net_generic(net, vlan_net_id);
-diff -urNp linux-2.6.38.2/net/atm/atm_misc.c linux-2.6.38.2/net/atm/atm_misc.c
---- linux-2.6.38.2/net/atm/atm_misc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/atm/atm_misc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/atm/atm_misc.c linux-2.6.38.7/net/atm/atm_misc.c
+--- linux-2.6.38.7/net/atm/atm_misc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/atm/atm_misc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -17,7 +17,7 @@ int atm_charge(struct atm_vcc *vcc, int 
  	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
  		return 1;
@@ -56222,9 +66472,21 @@ diff -urNp linux-2.6.38.2/net/atm/atm_misc.c linux-2.6.38.2/net/atm/atm_misc.c
  	__SONET_ITEMS
  #undef __HANDLE_ITEM
  }
-diff -urNp linux-2.6.38.2/net/atm/proc.c linux-2.6.38.2/net/atm/proc.c
---- linux-2.6.38.2/net/atm/proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/atm/proc.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/atm/mpoa_caches.c linux-2.6.38.7/net/atm/mpoa_caches.c
+--- linux-2.6.38.7/net/atm/mpoa_caches.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/atm/mpoa_caches.c	2011-05-16 21:47:09.000000000 -0400
+@@ -255,6 +255,8 @@ static void check_resolving_entries(stru
+ 	struct timeval now;
+ 	struct k_message msg;
+ 
++	pax_track_stack();
++
+ 	do_gettimeofday(&now);
+ 
+ 	read_lock_bh(&client->ingress_lock);
+diff -urNp linux-2.6.38.7/net/atm/proc.c linux-2.6.38.7/net/atm/proc.c
+--- linux-2.6.38.7/net/atm/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/atm/proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -45,9 +45,9 @@ static void add_stats(struct seq_file *s
    const struct k_atm_aal_stats *stats)
  {
@@ -56263,9 +66525,9 @@ diff -urNp linux-2.6.38.2/net/atm/proc.c linux-2.6.38.2/net/atm/proc.c
  	else
  		seq_printf(seq, "%3d %3d %5d         ",
  			   vcc->dev->number, vcc->vpi, vcc->vci);
-diff -urNp linux-2.6.38.2/net/atm/resources.c linux-2.6.38.2/net/atm/resources.c
---- linux-2.6.38.2/net/atm/resources.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/atm/resources.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/atm/resources.c linux-2.6.38.7/net/atm/resources.c
+--- linux-2.6.38.7/net/atm/resources.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/atm/resources.c	2011-04-28 19:34:15.000000000 -0400
 @@ -160,7 +160,7 @@ EXPORT_SYMBOL(atm_dev_deregister);
  static void copy_aal_stats(struct k_atm_aal_stats *from,
      struct atm_aal_stats *to)
@@ -56284,31 +66546,115 @@ diff -urNp linux-2.6.38.2/net/atm/resources.c linux-2.6.38.2/net/atm/resources.c
  	__AAL_STAT_ITEMS
  #undef __HANDLE_ITEM
  }
-diff -urNp linux-2.6.38.2/net/bluetooth/bnep/sock.c linux-2.6.38.2/net/bluetooth/bnep/sock.c
---- linux-2.6.38.2/net/bluetooth/bnep/sock.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/bluetooth/bnep/sock.c	2011-03-21 18:31:35.000000000 -0400
-@@ -88,6 +88,7 @@ static int bnep_sock_ioctl(struct socket
- 			sockfd_put(nsock);
- 			return -EBADFD;
- 		}
-+		ca.device[sizeof(ca.device)-1] = 0;
- 
- 		err = bnep_add_connection(&ca, nsock);
- 		if (!err) {
-diff -urNp linux-2.6.38.2/net/bluetooth/sco.c linux-2.6.38.2/net/bluetooth/sco.c
---- linux-2.6.38.2/net/bluetooth/sco.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/bluetooth/sco.c	2011-03-21 18:31:35.000000000 -0400
-@@ -703,6 +703,7 @@ static int sco_sock_getsockopt_old(struc
- 			break;
- 		}
+diff -urNp linux-2.6.38.7/net/batman-adv/hard-interface.c linux-2.6.38.7/net/batman-adv/hard-interface.c
+--- linux-2.6.38.7/net/batman-adv/hard-interface.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/hard-interface.c	2011-04-28 19:57:25.000000000 -0400
+@@ -325,8 +325,8 @@ int hardif_enable_interface(struct batma
+ 	kref_get(&batman_if->refcount);
+ 	dev_add_pack(&batman_if->batman_adv_ptype);
+ 
+-	atomic_set(&batman_if->seqno, 1);
+-	atomic_set(&batman_if->frag_seqno, 1);
++	atomic_set_unchecked(&batman_if->seqno, 1);
++	atomic_set_unchecked(&batman_if->frag_seqno, 1);
+ 	bat_info(batman_if->soft_iface, "Adding interface: %s\n",
+ 		 batman_if->net_dev->name);
+ 
+diff -urNp linux-2.6.38.7/net/batman-adv/routing.c linux-2.6.38.7/net/batman-adv/routing.c
+--- linux-2.6.38.7/net/batman-adv/routing.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/routing.c	2011-04-28 19:57:25.000000000 -0400
+@@ -569,7 +569,7 @@ void receive_bat_packet(struct ethhdr *e
+ 		return;
+ 
+ 	/* could be changed by schedule_own_packet() */
+-	if_incoming_seqno = atomic_read(&if_incoming->seqno);
++	if_incoming_seqno = atomic_read_unchecked(&if_incoming->seqno);
+ 
+ 	has_directlink_flag = (batman_packet->flags & DIRECTLINK ? 1 : 0);
  
-+		memset(&cinfo, 0, sizeof(cinfo));
- 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
- 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
+diff -urNp linux-2.6.38.7/net/batman-adv/send.c linux-2.6.38.7/net/batman-adv/send.c
+--- linux-2.6.38.7/net/batman-adv/send.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/send.c	2011-04-28 19:57:25.000000000 -0400
+@@ -277,7 +277,7 @@ void schedule_own_packet(struct batman_i
  
-diff -urNp linux-2.6.38.2/net/bridge/br_multicast.c linux-2.6.38.2/net/bridge/br_multicast.c
---- linux-2.6.38.2/net/bridge/br_multicast.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/bridge/br_multicast.c	2011-03-21 18:31:35.000000000 -0400
+ 	/* change sequence number to network order */
+ 	batman_packet->seqno =
+-		htonl((uint32_t)atomic_read(&batman_if->seqno));
++		htonl((uint32_t)atomic_read_unchecked(&batman_if->seqno));
+ 
+ 	if (vis_server == VIS_TYPE_SERVER_SYNC)
+ 		batman_packet->flags |= VIS_SERVER;
+@@ -291,7 +291,7 @@ void schedule_own_packet(struct batman_i
+ 	else
+ 		batman_packet->gw_flags = 0;
+ 
+-	atomic_inc(&batman_if->seqno);
++	atomic_inc_unchecked(&batman_if->seqno);
+ 
+ 	slide_own_bcast_window(batman_if);
+ 	send_time = own_send_time(bat_priv);
+diff -urNp linux-2.6.38.7/net/batman-adv/soft-interface.c linux-2.6.38.7/net/batman-adv/soft-interface.c
+--- linux-2.6.38.7/net/batman-adv/soft-interface.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/soft-interface.c	2011-04-28 19:57:25.000000000 -0400
+@@ -410,7 +410,7 @@ int interface_tx(struct sk_buff *skb, st
+ 
+ 		/* set broadcast sequence number */
+ 		bcast_packet->seqno =
+-			htonl(atomic_inc_return(&bat_priv->bcast_seqno));
++			htonl(atomic_inc_return_unchecked(&bat_priv->bcast_seqno));
+ 
+ 		add_bcast_packet_to_list(bat_priv, skb);
+ 
+@@ -603,7 +603,7 @@ struct net_device *softif_create(char *n
+ 	atomic_set(&bat_priv->batman_queue_left, BATMAN_QUEUE_LEN);
+ 
+ 	atomic_set(&bat_priv->mesh_state, MESH_INACTIVE);
+-	atomic_set(&bat_priv->bcast_seqno, 1);
++	atomic_set_unchecked(&bat_priv->bcast_seqno, 1);
+ 	atomic_set(&bat_priv->hna_local_changed, 0);
+ 
+ 	bat_priv->primary_if = NULL;
+diff -urNp linux-2.6.38.7/net/batman-adv/types.h linux-2.6.38.7/net/batman-adv/types.h
+--- linux-2.6.38.7/net/batman-adv/types.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/types.h	2011-04-28 19:57:25.000000000 -0400
+@@ -38,8 +38,8 @@ struct batman_if {
+ 	int16_t if_num;
+ 	char if_status;
+ 	struct net_device *net_dev;
+-	atomic_t seqno;
+-	atomic_t frag_seqno;
++	atomic_unchecked_t seqno;
++	atomic_unchecked_t frag_seqno;
+ 	unsigned char *packet_buff;
+ 	int packet_len;
+ 	struct kobject *hardif_obj;
+@@ -133,7 +133,7 @@ struct bat_priv {
+ 	atomic_t orig_interval;		/* uint */
+ 	atomic_t hop_penalty;		/* uint */
+ 	atomic_t log_level;		/* uint */
+-	atomic_t bcast_seqno;
++	atomic_unchecked_t bcast_seqno;
+ 	atomic_t bcast_queue_left;
+ 	atomic_t batman_queue_left;
+ 	char num_ifaces;
+diff -urNp linux-2.6.38.7/net/batman-adv/unicast.c linux-2.6.38.7/net/batman-adv/unicast.c
+--- linux-2.6.38.7/net/batman-adv/unicast.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/batman-adv/unicast.c	2011-04-28 19:57:25.000000000 -0400
+@@ -261,9 +261,9 @@ int frag_send_skb(struct sk_buff *skb, s
+ 	frag1->flags |= UNI_FRAG_HEAD;
+ 	frag2->flags &= ~UNI_FRAG_HEAD;
+ 
+-	frag1->seqno = htons((uint16_t)atomic_inc_return(
++	frag1->seqno = htons((uint16_t)atomic_inc_return_unchecked(
+ 			     &batman_if->frag_seqno));
+-	frag2->seqno = htons((uint16_t)atomic_inc_return(
++	frag2->seqno = htons((uint16_t)atomic_inc_return_unchecked(
+ 			     &batman_if->frag_seqno));
+ 
+ 	send_skb_packet(skb, batman_if, dstaddr);
+diff -urNp linux-2.6.38.7/net/bridge/br_multicast.c linux-2.6.38.7/net/bridge/br_multicast.c
+--- linux-2.6.38.7/net/bridge/br_multicast.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/net/bridge/br_multicast.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1482,7 +1482,7 @@ static int br_multicast_ipv6_rcv(struct 
  	nexthdr = ip6h->nexthdr;
  	offset = ipv6_skip_exthdr(skb, sizeof(*ip6h), &nexthdr);
@@ -56318,19 +66664,10 @@ diff -urNp linux-2.6.38.2/net/bridge/br_multicast.c linux-2.6.38.2/net/bridge/br
  		return 0;
  
  	/* Okay, we found ICMPv6 header */
-diff -urNp linux-2.6.38.2/net/bridge/netfilter/ebtables.c linux-2.6.38.2/net/bridge/netfilter/ebtables.c
---- linux-2.6.38.2/net/bridge/netfilter/ebtables.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/bridge/netfilter/ebtables.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1107,6 +1107,8 @@ static int do_replace(struct net *net, c
- 	if (tmp.num_counters >= INT_MAX / sizeof(struct ebt_counter))
- 		return -ENOMEM;
- 
-+	tmp.name[sizeof(tmp.name)-1] = 0;
-+
- 	countersize = COUNTER_OFFSET(tmp.nentries) * nr_cpu_ids;
- 	newinfo = vmalloc(sizeof(*newinfo) + countersize);
- 	if (!newinfo)
-@@ -1510,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
+diff -urNp linux-2.6.38.7/net/bridge/netfilter/ebtables.c linux-2.6.38.7/net/bridge/netfilter/ebtables.c
+--- linux-2.6.38.7/net/bridge/netfilter/ebtables.c	2011-04-18 17:27:18.000000000 -0400
++++ linux-2.6.38.7/net/bridge/netfilter/ebtables.c	2011-05-16 21:47:08.000000000 -0400
+@@ -1512,7 +1512,7 @@ static int do_ebt_get_ctl(struct sock *s
  			tmp.valid_hooks = t->table->valid_hooks;
  		}
  		mutex_unlock(&ebt_mutex);
@@ -56339,9 +66676,188 @@ diff -urNp linux-2.6.38.2/net/bridge/netfilter/ebtables.c linux-2.6.38.2/net/bri
  			BUGPRINT("c2u Didn't work\n");
  			ret = -EFAULT;
  			break;
-diff -urNp linux-2.6.38.2/net/can/bcm.c linux-2.6.38.2/net/can/bcm.c
---- linux-2.6.38.2/net/can/bcm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/can/bcm.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1779,6 +1779,8 @@ static int compat_copy_everything_to_use
+ 	int ret;
+ 	void __user *pos;
+ 
++	pax_track_stack();
++
+ 	memset(&tinfo, 0, sizeof(tinfo));
+ 
+ 	if (cmd == EBT_SO_GET_ENTRIES) {
+diff -urNp linux-2.6.38.7/net/caif/caif_socket.c linux-2.6.38.7/net/caif/caif_socket.c
+--- linux-2.6.38.7/net/caif/caif_socket.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/caif/caif_socket.c	2011-04-28 19:57:25.000000000 -0400
+@@ -48,18 +48,19 @@ static struct dentry *debugfsdir;
+ #ifdef CONFIG_DEBUG_FS
+ struct debug_fs_counter {
+ 	atomic_t caif_nr_socks;
+-	atomic_t num_connect_req;
+-	atomic_t num_connect_resp;
+-	atomic_t num_connect_fail_resp;
+-	atomic_t num_disconnect;
+-	atomic_t num_remote_shutdown_ind;
+-	atomic_t num_tx_flow_off_ind;
+-	atomic_t num_tx_flow_on_ind;
+-	atomic_t num_rx_flow_off;
+-	atomic_t num_rx_flow_on;
++	atomic_unchecked_t num_connect_req;
++	atomic_unchecked_t num_connect_resp;
++	atomic_unchecked_t num_connect_fail_resp;
++	atomic_unchecked_t num_disconnect;
++	atomic_unchecked_t num_remote_shutdown_ind;
++	atomic_unchecked_t num_tx_flow_off_ind;
++	atomic_unchecked_t num_tx_flow_on_ind;
++	atomic_unchecked_t num_rx_flow_off;
++	atomic_unchecked_t num_rx_flow_on;
+ };
+ static struct debug_fs_counter cnt;
+ #define	dbfs_atomic_inc(v) atomic_inc(v)
++#define	dbfs_atomic_inc_unchecked(v) atomic_inc_unchecked(v)
+ #define	dbfs_atomic_dec(v) atomic_dec(v)
+ #else
+ #define	dbfs_atomic_inc(v)
+@@ -159,7 +160,7 @@ static int caif_queue_rcv_skb(struct soc
+ 			atomic_read(&cf_sk->sk.sk_rmem_alloc),
+ 			sk_rcvbuf_lowwater(cf_sk));
+ 		set_rx_flow_off(cf_sk);
+-		dbfs_atomic_inc(&cnt.num_rx_flow_off);
++		dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
+ 		caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
+ 	}
+ 
+@@ -169,7 +170,7 @@ static int caif_queue_rcv_skb(struct soc
+ 	if (!sk_rmem_schedule(sk, skb->truesize) && rx_flow_is_on(cf_sk)) {
+ 		set_rx_flow_off(cf_sk);
+ 		pr_debug("sending flow OFF due to rmem_schedule\n");
+-		dbfs_atomic_inc(&cnt.num_rx_flow_off);
++		dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_off);
+ 		caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_OFF_REQ);
+ 	}
+ 	skb->dev = NULL;
+@@ -218,21 +219,21 @@ static void caif_ctrl_cb(struct cflayer 
+ 	switch (flow) {
+ 	case CAIF_CTRLCMD_FLOW_ON_IND:
+ 		/* OK from modem to start sending again */
+-		dbfs_atomic_inc(&cnt.num_tx_flow_on_ind);
++		dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_on_ind);
+ 		set_tx_flow_on(cf_sk);
+ 		cf_sk->sk.sk_state_change(&cf_sk->sk);
+ 		break;
+ 
+ 	case CAIF_CTRLCMD_FLOW_OFF_IND:
+ 		/* Modem asks us to shut up */
+-		dbfs_atomic_inc(&cnt.num_tx_flow_off_ind);
++		dbfs_atomic_inc_unchecked(&cnt.num_tx_flow_off_ind);
+ 		set_tx_flow_off(cf_sk);
+ 		cf_sk->sk.sk_state_change(&cf_sk->sk);
+ 		break;
+ 
+ 	case CAIF_CTRLCMD_INIT_RSP:
+ 		/* We're now connected */
+-		dbfs_atomic_inc(&cnt.num_connect_resp);
++		dbfs_atomic_inc_unchecked(&cnt.num_connect_resp);
+ 		cf_sk->sk.sk_state = CAIF_CONNECTED;
+ 		set_tx_flow_on(cf_sk);
+ 		cf_sk->sk.sk_state_change(&cf_sk->sk);
+@@ -247,7 +248,7 @@ static void caif_ctrl_cb(struct cflayer 
+ 
+ 	case CAIF_CTRLCMD_INIT_FAIL_RSP:
+ 		/* Connect request failed */
+-		dbfs_atomic_inc(&cnt.num_connect_fail_resp);
++		dbfs_atomic_inc_unchecked(&cnt.num_connect_fail_resp);
+ 		cf_sk->sk.sk_err = ECONNREFUSED;
+ 		cf_sk->sk.sk_state = CAIF_DISCONNECTED;
+ 		cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
+@@ -261,7 +262,7 @@ static void caif_ctrl_cb(struct cflayer 
+ 
+ 	case CAIF_CTRLCMD_REMOTE_SHUTDOWN_IND:
+ 		/* Modem has closed this connection, or device is down. */
+-		dbfs_atomic_inc(&cnt.num_remote_shutdown_ind);
++		dbfs_atomic_inc_unchecked(&cnt.num_remote_shutdown_ind);
+ 		cf_sk->sk.sk_shutdown = SHUTDOWN_MASK;
+ 		cf_sk->sk.sk_err = ECONNRESET;
+ 		set_rx_flow_on(cf_sk);
+@@ -281,7 +282,7 @@ static void caif_check_flow_release(stru
+ 		return;
+ 
+ 	if (atomic_read(&sk->sk_rmem_alloc) <= sk_rcvbuf_lowwater(cf_sk)) {
+-			dbfs_atomic_inc(&cnt.num_rx_flow_on);
++			dbfs_atomic_inc_unchecked(&cnt.num_rx_flow_on);
+ 			set_rx_flow_on(cf_sk);
+ 			caif_flow_ctrl(sk, CAIF_MODEMCMD_FLOW_ON_REQ);
+ 	}
+@@ -864,7 +865,7 @@ static int caif_connect(struct socket *s
+ 	/*ifindex = id of the interface.*/
+ 	cf_sk->conn_req.ifindex = cf_sk->sk.sk_bound_dev_if;
+ 
+-	dbfs_atomic_inc(&cnt.num_connect_req);
++	dbfs_atomic_inc_unchecked(&cnt.num_connect_req);
+ 	cf_sk->layer.receive = caif_sktrecv_cb;
+ 	err = caif_connect_client(&cf_sk->conn_req,
+ 				&cf_sk->layer, &ifindex, &headroom, &tailroom);
+@@ -952,7 +953,7 @@ static int caif_release(struct socket *s
+ 	spin_unlock(&sk->sk_receive_queue.lock);
+ 	sock->sk = NULL;
+ 
+-	dbfs_atomic_inc(&cnt.num_disconnect);
++	dbfs_atomic_inc_unchecked(&cnt.num_disconnect);
+ 
+ 	if (cf_sk->debugfs_socket_dir != NULL)
+ 		debugfs_remove_recursive(cf_sk->debugfs_socket_dir);
+diff -urNp linux-2.6.38.7/net/caif/cfctrl.c linux-2.6.38.7/net/caif/cfctrl.c
+--- linux-2.6.38.7/net/caif/cfctrl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/caif/cfctrl.c	2011-05-16 21:47:08.000000000 -0400
+@@ -9,6 +9,7 @@
+ #include <linux/stddef.h>
+ #include <linux/spinlock.h>
+ #include <linux/slab.h>
++#include <linux/sched.h>
+ #include <net/caif/caif_layer.h>
+ #include <net/caif/cfpkt.h>
+ #include <net/caif/cfctrl.h>
+@@ -46,8 +47,8 @@ struct cflayer *cfctrl_create(void)
+ 	dev_info.id = 0xff;
+ 	memset(this, 0, sizeof(*this));
+ 	cfsrvl_init(&this->serv, 0, &dev_info, false);
+-	atomic_set(&this->req_seq_no, 1);
+-	atomic_set(&this->rsp_seq_no, 1);
++	atomic_set_unchecked(&this->req_seq_no, 1);
++	atomic_set_unchecked(&this->rsp_seq_no, 1);
+ 	this->serv.layer.receive = cfctrl_recv;
+ 	sprintf(this->serv.layer.name, "ctrl");
+ 	this->serv.layer.ctrlcmd = cfctrl_ctrlcmd;
+@@ -116,8 +117,8 @@ void cfctrl_insert_req(struct cfctrl *ct
+ 			      struct cfctrl_request_info *req)
+ {
+ 	spin_lock(&ctrl->info_list_lock);
+-	atomic_inc(&ctrl->req_seq_no);
+-	req->sequence_no = atomic_read(&ctrl->req_seq_no);
++	atomic_inc_unchecked(&ctrl->req_seq_no);
++	req->sequence_no = atomic_read_unchecked(&ctrl->req_seq_no);
+ 	list_add_tail(&req->list, &ctrl->list);
+ 	spin_unlock(&ctrl->info_list_lock);
+ }
+@@ -136,7 +137,7 @@ struct cfctrl_request_info *cfctrl_remov
+ 			if (p != first)
+ 				pr_warn("Requests are not received in order\n");
+ 
+-			atomic_set(&ctrl->rsp_seq_no,
++			atomic_set_unchecked(&ctrl->rsp_seq_no,
+ 					 p->sequence_no);
+ 			list_del(&p->list);
+ 			goto out;
+@@ -385,6 +386,7 @@ static int cfctrl_recv(struct cflayer *l
+ 	struct cfctrl *cfctrl = container_obj(layer);
+ 	struct cfctrl_request_info rsp, *req;
+ 
++	pax_track_stack();
+ 
+ 	cfpkt_extr_head(pkt, &cmdrsp, 1);
+ 	cmd = cmdrsp & CFCTRL_CMD_MASK;
+diff -urNp linux-2.6.38.7/net/can/bcm.c linux-2.6.38.7/net/can/bcm.c
+--- linux-2.6.38.7/net/can/bcm.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/net/can/bcm.c	2011-05-10 22:09:01.000000000 -0400
 @@ -165,9 +165,15 @@ static int bcm_proc_show(struct seq_file
  	struct bcm_sock *bo = bcm_sk(sk);
  	struct bcm_op *op;
@@ -56358,19 +66874,37 @@ diff -urNp linux-2.6.38.2/net/can/bcm.c linux-2.6.38.2/net/can/bcm.c
  	seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
  	seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
  	seq_printf(m, " <<<\n");
-diff -urNp linux-2.6.38.2/net/core/dev.c linux-2.6.38.2/net/core/dev.c
---- linux-2.6.38.2/net/core/dev.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/core/dev.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1124,7 +1124,7 @@ void dev_load(struct net *net, const cha
+diff -urNp linux-2.6.38.7/net/core/datagram.c linux-2.6.38.7/net/core/datagram.c
+--- linux-2.6.38.7/net/core/datagram.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/core/datagram.c	2011-04-28 19:57:25.000000000 -0400
+@@ -285,7 +285,7 @@ int skb_kill_datagram(struct sock *sk, s
+ 	}
+ 
+ 	kfree_skb(skb);
+-	atomic_inc(&sk->sk_drops);
++	atomic_inc_unchecked(&sk->sk_drops);
+ 	sk_mem_reclaim_partial(sk);
+ 
+ 	return err;
+diff -urNp linux-2.6.38.7/net/core/dev.c linux-2.6.38.7/net/core/dev.c
+--- linux-2.6.38.7/net/core/dev.c	2011-05-22 23:05:21.000000000 -0400
++++ linux-2.6.38.7/net/core/dev.c	2011-05-22 23:06:04.000000000 -0400
+@@ -1124,10 +1124,14 @@ void dev_load(struct net *net, const cha
  	if (no_module && capable(CAP_NET_ADMIN))
  		no_module = request_module("netdev-%s", name);
  	if (no_module && capable(CAP_SYS_MODULE)) {
--		if (!request_module("%s", name))
-+		if (!request_module("%s", name))  
++#ifdef CONFIG_GRKERNSEC_MODHARDEN
++		___request_module(true, "grsec_modharden_netdev", "%s", name);
++#else
+ 		if (!request_module("%s", name))
  			pr_err("Loading kernel module for a network device "
  "with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s "
  "instead\n", name);
-@@ -2787,7 +2787,7 @@ int netif_rx_ni(struct sk_buff *skb)
++#endif
+ 	}
+ }
+ EXPORT_SYMBOL(dev_load);
+@@ -2789,7 +2793,7 @@ int netif_rx_ni(struct sk_buff *skb)
  }
  EXPORT_SYMBOL(netif_rx_ni);
  
@@ -56379,7 +66913,7 @@ diff -urNp linux-2.6.38.2/net/core/dev.c linux-2.6.38.2/net/core/dev.c
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  
-@@ -3697,7 +3697,7 @@ void netif_napi_del(struct napi_struct *
+@@ -3699,7 +3703,7 @@ void netif_napi_del(struct napi_struct *
  }
  EXPORT_SYMBOL(netif_napi_del);
  
@@ -56388,9 +66922,105 @@ diff -urNp linux-2.6.38.2/net/core/dev.c linux-2.6.38.2/net/core/dev.c
  {
  	struct softnet_data *sd = &__get_cpu_var(softnet_data);
  	unsigned long time_limit = jiffies + 2;
-diff -urNp linux-2.6.38.2/net/core/sock.c linux-2.6.38.2/net/core/sock.c
---- linux-2.6.38.2/net/core/sock.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/core/sock.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/core/flow.c linux-2.6.38.7/net/core/flow.c
+--- linux-2.6.38.7/net/core/flow.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/core/flow.c	2011-04-28 19:57:25.000000000 -0400
+@@ -60,7 +60,7 @@ struct flow_cache {
+ 	struct timer_list		rnd_timer;
+ };
+ 
+-atomic_t flow_cache_genid = ATOMIC_INIT(0);
++atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
+ EXPORT_SYMBOL(flow_cache_genid);
+ static struct flow_cache flow_cache_global;
+ static struct kmem_cache *flow_cachep __read_mostly;
+@@ -85,7 +85,7 @@ static void flow_cache_new_hashrnd(unsig
+ 
+ static int flow_entry_valid(struct flow_cache_entry *fle)
+ {
+-	if (atomic_read(&flow_cache_genid) != fle->genid)
++	if (atomic_read_unchecked(&flow_cache_genid) != fle->genid)
+ 		return 0;
+ 	if (fle->object && !fle->object->ops->check(fle->object))
+ 		return 0;
+@@ -253,7 +253,7 @@ flow_cache_lookup(struct net *net, struc
+ 			hlist_add_head(&fle->u.hlist, &fcp->hash_table[hash]);
+ 			fcp->hash_count++;
+ 		}
+-	} else if (likely(fle->genid == atomic_read(&flow_cache_genid))) {
++	} else if (likely(fle->genid == atomic_read_unchecked(&flow_cache_genid))) {
+ 		flo = fle->object;
+ 		if (!flo)
+ 			goto ret_object;
+@@ -274,7 +274,7 @@ nocache:
+ 	}
+ 	flo = resolver(net, key, family, dir, flo, ctx);
+ 	if (fle) {
+-		fle->genid = atomic_read(&flow_cache_genid);
++		fle->genid = atomic_read_unchecked(&flow_cache_genid);
+ 		if (!IS_ERR(flo))
+ 			fle->object = flo;
+ 		else
+diff -urNp linux-2.6.38.7/net/core/skbuff.c linux-2.6.38.7/net/core/skbuff.c
+--- linux-2.6.38.7/net/core/skbuff.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/core/skbuff.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1543,6 +1543,8 @@ int skb_splice_bits(struct sk_buff *skb,
+ 	struct sock *sk = skb->sk;
+ 	int ret = 0;
+ 
++	pax_track_stack();
++
+ 	if (splice_grow_spd(pipe, &spd))
+ 		return -ENOMEM;
+ 
+diff -urNp linux-2.6.38.7/net/core/sock.c linux-2.6.38.7/net/core/sock.c
+--- linux-2.6.38.7/net/core/sock.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/core/sock.c	2011-04-28 19:57:25.000000000 -0400
+@@ -291,7 +291,7 @@ int sock_queue_rcv_skb(struct sock *sk, 
+ 	 */
+ 	if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
+ 	    (unsigned)sk->sk_rcvbuf) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		return -ENOMEM;
+ 	}
+ 
+@@ -300,7 +300,7 @@ int sock_queue_rcv_skb(struct sock *sk, 
+ 		return err;
+ 
+ 	if (!sk_rmem_schedule(sk, skb->truesize)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		return -ENOBUFS;
+ 	}
+ 
+@@ -320,7 +320,7 @@ int sock_queue_rcv_skb(struct sock *sk, 
+ 	skb_dst_force(skb);
+ 
+ 	spin_lock_irqsave(&list->lock, flags);
+-	skb->dropcount = atomic_read(&sk->sk_drops);
++	skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
+ 	__skb_queue_tail(list, skb);
+ 	spin_unlock_irqrestore(&list->lock, flags);
+ 
+@@ -340,7 +340,7 @@ int sk_receive_skb(struct sock *sk, stru
+ 	skb->dev = NULL;
+ 
+ 	if (sk_rcvqueues_full(sk, skb)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		goto discard_and_relse;
+ 	}
+ 	if (nested)
+@@ -358,7 +358,7 @@ int sk_receive_skb(struct sock *sk, stru
+ 		mutex_release(&sk->sk_lock.dep_map, 1, _RET_IP_);
+ 	} else if (sk_add_backlog(sk, skb)) {
+ 		bh_unlock_sock(sk);
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		goto discard_and_relse;
+ 	}
+ 
 @@ -934,7 +934,7 @@ int sock_getsockopt(struct socket *sock,
  			return -ENOTCONN;
  		if (lv < len)
@@ -56409,37 +67039,18 @@ diff -urNp linux-2.6.38.2/net/core/sock.c linux-2.6.38.2/net/core/sock.c
  		return -EFAULT;
  lenout:
  	if (put_user(len, optlen))
-diff -urNp linux-2.6.38.2/net/dccp/ccids/ccid3.c linux-2.6.38.2/net/dccp/ccids/ccid3.c
---- linux-2.6.38.2/net/dccp/ccids/ccid3.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/dccp/ccids/ccid3.c	2011-03-21 18:31:35.000000000 -0400
-@@ -41,7 +41,7 @@
- static int ccid3_debug;
- #define ccid3_pr_debug(format, a...)	DCCP_PR_DEBUG(ccid3_debug, format, ##a)
- #else
--#define ccid3_pr_debug(format, a...)
-+#define ccid3_pr_debug(format, a...) do {} while (0)
- #endif
- 
- /*
-diff -urNp linux-2.6.38.2/net/dccp/dccp.h linux-2.6.38.2/net/dccp/dccp.h
---- linux-2.6.38.2/net/dccp/dccp.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/dccp/dccp.h	2011-03-21 18:31:35.000000000 -0400
-@@ -44,9 +44,9 @@ extern int dccp_debug;
- #define dccp_pr_debug_cat(format, a...)   DCCP_PRINTK(dccp_debug, format, ##a)
- #define dccp_debug(fmt, a...)		  dccp_pr_debug_cat(KERN_DEBUG fmt, ##a)
- #else
--#define dccp_pr_debug(format, a...)
--#define dccp_pr_debug_cat(format, a...)
--#define dccp_debug(format, a...)
-+#define dccp_pr_debug(format, a...) do {} while (0)
-+#define dccp_pr_debug_cat(format, a...) do {} while (0)
-+#define dccp_debug(format, a...) do {} while (0)
- #endif
+@@ -2023,7 +2023,7 @@ void sock_init_data(struct socket *sock,
+ 	 */
+ 	smp_wmb();
+ 	atomic_set(&sk->sk_refcnt, 1);
+-	atomic_set(&sk->sk_drops, 0);
++	atomic_set_unchecked(&sk->sk_drops, 0);
+ }
+ EXPORT_SYMBOL(sock_init_data);
  
- extern struct inet_hashinfo dccp_hashinfo;
-diff -urNp linux-2.6.38.2/net/decnet/sysctl_net_decnet.c linux-2.6.38.2/net/decnet/sysctl_net_decnet.c
---- linux-2.6.38.2/net/decnet/sysctl_net_decnet.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/decnet/sysctl_net_decnet.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/decnet/sysctl_net_decnet.c linux-2.6.38.7/net/decnet/sysctl_net_decnet.c
+--- linux-2.6.38.7/net/decnet/sysctl_net_decnet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/decnet/sysctl_net_decnet.c	2011-04-28 19:34:15.000000000 -0400
 @@ -173,7 +173,7 @@ static int dn_node_address_handler(ctl_t
  
  	if (len > *lenp) len = *lenp;
@@ -56458,9 +67069,9 @@ diff -urNp linux-2.6.38.2/net/decnet/sysctl_net_decnet.c linux-2.6.38.2/net/decn
  		return -EFAULT;
  
  	*lenp = len;
-diff -urNp linux-2.6.38.2/net/econet/Kconfig linux-2.6.38.2/net/econet/Kconfig
---- linux-2.6.38.2/net/econet/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/econet/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/econet/Kconfig linux-2.6.38.7/net/econet/Kconfig
+--- linux-2.6.38.7/net/econet/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/econet/Kconfig	2011-04-28 19:34:15.000000000 -0400
 @@ -4,7 +4,7 @@
  
  config ECONET
@@ -56470,9 +67081,9 @@ diff -urNp linux-2.6.38.2/net/econet/Kconfig linux-2.6.38.2/net/econet/Kconfig
  	---help---
  	  Econet is a fairly old and slow networking protocol mainly used by
  	  Acorn computers to access file and print servers. It uses native
-diff -urNp linux-2.6.38.2/net/ipv4/inet_diag.c linux-2.6.38.2/net/ipv4/inet_diag.c
---- linux-2.6.38.2/net/ipv4/inet_diag.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/inet_diag.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/inet_diag.c linux-2.6.38.7/net/ipv4/inet_diag.c
+--- linux-2.6.38.7/net/ipv4/inet_diag.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/inet_diag.c	2011-04-28 19:34:15.000000000 -0400
 @@ -114,8 +114,14 @@ static int inet_csk_diag_fill(struct soc
  	r->idiag_retrans = 0;
  
@@ -56534,9 +67145,9 @@ diff -urNp linux-2.6.38.2/net/ipv4/inet_diag.c linux-2.6.38.2/net/ipv4/inet_diag
  
  	tmo = req->expires - jiffies;
  	if (tmo < 0)
-diff -urNp linux-2.6.38.2/net/ipv4/inet_hashtables.c linux-2.6.38.2/net/ipv4/inet_hashtables.c
---- linux-2.6.38.2/net/ipv4/inet_hashtables.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/inet_hashtables.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/inet_hashtables.c linux-2.6.38.7/net/ipv4/inet_hashtables.c
+--- linux-2.6.38.7/net/ipv4/inet_hashtables.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/inet_hashtables.c	2011-04-28 19:34:15.000000000 -0400
 @@ -18,11 +18,14 @@
  #include <linux/sched.h>
  #include <linux/slab.h>
@@ -56561,10 +67172,19 @@ diff -urNp linux-2.6.38.2/net/ipv4/inet_hashtables.c linux-2.6.38.2/net/ipv4/ine
  		if (tw) {
  			inet_twsk_deschedule(tw, death_row);
  			while (twrefcnt) {
-diff -urNp linux-2.6.38.2/net/ipv4/inetpeer.c linux-2.6.38.2/net/ipv4/inetpeer.c
---- linux-2.6.38.2/net/ipv4/inetpeer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/inetpeer.c	2011-03-21 18:31:35.000000000 -0400
-@@ -509,8 +509,8 @@ struct inet_peer *inet_getpeer(struct in
+diff -urNp linux-2.6.38.7/net/ipv4/inetpeer.c linux-2.6.38.7/net/ipv4/inetpeer.c
+--- linux-2.6.38.7/net/ipv4/inetpeer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/inetpeer.c	2011-05-16 21:47:08.000000000 -0400
+@@ -478,6 +478,8 @@ struct inet_peer *inet_getpeer(struct in
+ 	struct inet_peer_base *base = family_to_base(daddr->family);
+ 	struct inet_peer *p;
+ 
++	pax_track_stack();
++
+ 	/* Look up for the address quickly, lockless.
+ 	 * Because of a concurrent writer, we might not find an existing entry.
+ 	 */
+@@ -509,8 +511,8 @@ struct inet_peer *inet_getpeer(struct in
  	if (p) {
  		p->daddr = *daddr;
  		atomic_set(&p->refcnt, 1);
@@ -56575,10 +67195,10 @@ diff -urNp linux-2.6.38.2/net/ipv4/inetpeer.c linux-2.6.38.2/net/ipv4/inetpeer.c
  		p->tcp_ts_stamp = 0;
  		INIT_LIST_HEAD(&p->unused);
  
-diff -urNp linux-2.6.38.2/net/ipv4/ip_fragment.c linux-2.6.38.2/net/ipv4/ip_fragment.c
---- linux-2.6.38.2/net/ipv4/ip_fragment.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/ip_fragment.c	2011-03-21 18:31:35.000000000 -0400
-@@ -298,7 +298,7 @@ static inline int ip_frag_too_far(struct
+diff -urNp linux-2.6.38.7/net/ipv4/ip_fragment.c linux-2.6.38.7/net/ipv4/ip_fragment.c
+--- linux-2.6.38.7/net/ipv4/ip_fragment.c	2011-05-22 23:05:21.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/ip_fragment.c	2011-05-22 23:06:04.000000000 -0400
+@@ -297,7 +297,7 @@ static inline int ip_frag_too_far(struct
  		return 0;
  
  	start = qp->rid;
@@ -56587,9 +67207,21 @@ diff -urNp linux-2.6.38.2/net/ipv4/ip_fragment.c linux-2.6.38.2/net/ipv4/ip_frag
  	qp->rid = end;
  
  	rc = qp->q.fragments && (end - start) > max;
-diff -urNp linux-2.6.38.2/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.38.2/net/ipv4/netfilter/nf_nat_snmp_basic.c
---- linux-2.6.38.2/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/ip_sockglue.c linux-2.6.38.7/net/ipv4/ip_sockglue.c
+--- linux-2.6.38.7/net/ipv4/ip_sockglue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/ip_sockglue.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1064,6 +1064,8 @@ static int do_ip_getsockopt(struct sock 
+ 	int val;
+ 	int len;
+ 
++	pax_track_stack();
++
+ 	if (level != SOL_IP)
+ 		return -EOPNOTSUPP;
+ 
+diff -urNp linux-2.6.38.7/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.38.7/net/ipv4/netfilter/nf_nat_snmp_basic.c
+--- linux-2.6.38.7/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-04-28 19:34:15.000000000 -0400
 @@ -398,7 +398,7 @@ static unsigned char asn1_octets_decode(
  
  	*len = 0;
@@ -56599,9 +67231,86 @@ diff -urNp linux-2.6.38.2/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.38.2/
  	if (*octets == NULL) {
  		if (net_ratelimit())
  			pr_notice("OOM in bsalg (%d)\n", __LINE__);
-diff -urNp linux-2.6.38.2/net/ipv4/route.c linux-2.6.38.2/net/ipv4/route.c
---- linux-2.6.38.2/net/ipv4/route.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/route.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/raw.c linux-2.6.38.7/net/ipv4/raw.c
+--- linux-2.6.38.7/net/ipv4/raw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/raw.c	2011-05-04 18:00:09.000000000 -0400
+@@ -302,7 +302,7 @@ static int raw_rcv_skb(struct sock * sk,
+ int raw_rcv(struct sock *sk, struct sk_buff *skb)
+ {
+ 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		kfree_skb(skb);
+ 		return NET_RX_DROP;
+ 	}
+@@ -724,15 +724,19 @@ static int raw_init(struct sock *sk)
+ 
+ static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
+ {
++	struct icmp_filter filter;
++
+ 	if (optlen > sizeof(struct icmp_filter))
+ 		optlen = sizeof(struct icmp_filter);
+-	if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
++	if (copy_from_user(&filter, optval, optlen))
+ 		return -EFAULT;
++	memcpy(&raw_sk(sk)->filter, &filter, sizeof(filter));
+ 	return 0;
+ }
+ 
+ static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
+ {
++	struct icmp_filter filter;
+ 	int len, ret = -EFAULT;
+ 
+ 	if (get_user(len, optlen))
+@@ -743,8 +747,9 @@ static int raw_geticmpfilter(struct sock
+ 	if (len > sizeof(struct icmp_filter))
+ 		len = sizeof(struct icmp_filter);
+ 	ret = -EFAULT;
++	memcpy(&filter, &raw_sk(sk)->filter, len);
+ 	if (put_user(len, optlen) ||
+-	    copy_to_user(optval, &raw_sk(sk)->filter, len))
++	    copy_to_user(optval, &filter, len))
+ 		goto out;
+ 	ret = 0;
+ out:	return ret;
+@@ -972,7 +977,13 @@ static void raw_sock_seq_show(struct seq
+ 		sk_wmem_alloc_get(sp),
+ 		sk_rmem_alloc_get(sp),
+ 		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
+-		atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
++		atomic_read(&sp->sk_refcnt),
++#ifdef CONFIG_GRKERNSEC_HIDESYM
++		NULL,
++#else
++		sp,
++#endif
++		atomic_read_unchecked(&sp->sk_drops));
+ }
+ 
+ static int raw_seq_show(struct seq_file *seq, void *v)
+diff -urNp linux-2.6.38.7/net/ipv4/route.c linux-2.6.38.7/net/ipv4/route.c
+--- linux-2.6.38.7/net/ipv4/route.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/route.c	2011-04-28 19:57:25.000000000 -0400
+@@ -270,7 +270,7 @@ static inline unsigned int rt_hash(__be3
+ 
+ static inline int rt_genid(struct net *net)
+ {
+-	return atomic_read(&net->ipv4.rt_genid);
++	return atomic_read_unchecked(&net->ipv4.rt_genid);
+ }
+ 
+ #ifdef CONFIG_PROC_FS
+@@ -895,7 +895,7 @@ static void rt_cache_invalidate(struct n
+ 	unsigned char shuffle;
+ 
+ 	get_random_bytes(&shuffle, sizeof(shuffle));
+-	atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
++	atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
+ }
+ 
+ /*
 @@ -2857,7 +2857,7 @@ static int rt_fill_info(struct net *net,
  	expires = rt->dst.expires ? rt->dst.expires - jiffies : 0;
  	if (rt->peer) {
@@ -56611,9 +67320,30 @@ diff -urNp linux-2.6.38.2/net/ipv4/route.c linux-2.6.38.2/net/ipv4/route.c
  		if (rt->peer->tcp_ts_stamp) {
  			ts = rt->peer->tcp_ts;
  			tsage = get_seconds() - rt->peer->tcp_ts_stamp;
-diff -urNp linux-2.6.38.2/net/ipv4/tcp_ipv4.c linux-2.6.38.2/net/ipv4/tcp_ipv4.c
---- linux-2.6.38.2/net/ipv4/tcp_ipv4.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/tcp_ipv4.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/tcp.c linux-2.6.38.7/net/ipv4/tcp.c
+--- linux-2.6.38.7/net/ipv4/tcp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp.c	2011-05-16 21:47:09.000000000 -0400
+@@ -2121,6 +2121,8 @@ static int do_tcp_setsockopt(struct sock
+ 	int val;
+ 	int err = 0;
+ 
++	pax_track_stack();
++
+ 	/* These are data/string values, all the others are ints */
+ 	switch (optname) {
+ 	case TCP_CONGESTION: {
+@@ -2500,6 +2502,8 @@ static int do_tcp_getsockopt(struct sock
+ 	struct tcp_sock *tp = tcp_sk(sk);
+ 	int val, len;
+ 
++	pax_track_stack();
++
+ 	if (get_user(len, optlen))
+ 		return -EFAULT;
+ 
+diff -urNp linux-2.6.38.7/net/ipv4/tcp_ipv4.c linux-2.6.38.7/net/ipv4/tcp_ipv4.c
+--- linux-2.6.38.7/net/ipv4/tcp_ipv4.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp_ipv4.c	2011-04-28 19:34:15.000000000 -0400
 @@ -86,6 +86,9 @@ int sysctl_tcp_tw_reuse __read_mostly;
  int sysctl_tcp_low_latency __read_mostly;
  EXPORT_SYMBOL(sysctl_tcp_low_latency);
@@ -56709,9 +67439,9 @@ diff -urNp linux-2.6.38.2/net/ipv4/tcp_ipv4.c linux-2.6.38.2/net/ipv4/tcp_ipv4.c
  }
  
  #define TMPSZ 150
-diff -urNp linux-2.6.38.2/net/ipv4/tcp_minisocks.c linux-2.6.38.2/net/ipv4/tcp_minisocks.c
---- linux-2.6.38.2/net/ipv4/tcp_minisocks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/tcp_minisocks.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/tcp_minisocks.c linux-2.6.38.7/net/ipv4/tcp_minisocks.c
+--- linux-2.6.38.7/net/ipv4/tcp_minisocks.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp_minisocks.c	2011-04-28 19:34:15.000000000 -0400
 @@ -27,6 +27,10 @@
  #include <net/inet_common.h>
  #include <net/xfrm.h>
@@ -56734,9 +67464,21 @@ diff -urNp linux-2.6.38.2/net/ipv4/tcp_minisocks.c linux-2.6.38.2/net/ipv4/tcp_m
  	if (!(flg & TCP_FLAG_RST))
  		req->rsk_ops->send_reset(sk, skb);
  
-diff -urNp linux-2.6.38.2/net/ipv4/tcp_probe.c linux-2.6.38.2/net/ipv4/tcp_probe.c
---- linux-2.6.38.2/net/ipv4/tcp_probe.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/tcp_probe.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/tcp_output.c linux-2.6.38.7/net/ipv4/tcp_output.c
+--- linux-2.6.38.7/net/ipv4/tcp_output.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp_output.c	2011-05-16 21:47:09.000000000 -0400
+@@ -2420,6 +2420,8 @@ struct sk_buff *tcp_make_synack(struct s
+ 	int mss;
+ 	int s_data_desired = 0;
+ 
++	pax_track_stack();
++
+ 	if (cvp != NULL && cvp->s_data_constant && cvp->s_data_desired)
+ 		s_data_desired = cvp->s_data_desired;
+ 	skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15 + s_data_desired, 1, GFP_ATOMIC);
+diff -urNp linux-2.6.38.7/net/ipv4/tcp_probe.c linux-2.6.38.7/net/ipv4/tcp_probe.c
+--- linux-2.6.38.7/net/ipv4/tcp_probe.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp_probe.c	2011-04-28 19:34:15.000000000 -0400
 @@ -202,7 +202,7 @@ static ssize_t tcpprobe_read(struct file
  		if (cnt + width >= len)
  			break;
@@ -56746,9 +67488,9 @@ diff -urNp linux-2.6.38.2/net/ipv4/tcp_probe.c linux-2.6.38.2/net/ipv4/tcp_probe
  			return -EFAULT;
  		cnt += width;
  	}
-diff -urNp linux-2.6.38.2/net/ipv4/tcp_timer.c linux-2.6.38.2/net/ipv4/tcp_timer.c
---- linux-2.6.38.2/net/ipv4/tcp_timer.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/tcp_timer.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/tcp_timer.c linux-2.6.38.7/net/ipv4/tcp_timer.c
+--- linux-2.6.38.7/net/ipv4/tcp_timer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/tcp_timer.c	2011-04-28 19:34:15.000000000 -0400
 @@ -22,6 +22,10 @@
  #include <linux/gfp.h>
  #include <net/tcp.h>
@@ -56774,9 +67516,9 @@ diff -urNp linux-2.6.38.2/net/ipv4/tcp_timer.c linux-2.6.38.2/net/ipv4/tcp_timer
  	if (retransmits_timed_out(sk, retry_until,
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
-diff -urNp linux-2.6.38.2/net/ipv4/udp.c linux-2.6.38.2/net/ipv4/udp.c
---- linux-2.6.38.2/net/ipv4/udp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv4/udp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv4/udp.c linux-2.6.38.7/net/ipv4/udp.c
+--- linux-2.6.38.7/net/ipv4/udp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv4/udp.c	2011-04-28 20:09:30.000000000 -0400
 @@ -86,6 +86,7 @@
  #include <linux/types.h>
  #include <linux/fcntl.h>
@@ -56825,6 +67567,15 @@ diff -urNp linux-2.6.38.2/net/ipv4/udp.c linux-2.6.38.2/net/ipv4/udp.c
  		daddr = inet->inet_daddr;
  		dport = inet->inet_dport;
  		/* Open fast path for connected socket.
+@@ -1053,7 +1070,7 @@ static unsigned int first_packet_length(
+ 		udp_lib_checksum_complete(skb)) {
+ 		UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
+ 				 IS_UDPLITE(sk));
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		__skb_unlink(skb, rcvq);
+ 		__skb_queue_tail(&list_kill, skb);
+ 	}
 @@ -1139,6 +1156,10 @@ try_again:
  	if (!skb)
  		goto out;
@@ -56836,6 +67587,24 @@ diff -urNp linux-2.6.38.2/net/ipv4/udp.c linux-2.6.38.2/net/ipv4/udp.c
  	ulen = skb->len - sizeof(struct udphdr);
  	if (len > ulen)
  		len = ulen;
+@@ -1435,7 +1456,7 @@ int udp_queue_rcv_skb(struct sock *sk, s
+ 
+ drop:
+ 	UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+-	atomic_inc(&sk->sk_drops);
++	atomic_inc_unchecked(&sk->sk_drops);
+ 	kfree_skb(skb);
+ 	return -1;
+ }
+@@ -1454,7 +1475,7 @@ static void flush_stack(struct sock **st
+ 			skb1 = (i == final) ? skb : skb_clone(skb, GFP_ATOMIC);
+ 
+ 		if (!skb1) {
+-			atomic_inc(&sk->sk_drops);
++			atomic_inc_unchecked(&sk->sk_drops);
+ 			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
+ 					 IS_UDPLITE(sk));
+ 			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
 @@ -1623,6 +1644,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, 
  		goto csum_error;
  
@@ -56846,35 +67615,106 @@ diff -urNp linux-2.6.38.2/net/ipv4/udp.c linux-2.6.38.2/net/ipv4/udp.c
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2050,7 +2074,12 @@ static void udp4_format_sock(struct sock
+@@ -2050,8 +2074,13 @@ static void udp4_format_sock(struct sock
  		sk_wmem_alloc_get(sp),
  		sk_rmem_alloc_get(sp),
  		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
 -		atomic_read(&sp->sk_refcnt), sp,
+-		atomic_read(&sp->sk_drops), len);
 +		atomic_read(&sp->sk_refcnt),
 +#ifdef CONFIG_GRKERNSEC_HIDESYM
 +		NULL,
 +#else
 +		sp,
 +#endif
- 		atomic_read(&sp->sk_drops), len);
++		atomic_read_unchecked(&sp->sk_drops), len);
  }
  
-diff -urNp linux-2.6.38.2/net/ipv6/exthdrs.c linux-2.6.38.2/net/ipv6/exthdrs.c
---- linux-2.6.38.2/net/ipv6/exthdrs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv6/exthdrs.c	2011-03-21 18:31:35.000000000 -0400
-@@ -634,7 +634,7 @@ static struct tlvtype_proc tlvprochopopt
- 		.type	= IPV6_TLV_JUMBO,
- 		.func	= ipv6_hop_jumbo,
- 	},
--	{ -1, }
-+	{ -1, NULL }
- };
+ int udp4_seq_show(struct seq_file *seq, void *v)
+diff -urNp linux-2.6.38.7/net/ipv6/inet6_connection_sock.c linux-2.6.38.7/net/ipv6/inet6_connection_sock.c
+--- linux-2.6.38.7/net/ipv6/inet6_connection_sock.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/inet6_connection_sock.c	2011-04-28 19:57:25.000000000 -0400
+@@ -183,7 +183,7 @@ void __inet6_csk_dst_store(struct sock *
+ #ifdef CONFIG_XFRM
+ 	{
+ 		struct rt6_info *rt = (struct rt6_info  *)dst;
+-		rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
++		rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
+ 	}
+ #endif
+ }
+@@ -198,7 +198,7 @@ struct dst_entry *__inet6_csk_dst_check(
+ #ifdef CONFIG_XFRM
+ 	if (dst) {
+ 		struct rt6_info *rt = (struct rt6_info *)dst;
+-		if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
++		if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
+ 			__sk_dst_reset(sk);
+ 			dst = NULL;
+ 		}
+diff -urNp linux-2.6.38.7/net/ipv6/inet6_hashtables.c linux-2.6.38.7/net/ipv6/inet6_hashtables.c
+--- linux-2.6.38.7/net/ipv6/inet6_hashtables.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/inet6_hashtables.c	2011-05-11 18:35:16.000000000 -0400
+@@ -124,7 +124,7 @@ out:
+ }
+ EXPORT_SYMBOL(__inet6_lookup_established);
+ 
+-static int inline compute_score(struct sock *sk, struct net *net,
++static inline int compute_score(struct sock *sk, struct net *net,
+ 				const unsigned short hnum,
+ 				const struct in6_addr *daddr,
+ 				const int dif)
+diff -urNp linux-2.6.38.7/net/ipv6/ipv6_sockglue.c linux-2.6.38.7/net/ipv6/ipv6_sockglue.c
+--- linux-2.6.38.7/net/ipv6/ipv6_sockglue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/ipv6_sockglue.c	2011-05-16 21:47:09.000000000 -0400
+@@ -129,6 +129,8 @@ static int do_ipv6_setsockopt(struct soc
+ 	int val, valbool;
+ 	int retv = -ENOPROTOOPT;
+ 
++	pax_track_stack();
++
+ 	if (optval == NULL)
+ 		val=0;
+ 	else {
+@@ -919,6 +921,8 @@ static int do_ipv6_getsockopt(struct soc
+ 	int len;
+ 	int val;
  
- int ipv6_parse_hopopts(struct sk_buff *skb)
-diff -urNp linux-2.6.38.2/net/ipv6/raw.c linux-2.6.38.2/net/ipv6/raw.c
---- linux-2.6.38.2/net/ipv6/raw.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv6/raw.c	2011-03-21 18:31:35.000000000 -0400
++	pax_track_stack();
++
+ 	if (ip6_mroute_opt(optname))
+ 		return ip6_mroute_getsockopt(sk, optname, optval, optlen);
+ 
+diff -urNp linux-2.6.38.7/net/ipv6/raw.c linux-2.6.38.7/net/ipv6/raw.c
+--- linux-2.6.38.7/net/ipv6/raw.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/raw.c	2011-05-16 21:47:08.000000000 -0400
+@@ -376,7 +376,7 @@ static inline int rawv6_rcv_skb(struct s
+ {
+ 	if ((raw6_sk(sk)->checksum || rcu_dereference_raw(sk->sk_filter)) &&
+ 	    skb_checksum_complete(skb)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		kfree_skb(skb);
+ 		return NET_RX_DROP;
+ 	}
+@@ -403,7 +403,7 @@ int rawv6_rcv(struct sock *sk, struct sk
+ 	struct raw6_sock *rp = raw6_sk(sk);
+ 
+ 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		kfree_skb(skb);
+ 		return NET_RX_DROP;
+ 	}
+@@ -427,7 +427,7 @@ int rawv6_rcv(struct sock *sk, struct sk
+ 
+ 	if (inet->hdrincl) {
+ 		if (skb_checksum_complete(skb)) {
+-			atomic_inc(&sk->sk_drops);
++			atomic_inc_unchecked(&sk->sk_drops);
+ 			kfree_skb(skb);
+ 			return NET_RX_DROP;
+ 		}
 @@ -602,7 +602,7 @@ out:
  	return err;
  }
@@ -56884,7 +67724,51 @@ diff -urNp linux-2.6.38.2/net/ipv6/raw.c linux-2.6.38.2/net/ipv6/raw.c
  			struct flowi *fl, struct dst_entry **dstp,
  			unsigned int flags)
  {
-@@ -1262,7 +1262,13 @@ static void raw6_sock_seq_show(struct se
+@@ -743,6 +743,8 @@ static int rawv6_sendmsg(struct kiocb *i
+ 	u16 proto;
+ 	int err;
+ 
++	pax_track_stack();
++
+ 	/* Rough check on arithmetic overflow,
+ 	   better check is made in ip6_append_data().
+ 	 */
+@@ -919,12 +921,15 @@ do_confirm:
+ static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
+ 			       char __user *optval, int optlen)
+ {
++	struct icmp6_filter filter;
++
+ 	switch (optname) {
+ 	case ICMPV6_FILTER:
+ 		if (optlen > sizeof(struct icmp6_filter))
+ 			optlen = sizeof(struct icmp6_filter);
+-		if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
++		if (copy_from_user(&filter, optval, optlen))
+ 			return -EFAULT;
++		memcpy(&raw6_sk(sk)->filter, &filter, optlen);
+ 		return 0;
+ 	default:
+ 		return -ENOPROTOOPT;
+@@ -936,6 +941,7 @@ static int rawv6_seticmpfilter(struct so
+ static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
+ 			       char __user *optval, int __user *optlen)
+ {
++	struct icmp6_filter filter;
+ 	int len;
+ 
+ 	switch (optname) {
+@@ -948,7 +954,8 @@ static int rawv6_geticmpfilter(struct so
+ 			len = sizeof(struct icmp6_filter);
+ 		if (put_user(len, optlen))
+ 			return -EFAULT;
+-		if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
++		memcpy(&filter, &raw6_sk(sk)->filter, len);
++		if (copy_to_user(optval, &filter, len))
+ 			return -EFAULT;
+ 		return 0;
+ 	default:
+@@ -1262,7 +1269,13 @@ static void raw6_sock_seq_show(struct se
  		   0, 0L, 0,
  		   sock_i_uid(sp), 0,
  		   sock_i_ino(sp),
@@ -56895,13 +67779,13 @@ diff -urNp linux-2.6.38.2/net/ipv6/raw.c linux-2.6.38.2/net/ipv6/raw.c
 +#else
 +		   sp,
 +#endif
-+		   atomic_read(&sp->sk_drops));
++		   atomic_read_unchecked(&sp->sk_drops));
  }
  
  static int raw6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.38.2/net/ipv6/tcp_ipv6.c linux-2.6.38.2/net/ipv6/tcp_ipv6.c
---- linux-2.6.38.2/net/ipv6/tcp_ipv6.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv6/tcp_ipv6.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv6/tcp_ipv6.c linux-2.6.38.7/net/ipv6/tcp_ipv6.c
+--- linux-2.6.38.7/net/ipv6/tcp_ipv6.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/tcp_ipv6.c	2011-04-28 19:34:15.000000000 -0400
 @@ -92,6 +92,10 @@ static struct tcp_md5sig_key *tcp_v6_md5
  }
  #endif
@@ -57001,9 +67885,9 @@ diff -urNp linux-2.6.38.2/net/ipv6/tcp_ipv6.c linux-2.6.38.2/net/ipv6/tcp_ipv6.c
  }
  
  static int tcp6_seq_show(struct seq_file *seq, void *v)
-diff -urNp linux-2.6.38.2/net/ipv6/udp.c linux-2.6.38.2/net/ipv6/udp.c
---- linux-2.6.38.2/net/ipv6/udp.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/ipv6/udp.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/ipv6/udp.c linux-2.6.38.7/net/ipv6/udp.c
+--- linux-2.6.38.7/net/ipv6/udp.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/ipv6/udp.c	2011-04-28 20:09:04.000000000 -0400
 @@ -50,6 +50,10 @@
  #include <linux/seq_file.h>
  #include "udp_impl.h"
@@ -57015,6 +67899,24 @@ diff -urNp linux-2.6.38.2/net/ipv6/udp.c linux-2.6.38.2/net/ipv6/udp.c
  int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
  {
  	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
+@@ -542,7 +546,7 @@ int udpv6_queue_rcv_skb(struct sock * sk
+ 
+ 	return 0;
+ drop:
+-	atomic_inc(&sk->sk_drops);
++	atomic_inc_unchecked(&sk->sk_drops);
+ drop_no_sk_drops_inc:
+ 	UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS, is_udplite);
+ 	kfree_skb(skb);
+@@ -618,7 +622,7 @@ static void flush_stack(struct sock **st
+ 			continue;
+ 		}
+ drop:
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		UDP6_INC_STATS_BH(sock_net(sk),
+ 				UDP_MIB_RCVBUFERRORS, IS_UDPLITE(sk));
+ 		UDP6_INC_STATS_BH(sock_net(sk),
 @@ -773,6 +777,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
  		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
  				proto == IPPROTO_UDPLITE);
@@ -57025,23 +67927,34 @@ diff -urNp linux-2.6.38.2/net/ipv6/udp.c linux-2.6.38.2/net/ipv6/udp.c
  		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0);
  
  		kfree_skb(skb);
-@@ -1407,7 +1414,12 @@ static void udp6_sock_seq_show(struct se
+@@ -789,7 +796,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, 
+ 	if (!sock_owned_by_user(sk))
+ 		udpv6_queue_rcv_skb(sk, skb);
+ 	else if (sk_add_backlog(sk, skb)) {
+-		atomic_inc(&sk->sk_drops);
++		atomic_inc_unchecked(&sk->sk_drops);
+ 		bh_unlock_sock(sk);
+ 		sock_put(sk);
+ 		goto discard;
+@@ -1407,8 +1414,13 @@ static void udp6_sock_seq_show(struct se
  		   0, 0L, 0,
  		   sock_i_uid(sp), 0,
  		   sock_i_ino(sp),
 -		   atomic_read(&sp->sk_refcnt), sp,
+-		   atomic_read(&sp->sk_drops));
 +		   atomic_read(&sp->sk_refcnt),
 +#ifdef CONFIG_GRKERNSEC_HIDESYM
 +		   NULL,
 +#else
 +		   sp,
 +#endif
- 		   atomic_read(&sp->sk_drops));
++		   atomic_read_unchecked(&sp->sk_drops));
  }
  
-diff -urNp linux-2.6.38.2/net/irda/ircomm/ircomm_tty.c linux-2.6.38.2/net/irda/ircomm/ircomm_tty.c
---- linux-2.6.38.2/net/irda/ircomm/ircomm_tty.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/irda/ircomm/ircomm_tty.c	2011-03-21 18:31:35.000000000 -0400
+ int udp6_seq_show(struct seq_file *seq, void *v)
+diff -urNp linux-2.6.38.7/net/irda/ircomm/ircomm_tty.c linux-2.6.38.7/net/irda/ircomm/ircomm_tty.c
+--- linux-2.6.38.7/net/irda/ircomm/ircomm_tty.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/irda/ircomm/ircomm_tty.c	2011-04-28 19:34:15.000000000 -0400
 @@ -281,16 +281,16 @@ static int ircomm_tty_block_til_ready(st
  	add_wait_queue(&self->open_wait, &wait);
  
@@ -57164,10 +68077,48 @@ diff -urNp linux-2.6.38.2/net/irda/ircomm/ircomm_tty.c linux-2.6.38.2/net/irda/i
  	seq_printf(m, "Max data size: %d\n", self->max_data_size);
  	seq_printf(m, "Max header size: %d\n", self->max_header_size);
  
-diff -urNp linux-2.6.38.2/net/key/af_key.c linux-2.6.38.2/net/key/af_key.c
---- linux-2.6.38.2/net/key/af_key.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/key/af_key.c	2011-03-21 18:31:35.000000000 -0400
-@@ -3644,7 +3644,11 @@ static int pfkey_seq_show(struct seq_fil
+diff -urNp linux-2.6.38.7/net/iucv/af_iucv.c linux-2.6.38.7/net/iucv/af_iucv.c
+--- linux-2.6.38.7/net/iucv/af_iucv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/iucv/af_iucv.c	2011-04-28 19:57:25.000000000 -0400
+@@ -653,10 +653,10 @@ static int iucv_sock_autobind(struct soc
+ 
+ 	write_lock_bh(&iucv_sk_list.lock);
+ 
+-	sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
++	sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
+ 	while (__iucv_get_sock_by_name(name)) {
+ 		sprintf(name, "%08x",
+-			atomic_inc_return(&iucv_sk_list.autobind_name));
++			atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
+ 	}
+ 
+ 	write_unlock_bh(&iucv_sk_list.lock);
+diff -urNp linux-2.6.38.7/net/key/af_key.c linux-2.6.38.7/net/key/af_key.c
+--- linux-2.6.38.7/net/key/af_key.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/key/af_key.c	2011-05-16 21:47:08.000000000 -0400
+@@ -2470,6 +2470,8 @@ static int pfkey_migrate(struct sock *sk
+ 	struct xfrm_migrate m[XFRM_MAX_DEPTH];
+ 	struct xfrm_kmaddress k;
+ 
++	pax_track_stack();
++
+ 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
+ 				     ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
+ 	    !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
+@@ -3003,10 +3005,10 @@ static int pfkey_send_policy_notify(stru
+ static u32 get_acqseq(void)
+ {
+ 	u32 res;
+-	static atomic_t acqseq;
++	static atomic_unchecked_t acqseq;
+ 
+ 	do {
+-		res = atomic_inc_return(&acqseq);
++		res = atomic_inc_return_unchecked(&acqseq);
+ 	} while (!res);
+ 	return res;
+ }
+@@ -3644,7 +3646,11 @@ static int pfkey_seq_show(struct seq_fil
  		seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
  	else
  		seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
@@ -57179,9 +68130,53 @@ diff -urNp linux-2.6.38.2/net/key/af_key.c linux-2.6.38.2/net/key/af_key.c
  			       atomic_read(&s->sk_refcnt),
  			       sk_rmem_alloc_get(s),
  			       sk_wmem_alloc_get(s),
-diff -urNp linux-2.6.38.2/net/mac80211/ieee80211_i.h linux-2.6.38.2/net/mac80211/ieee80211_i.h
---- linux-2.6.38.2/net/mac80211/ieee80211_i.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/ieee80211_i.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/cfg.c linux-2.6.38.7/net/mac80211/cfg.c
+--- linux-2.6.38.7/net/mac80211/cfg.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/cfg.c	2011-05-10 22:09:03.000000000 -0400
+@@ -1941,7 +1941,7 @@ static int ieee80211_get_antenna(struct 
+ 	return drv_get_antenna(local, tx_ant, rx_ant);
+ }
+ 
+-struct cfg80211_ops mac80211_config_ops = {
++const struct cfg80211_ops mac80211_config_ops = {
+ 	.add_virtual_intf = ieee80211_add_iface,
+ 	.del_virtual_intf = ieee80211_del_iface,
+ 	.change_virtual_intf = ieee80211_change_iface,
+diff -urNp linux-2.6.38.7/net/mac80211/cfg.h linux-2.6.38.7/net/mac80211/cfg.h
+--- linux-2.6.38.7/net/mac80211/cfg.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/cfg.h	2011-04-28 19:34:15.000000000 -0400
+@@ -4,6 +4,6 @@
+ #ifndef __CFG_H
+ #define __CFG_H
+ 
+-extern struct cfg80211_ops mac80211_config_ops;
++extern const struct cfg80211_ops mac80211_config_ops;
+ 
+ #endif /* __CFG_H */
+diff -urNp linux-2.6.38.7/net/mac80211/debugfs_sta.c linux-2.6.38.7/net/mac80211/debugfs_sta.c
+--- linux-2.6.38.7/net/mac80211/debugfs_sta.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/debugfs_sta.c	2011-05-16 21:47:09.000000000 -0400
+@@ -115,6 +115,8 @@ static ssize_t sta_agg_status_read(struc
+ 	struct tid_ampdu_rx *tid_rx;
+ 	struct tid_ampdu_tx *tid_tx;
+ 
++	pax_track_stack();
++
+ 	rcu_read_lock();
+ 
+ 	p += scnprintf(p, sizeof(buf) + buf - p, "next dialog_token: %#02x\n",
+@@ -215,6 +217,8 @@ static ssize_t sta_ht_capa_read(struct f
+ 	struct sta_info *sta = file->private_data;
+ 	struct ieee80211_sta_ht_cap *htc = &sta->sta.ht_cap;
+ 
++	pax_track_stack();
++
+ 	p += scnprintf(p, sizeof(buf) + buf - p, "ht %ssupported\n",
+ 			htc->ht_supported ? "" : "not ");
+ 	if (htc->ht_supported) {
+diff -urNp linux-2.6.38.7/net/mac80211/ieee80211_i.h linux-2.6.38.7/net/mac80211/ieee80211_i.h
+--- linux-2.6.38.7/net/mac80211/ieee80211_i.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/ieee80211_i.h	2011-04-28 19:34:15.000000000 -0400
 @@ -27,6 +27,7 @@
  #include <net/ieee80211_radiotap.h>
  #include <net/cfg80211.h>
@@ -57199,9 +68194,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/ieee80211_i.h linux-2.6.38.2/net/mac80211
  	int monitors, cooked_mntrs;
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
-diff -urNp linux-2.6.38.2/net/mac80211/iface.c linux-2.6.38.2/net/mac80211/iface.c
---- linux-2.6.38.2/net/mac80211/iface.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/iface.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/iface.c linux-2.6.38.7/net/mac80211/iface.c
+--- linux-2.6.38.7/net/mac80211/iface.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/iface.c	2011-04-28 19:34:15.000000000 -0400
 @@ -211,7 +211,7 @@ static int ieee80211_do_open(struct net_
  		break;
  	}
@@ -57256,9 +68251,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/iface.c linux-2.6.38.2/net/mac80211/iface
  		if (local->ops->napi_poll)
  			napi_disable(&local->napi);
  		ieee80211_clear_tx_pending(local);
-diff -urNp linux-2.6.38.2/net/mac80211/main.c linux-2.6.38.2/net/mac80211/main.c
---- linux-2.6.38.2/net/mac80211/main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/main.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/main.c linux-2.6.38.7/net/mac80211/main.c
+--- linux-2.6.38.7/net/mac80211/main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/main.c	2011-04-28 19:34:15.000000000 -0400
 @@ -161,7 +161,7 @@ int ieee80211_hw_config(struct ieee80211
  		local->hw.conf.power_level = power;
  	}
@@ -57268,9 +68263,21 @@ diff -urNp linux-2.6.38.2/net/mac80211/main.c linux-2.6.38.2/net/mac80211/main.c
  		ret = drv_config(local, changed);
  		/*
  		 * Goal:
-diff -urNp linux-2.6.38.2/net/mac80211/pm.c linux-2.6.38.2/net/mac80211/pm.c
---- linux-2.6.38.2/net/mac80211/pm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/pm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/mlme.c linux-2.6.38.7/net/mac80211/mlme.c
+--- linux-2.6.38.7/net/mac80211/mlme.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/mlme.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1356,6 +1356,8 @@ static bool ieee80211_assoc_success(stru
+ 	bool have_higher_than_11mbit = false;
+ 	u16 ap_ht_cap_flags;
+ 
++	pax_track_stack();
++
+ 	/* AssocResp and ReassocResp have identical structure */
+ 
+ 	aid = le16_to_cpu(mgmt->u.assoc_resp.aid);
+diff -urNp linux-2.6.38.7/net/mac80211/pm.c linux-2.6.38.7/net/mac80211/pm.c
+--- linux-2.6.38.7/net/mac80211/pm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/pm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -95,7 +95,7 @@ int __ieee80211_suspend(struct ieee80211
  	}
  
@@ -57280,9 +68287,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/pm.c linux-2.6.38.2/net/mac80211/pm.c
  		ieee80211_stop_device(local);
  
  	local->suspended = true;
-diff -urNp linux-2.6.38.2/net/mac80211/rate.c linux-2.6.38.2/net/mac80211/rate.c
---- linux-2.6.38.2/net/mac80211/rate.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/rate.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/rate.c linux-2.6.38.7/net/mac80211/rate.c
+--- linux-2.6.38.7/net/mac80211/rate.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/rate.c	2011-04-28 19:34:15.000000000 -0400
 @@ -371,7 +371,7 @@ int ieee80211_init_rate_ctrl_alg(struct 
  
  	ASSERT_RTNL();
@@ -57292,9 +68299,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/rate.c linux-2.6.38.2/net/mac80211/rate.c
  		return -EBUSY;
  
  	if (local->hw.flags & IEEE80211_HW_HAS_RATE_CONTROL) {
-diff -urNp linux-2.6.38.2/net/mac80211/rc80211_pid_debugfs.c linux-2.6.38.2/net/mac80211/rc80211_pid_debugfs.c
---- linux-2.6.38.2/net/mac80211/rc80211_pid_debugfs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/rc80211_pid_debugfs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/rc80211_pid_debugfs.c linux-2.6.38.7/net/mac80211/rc80211_pid_debugfs.c
+--- linux-2.6.38.7/net/mac80211/rc80211_pid_debugfs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/rc80211_pid_debugfs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -192,7 +192,7 @@ static ssize_t rate_control_pid_events_r
  
  	spin_unlock_irqrestore(&events->lock, status);
@@ -57304,9 +68311,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/rc80211_pid_debugfs.c linux-2.6.38.2/net/
  		return -EFAULT;
  
  	return p;
-diff -urNp linux-2.6.38.2/net/mac80211/tx.c linux-2.6.38.2/net/mac80211/tx.c
---- linux-2.6.38.2/net/mac80211/tx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/tx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/tx.c linux-2.6.38.7/net/mac80211/tx.c
+--- linux-2.6.38.7/net/mac80211/tx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/tx.c	2011-04-28 19:34:15.000000000 -0400
 @@ -173,7 +173,7 @@ static __le16 ieee80211_duration(struct 
  	return cpu_to_le16(dur);
  }
@@ -57316,9 +68323,9 @@ diff -urNp linux-2.6.38.2/net/mac80211/tx.c linux-2.6.38.2/net/mac80211/tx.c
  				      struct net_device *dev)
  {
  	return local == wdev_priv(dev->ieee80211_ptr);
-diff -urNp linux-2.6.38.2/net/mac80211/util.c linux-2.6.38.2/net/mac80211/util.c
---- linux-2.6.38.2/net/mac80211/util.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/mac80211/util.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/mac80211/util.c linux-2.6.38.7/net/mac80211/util.c
+--- linux-2.6.38.7/net/mac80211/util.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/mac80211/util.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1135,7 +1135,7 @@ int ieee80211_reconfig(struct ieee80211_
  		local->resuming = true;
  
@@ -57328,9 +68335,198 @@ diff -urNp linux-2.6.38.2/net/mac80211/util.c linux-2.6.38.2/net/mac80211/util.c
  		/*
  		 * Upon resume hardware can sometimes be goofy due to
  		 * various platform / driver / bus issues, so restarting
-diff -urNp linux-2.6.38.2/net/netfilter/Kconfig linux-2.6.38.2/net/netfilter/Kconfig
---- linux-2.6.38.2/net/netfilter/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/netfilter/Kconfig	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_app.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_app.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_app.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_app.c	2011-05-17 19:31:43.000000000 -0400
+@@ -565,7 +565,7 @@ static const struct file_operations ip_v
+ 	.open	 = ip_vs_app_open,
+ 	.read	 = seq_read,
+ 	.llseek  = seq_lseek,
+-	.release = seq_release,
++	.release = seq_release_net,
+ };
+ #endif
+ 
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_conn.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_conn.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_conn.c	2011-05-17 19:31:43.000000000 -0400
+@@ -553,7 +553,7 @@ ip_vs_bind_dest(struct ip_vs_conn *cp, s
+ 	/* Increase the refcnt counter of the dest */
+ 	atomic_inc(&dest->refcnt);
+ 
+-	conn_flags = atomic_read(&dest->conn_flags);
++	conn_flags = atomic_read_unchecked(&dest->conn_flags);
+ 	if (cp->protocol != IPPROTO_UDP)
+ 		conn_flags &= ~IP_VS_CONN_F_ONE_PACKET;
+ 	/* Bind with the destination and its corresponding transmitter */
+@@ -840,7 +840,7 @@ ip_vs_conn_new(const struct ip_vs_conn_p
+ 	atomic_set(&cp->refcnt, 1);
+ 
+ 	atomic_set(&cp->n_control, 0);
+-	atomic_set(&cp->in_pkts, 0);
++	atomic_set_unchecked(&cp->in_pkts, 0);
+ 
+ 	atomic_inc(&ip_vs_conn_count);
+ 	if (flags & IP_VS_CONN_F_NO_CPORT)
+@@ -1012,7 +1012,7 @@ static const struct file_operations ip_v
+ 	.open    = ip_vs_conn_open,
+ 	.read    = seq_read,
+ 	.llseek  = seq_lseek,
+-	.release = seq_release,
++	.release = seq_release_net,
+ };
+ 
+ static const char *ip_vs_origin_name(unsigned flags)
+@@ -1075,7 +1075,7 @@ static const struct file_operations ip_v
+ 	.open    = ip_vs_conn_sync_open,
+ 	.read    = seq_read,
+ 	.llseek  = seq_lseek,
+-	.release = seq_release,
++	.release = seq_release_net,
+ };
+ 
+ #endif
+@@ -1102,7 +1102,7 @@ static inline int todrop_entry(struct ip
+ 
+ 	/* Don't drop the entry if its number of incoming packets is not
+ 	   located in [0, 8] */
+-	i = atomic_read(&cp->in_pkts);
++	i = atomic_read_unchecked(&cp->in_pkts);
+ 	if (i > 8 || i < 0) return 0;
+ 
+ 	if (!todrop_rate[i]) return 0;
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_core.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_core.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_core.c	2011-04-28 19:57:25.000000000 -0400
+@@ -504,7 +504,7 @@ int ip_vs_leave(struct ip_vs_service *sv
+ 		ret = cp->packet_xmit(skb, cp, pp);
+ 		/* do not touch skb anymore */
+ 
+-		atomic_inc(&cp->in_pkts);
++		atomic_inc_unchecked(&cp->in_pkts);
+ 		ip_vs_conn_put(cp);
+ 		return ret;
+ 	}
+@@ -1536,7 +1536,7 @@ ip_vs_in(unsigned int hooknum, struct sk
+ 	 * Sync connection if it is about to close to
+ 	 * encorage the standby servers to update the connections timeout
+ 	 */
+-	pkts = atomic_add_return(1, &cp->in_pkts);
++	pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
+ 	if (af == AF_INET && (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
+ 	    cp->protocol == IPPROTO_SCTP) {
+ 		if ((cp->state == IP_VS_SCTP_S_ESTABLISHED &&
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_ctl.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_ctl.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_ctl.c	2011-05-17 19:31:43.000000000 -0400
+@@ -787,7 +787,7 @@ __ip_vs_update_dest(struct ip_vs_service
+ 		ip_vs_rs_hash(dest);
+ 		write_unlock_bh(&__ip_vs_rs_lock);
+ 	}
+-	atomic_set(&dest->conn_flags, conn_flags);
++	atomic_set_unchecked(&dest->conn_flags, conn_flags);
+ 
+ 	/* bind the service */
+ 	if (!dest->svc) {
+@@ -1905,7 +1905,7 @@ static int ip_vs_info_seq_show(struct se
+ 					   "      %-7s %-6d %-10d %-10d\n",
+ 					   &dest->addr.in6,
+ 					   ntohs(dest->port),
+-					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
++					   ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
+ 					   atomic_read(&dest->weight),
+ 					   atomic_read(&dest->activeconns),
+ 					   atomic_read(&dest->inactconns));
+@@ -1916,7 +1916,7 @@ static int ip_vs_info_seq_show(struct se
+ 					   "%-7s %-6d %-10d %-10d\n",
+ 					   ntohl(dest->addr.ip),
+ 					   ntohs(dest->port),
+-					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
++					   ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
+ 					   atomic_read(&dest->weight),
+ 					   atomic_read(&dest->activeconns),
+ 					   atomic_read(&dest->inactconns));
+@@ -1944,7 +1944,7 @@ static const struct file_operations ip_v
+ 	.open    = ip_vs_info_open,
+ 	.read    = seq_read,
+ 	.llseek  = seq_lseek,
+-	.release = seq_release_private,
++	.release = seq_release_net,
+ };
+ 
+ #endif
+@@ -1993,7 +1993,7 @@ static const struct file_operations ip_v
+ 	.open = ip_vs_stats_seq_open,
+ 	.read = seq_read,
+ 	.llseek = seq_lseek,
+-	.release = single_release,
++	.release = single_release_net,
+ };
+ 
+ #endif
+@@ -2315,7 +2315,7 @@ __ip_vs_get_dest_entries(const struct ip
+ 
+ 			entry.addr = dest->addr.ip;
+ 			entry.port = dest->port;
+-			entry.conn_flags = atomic_read(&dest->conn_flags);
++			entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
+ 			entry.weight = atomic_read(&dest->weight);
+ 			entry.u_threshold = dest->u_threshold;
+ 			entry.l_threshold = dest->l_threshold;
+@@ -2376,6 +2376,8 @@ do_ip_vs_get_ctl(struct sock *sk, int cm
+ 	int ret = 0;
+ 	unsigned int copylen;
+ 
++	pax_track_stack();
++
+ 	if (!capable(CAP_NET_ADMIN))
+ 		return -EPERM;
+ 
+@@ -2831,7 +2833,7 @@ static int ip_vs_genl_fill_dest(struct s
+ 	NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
+ 
+ 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
+-		    atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
++		    atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
+ 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
+ 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
+ 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_sync.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_sync.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_sync.c	2011-04-28 19:57:25.000000000 -0400
+@@ -460,7 +460,7 @@ static void ip_vs_process_message(const 
+ 
+ 		if (opt)
+ 			memcpy(&cp->in_seq, opt, sizeof(*opt));
+-		atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
++		atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
+ 		cp->state = state;
+ 		cp->old_state = cp->state;
+ 		/*
+diff -urNp linux-2.6.38.7/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.38.7/net/netfilter/ipvs/ip_vs_xmit.c
+--- linux-2.6.38.7/net/netfilter/ipvs/ip_vs_xmit.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/ipvs/ip_vs_xmit.c	2011-04-28 19:57:25.000000000 -0400
+@@ -1116,7 +1116,7 @@ ip_vs_icmp_xmit(struct sk_buff *skb, str
+ 		else
+ 			rc = NF_ACCEPT;
+ 		/* do not touch skb anymore */
+-		atomic_inc(&cp->in_pkts);
++		atomic_inc_unchecked(&cp->in_pkts);
+ 		goto out;
+ 	}
+ 
+@@ -1230,7 +1230,7 @@ ip_vs_icmp_xmit_v6(struct sk_buff *skb, 
+ 		else
+ 			rc = NF_ACCEPT;
+ 		/* do not touch skb anymore */
+-		atomic_inc(&cp->in_pkts);
++		atomic_inc_unchecked(&cp->in_pkts);
+ 		goto out;
+ 	}
+ 
+diff -urNp linux-2.6.38.7/net/netfilter/Kconfig linux-2.6.38.7/net/netfilter/Kconfig
+--- linux-2.6.38.7/net/netfilter/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/Kconfig	2011-04-28 19:34:15.000000000 -0400
 @@ -709,6 +709,16 @@ config NETFILTER_XT_MATCH_ESP
  
  	  To compile it as a module, choose M here.  If unsure, say N.
@@ -57348,9 +68544,9 @@ diff -urNp linux-2.6.38.2/net/netfilter/Kconfig linux-2.6.38.2/net/netfilter/Kco
  config NETFILTER_XT_MATCH_HASHLIMIT
  	tristate '"hashlimit" match support'
  	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
-diff -urNp linux-2.6.38.2/net/netfilter/Makefile linux-2.6.38.2/net/netfilter/Makefile
---- linux-2.6.38.2/net/netfilter/Makefile	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/netfilter/Makefile	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/netfilter/Makefile linux-2.6.38.7/net/netfilter/Makefile
+--- linux-2.6.38.7/net/netfilter/Makefile	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/Makefile	2011-04-28 19:34:15.000000000 -0400
 @@ -74,6 +74,7 @@ obj-$(CONFIG_NETFILTER_XT_MATCH_CPU) += 
  obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
  obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
@@ -57359,9 +68555,9 @@ diff -urNp linux-2.6.38.2/net/netfilter/Makefile linux-2.6.38.2/net/netfilter/Ma
  obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
  obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
  obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
-diff -urNp linux-2.6.38.2/net/netfilter/nf_conntrack_netlink.c linux-2.6.38.2/net/netfilter/nf_conntrack_netlink.c
---- linux-2.6.38.2/net/netfilter/nf_conntrack_netlink.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/netfilter/nf_conntrack_netlink.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/netfilter/nf_conntrack_netlink.c linux-2.6.38.7/net/netfilter/nf_conntrack_netlink.c
+--- linux-2.6.38.7/net/netfilter/nf_conntrack_netlink.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/nf_conntrack_netlink.c	2011-04-28 19:34:15.000000000 -0400
 @@ -761,7 +761,7 @@ static const struct nla_policy tuple_nla
  static int
  ctnetlink_parse_tuple(const struct nlattr * const cda[],
@@ -57371,9 +68567,60 @@ diff -urNp linux-2.6.38.2/net/netfilter/nf_conntrack_netlink.c linux-2.6.38.2/ne
  {
  	struct nlattr *tb[CTA_TUPLE_MAX+1];
  	int err;
-diff -urNp linux-2.6.38.2/net/netfilter/xt_gradm.c linux-2.6.38.2/net/netfilter/xt_gradm.c
---- linux-2.6.38.2/net/netfilter/xt_gradm.c	1969-12-31 19:00:00.000000000 -0500
-+++ linux-2.6.38.2/net/netfilter/xt_gradm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/netfilter/nfnetlink_log.c linux-2.6.38.7/net/netfilter/nfnetlink_log.c
+--- linux-2.6.38.7/net/netfilter/nfnetlink_log.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/nfnetlink_log.c	2011-04-28 19:57:25.000000000 -0400
+@@ -70,7 +70,7 @@ struct nfulnl_instance {
+ };
+ 
+ static DEFINE_SPINLOCK(instances_lock);
+-static atomic_t global_seq;
++static atomic_unchecked_t global_seq;
+ 
+ #define INSTANCE_BUCKETS	16
+ static struct hlist_head instance_table[INSTANCE_BUCKETS];
+@@ -507,7 +507,7 @@ __build_packet_message(struct nfulnl_ins
+ 	/* global sequence number */
+ 	if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
+ 		NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
+-			     htonl(atomic_inc_return(&global_seq)));
++			     htonl(atomic_inc_return_unchecked(&global_seq)));
+ 
+ 	if (data_len) {
+ 		struct nlattr *nla;
+diff -urNp linux-2.6.38.7/net/netfilter/nfnetlink_queue.c linux-2.6.38.7/net/netfilter/nfnetlink_queue.c
+--- linux-2.6.38.7/net/netfilter/nfnetlink_queue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/nfnetlink_queue.c	2011-04-28 19:57:25.000000000 -0400
+@@ -58,7 +58,7 @@ struct nfqnl_instance {
+  */
+ 	spinlock_t	lock;
+ 	unsigned int	queue_total;
+-	atomic_t	id_sequence;		/* 'sequence' of pkt ids */
++	atomic_unchecked_t	id_sequence;	/* 'sequence' of pkt ids */
+ 	struct list_head queue_list;		/* packets in queue */
+ };
+ 
+@@ -272,7 +272,7 @@ nfqnl_build_packet_message(struct nfqnl_
+ 	nfmsg->version = NFNETLINK_V0;
+ 	nfmsg->res_id = htons(queue->queue_num);
+ 
+-	entry->id = atomic_inc_return(&queue->id_sequence);
++	entry->id = atomic_inc_return_unchecked(&queue->id_sequence);
+ 	pmsg.packet_id 		= htonl(entry->id);
+ 	pmsg.hw_protocol	= entskb->protocol;
+ 	pmsg.hook		= entry->hook;
+@@ -863,7 +863,7 @@ static int seq_show(struct seq_file *s, 
+ 			  inst->peer_pid, inst->queue_total,
+ 			  inst->copy_mode, inst->copy_range,
+ 			  inst->queue_dropped, inst->queue_user_dropped,
+-			  atomic_read(&inst->id_sequence), 1);
++			  atomic_read_unchecked(&inst->id_sequence), 1);
+ }
+ 
+ static const struct seq_operations nfqnl_seq_ops = {
+diff -urNp linux-2.6.38.7/net/netfilter/xt_gradm.c linux-2.6.38.7/net/netfilter/xt_gradm.c
+--- linux-2.6.38.7/net/netfilter/xt_gradm.c	1969-12-31 19:00:00.000000000 -0500
++++ linux-2.6.38.7/net/netfilter/xt_gradm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -0,0 +1,51 @@
 +/*
 + *	gradm match for netfilter
@@ -57426,10 +68673,52 @@ diff -urNp linux-2.6.38.2/net/netfilter/xt_gradm.c linux-2.6.38.2/net/netfilter/
 +MODULE_LICENSE("GPL");
 +MODULE_ALIAS("ipt_gradm");
 +MODULE_ALIAS("ip6t_gradm");
-diff -urNp linux-2.6.38.2/net/netlink/af_netlink.c linux-2.6.38.2/net/netlink/af_netlink.c
---- linux-2.6.38.2/net/netlink/af_netlink.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/netlink/af_netlink.c	2011-03-21 18:31:35.000000000 -0400
-@@ -2001,13 +2001,21 @@ static int netlink_seq_show(struct seq_f
+diff -urNp linux-2.6.38.7/net/netfilter/xt_statistic.c linux-2.6.38.7/net/netfilter/xt_statistic.c
+--- linux-2.6.38.7/net/netfilter/xt_statistic.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netfilter/xt_statistic.c	2011-04-28 19:57:25.000000000 -0400
+@@ -18,7 +18,7 @@
+ #include <linux/netfilter/x_tables.h>
+ 
+ struct xt_statistic_priv {
+-	atomic_t count;
++	atomic_unchecked_t count;
+ } ____cacheline_aligned_in_smp;
+ 
+ MODULE_LICENSE("GPL");
+@@ -41,9 +41,9 @@ statistic_mt(const struct sk_buff *skb, 
+ 		break;
+ 	case XT_STATISTIC_MODE_NTH:
+ 		do {
+-			oval = atomic_read(&info->master->count);
++			oval = atomic_read_unchecked(&info->master->count);
+ 			nval = (oval == info->u.nth.every) ? 0 : oval + 1;
+-		} while (atomic_cmpxchg(&info->master->count, oval, nval) != oval);
++		} while (atomic_cmpxchg_unchecked(&info->master->count, oval, nval) != oval);
+ 		if (nval == 0)
+ 			ret = !ret;
+ 		break;
+@@ -63,7 +63,7 @@ static int statistic_mt_check(const stru
+ 	info->master = kzalloc(sizeof(*info->master), GFP_KERNEL);
+ 	if (info->master == NULL)
+ 		return -ENOMEM;
+-	atomic_set(&info->master->count, info->u.nth.count);
++	atomic_set_unchecked(&info->master->count, info->u.nth.count);
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.38.7/net/netlink/af_netlink.c linux-2.6.38.7/net/netlink/af_netlink.c
+--- linux-2.6.38.7/net/netlink/af_netlink.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netlink/af_netlink.c	2011-04-28 19:57:25.000000000 -0400
+@@ -742,7 +742,7 @@ static void netlink_overrun(struct sock 
+ 			sk->sk_error_report(sk);
+ 		}
+ 	}
+-	atomic_inc(&sk->sk_drops);
++	atomic_inc_unchecked(&sk->sk_drops);
+ }
+ 
+ static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
+@@ -2001,15 +2001,23 @@ static int netlink_seq_show(struct seq_f
  		struct netlink_sock *nlk = nlk_sk(s);
  
  		seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d %-8lu\n",
@@ -57449,11 +68738,14 @@ diff -urNp linux-2.6.38.2/net/netlink/af_netlink.c linux-2.6.38.2/net/netlink/af
  			   nlk->cb,
 +#endif
  			   atomic_read(&s->sk_refcnt),
- 			   atomic_read(&s->sk_drops),
+-			   atomic_read(&s->sk_drops),
++			   atomic_read_unchecked(&s->sk_drops),
  			   sock_i_ino(s)
-diff -urNp linux-2.6.38.2/net/netrom/af_netrom.c linux-2.6.38.2/net/netrom/af_netrom.c
---- linux-2.6.38.2/net/netrom/af_netrom.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/netrom/af_netrom.c	2011-03-21 18:31:35.000000000 -0400
+ 			);
+ 
+diff -urNp linux-2.6.38.7/net/netrom/af_netrom.c linux-2.6.38.7/net/netrom/af_netrom.c
+--- linux-2.6.38.7/net/netrom/af_netrom.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/netrom/af_netrom.c	2011-04-28 19:34:15.000000000 -0400
 @@ -840,6 +840,7 @@ static int nr_getname(struct socket *soc
  	struct sock *sk = sock->sk;
  	struct nr_sock *nr = nr_sk(sk);
@@ -57470,9 +68762,26 @@ diff -urNp linux-2.6.38.2/net/netrom/af_netrom.c linux-2.6.38.2/net/netrom/af_ne
  		sax->fsa_ax25.sax25_call   = nr->source_addr;
  		*uaddr_len = sizeof(struct sockaddr_ax25);
  	}
-diff -urNp linux-2.6.38.2/net/packet/af_packet.c linux-2.6.38.2/net/packet/af_packet.c
---- linux-2.6.38.2/net/packet/af_packet.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/packet/af_packet.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/packet/af_packet.c linux-2.6.38.7/net/packet/af_packet.c
+--- linux-2.6.38.7/net/packet/af_packet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/packet/af_packet.c	2011-04-28 19:57:25.000000000 -0400
+@@ -635,14 +635,14 @@ static int packet_rcv(struct sk_buff *sk
+ 
+ 	spin_lock(&sk->sk_receive_queue.lock);
+ 	po->stats.tp_packets++;
+-	skb->dropcount = atomic_read(&sk->sk_drops);
++	skb->dropcount = atomic_read_unchecked(&sk->sk_drops);
+ 	__skb_queue_tail(&sk->sk_receive_queue, skb);
+ 	spin_unlock(&sk->sk_receive_queue.lock);
+ 	sk->sk_data_ready(sk, skb->len);
+ 	return 0;
+ 
+ drop_n_acct:
+-	po->stats.tp_drops = atomic_inc_return(&sk->sk_drops);
++	po->stats.tp_drops = atomic_inc_return_unchecked(&sk->sk_drops);
+ 
+ drop_n_restore:
+ 	if (skb_head != skb->data && skb_shared(skb)) {
 @@ -2134,7 +2134,7 @@ static int packet_getsockopt(struct sock
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
@@ -57503,9 +68812,9 @@ diff -urNp linux-2.6.38.2/net/packet/af_packet.c linux-2.6.38.2/net/packet/af_pa
  			   atomic_read(&s->sk_refcnt),
  			   s->sk_type,
  			   ntohs(po->num),
-diff -urNp linux-2.6.38.2/net/phonet/af_phonet.c linux-2.6.38.2/net/phonet/af_phonet.c
---- linux-2.6.38.2/net/phonet/af_phonet.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/phonet/af_phonet.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/phonet/af_phonet.c linux-2.6.38.7/net/phonet/af_phonet.c
+--- linux-2.6.38.7/net/phonet/af_phonet.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/phonet/af_phonet.c	2011-04-28 19:34:15.000000000 -0400
 @@ -41,7 +41,7 @@ static struct phonet_protocol *phonet_pr
  {
  	struct phonet_protocol *pp;
@@ -57524,26 +68833,455 @@ diff -urNp linux-2.6.38.2/net/phonet/af_phonet.c linux-2.6.38.2/net/phonet/af_ph
  		return -EINVAL;
  
  	err = proto_register(pp->prot, 1);
-diff -urNp linux-2.6.38.2/net/phonet/socket.c linux-2.6.38.2/net/phonet/socket.c
---- linux-2.6.38.2/net/phonet/socket.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/phonet/socket.c	2011-03-21 18:31:35.000000000 -0400
-@@ -637,7 +637,12 @@ static int pn_sock_seq_show(struct seq_f
+diff -urNp linux-2.6.38.7/net/phonet/pep.c linux-2.6.38.7/net/phonet/pep.c
+--- linux-2.6.38.7/net/phonet/pep.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/phonet/pep.c	2011-04-28 19:57:25.000000000 -0400
+@@ -592,7 +592,7 @@ static int pipe_do_rcv(struct sock *sk, 
+ 
+ 	case PNS_PEP_CTRL_REQ:
+ 		if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
+-			atomic_inc(&sk->sk_drops);
++			atomic_inc_unchecked(&sk->sk_drops);
+ 			break;
+ 		}
+ 		__skb_pull(skb, 4);
+@@ -612,7 +612,7 @@ static int pipe_do_rcv(struct sock *sk, 
+ 		}
+ 
+ 		if (pn->rx_credits == 0) {
+-			atomic_inc(&sk->sk_drops);
++			atomic_inc_unchecked(&sk->sk_drops);
+ 			err = -ENOBUFS;
+ 			break;
+ 		}
+diff -urNp linux-2.6.38.7/net/phonet/socket.c linux-2.6.38.7/net/phonet/socket.c
+--- linux-2.6.38.7/net/phonet/socket.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/phonet/socket.c	2011-04-28 20:09:57.000000000 -0400
+@@ -637,8 +637,13 @@ static int pn_sock_seq_show(struct seq_f
  			sk->sk_state,
  			sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
  			sock_i_uid(sk), sock_i_ino(sk),
 -			atomic_read(&sk->sk_refcnt), sk,
+-			atomic_read(&sk->sk_drops), &len);
 +			atomic_read(&sk->sk_refcnt),
 +#ifdef CONFIG_GRKERNSEC_HIDESYM
 +			NULL,
 +#else
 +			sk,
 +#endif
- 			atomic_read(&sk->sk_drops), &len);
++			atomic_read_unchecked(&sk->sk_drops), &len);
  	}
  	seq_printf(seq, "%*s\n", 127 - len, "");
-diff -urNp linux-2.6.38.2/net/sctp/proc.c linux-2.6.38.2/net/sctp/proc.c
---- linux-2.6.38.2/net/sctp/proc.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/sctp/proc.c	2011-03-21 18:31:35.000000000 -0400
+ 	return 0;
+diff -urNp linux-2.6.38.7/net/rds/cong.c linux-2.6.38.7/net/rds/cong.c
+--- linux-2.6.38.7/net/rds/cong.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/cong.c	2011-04-28 19:57:25.000000000 -0400
+@@ -78,7 +78,7 @@
+  * finds that the saved generation number is smaller than the global generation
+  * number, it wakes up the process.
+  */
+-static atomic_t		rds_cong_generation = ATOMIC_INIT(0);
++static atomic_unchecked_t		rds_cong_generation = ATOMIC_INIT(0);
+ 
+ /*
+  * Congestion monitoring
+@@ -233,7 +233,7 @@ void rds_cong_map_updated(struct rds_con
+ 	rdsdebug("waking map %p for %pI4\n",
+ 	  map, &map->m_addr);
+ 	rds_stats_inc(s_cong_update_received);
+-	atomic_inc(&rds_cong_generation);
++	atomic_inc_unchecked(&rds_cong_generation);
+ 	if (waitqueue_active(&map->m_waitq))
+ 		wake_up(&map->m_waitq);
+ 	if (waitqueue_active(&rds_poll_waitq))
+@@ -259,7 +259,7 @@ EXPORT_SYMBOL_GPL(rds_cong_map_updated);
+ 
+ int rds_cong_updated_since(unsigned long *recent)
+ {
+-	unsigned long gen = atomic_read(&rds_cong_generation);
++	unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
+ 
+ 	if (likely(*recent == gen))
+ 		return 0;
+diff -urNp linux-2.6.38.7/net/rds/ib_cm.c linux-2.6.38.7/net/rds/ib_cm.c
+--- linux-2.6.38.7/net/rds/ib_cm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/ib_cm.c	2011-05-11 18:35:16.000000000 -0400
+@@ -720,7 +720,7 @@ void rds_ib_conn_shutdown(struct rds_con
+ 	/* Clear the ACK state */
+ 	clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
+ #ifdef KERNEL_HAS_ATOMIC64
+-	atomic64_set(&ic->i_ack_next, 0);
++	atomic64_set_unchecked(&ic->i_ack_next, 0);
+ #else
+ 	ic->i_ack_next = 0;
+ #endif
+diff -urNp linux-2.6.38.7/net/rds/ib.h linux-2.6.38.7/net/rds/ib.h
+--- linux-2.6.38.7/net/rds/ib.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/ib.h	2011-05-11 18:35:16.000000000 -0400
+@@ -127,7 +127,7 @@ struct rds_ib_connection {
+ 	/* sending acks */
+ 	unsigned long		i_ack_flags;
+ #ifdef KERNEL_HAS_ATOMIC64
+-	atomic64_t		i_ack_next;	/* next ACK to send */
++	atomic64_unchecked_t	i_ack_next;	/* next ACK to send */
+ #else
+ 	spinlock_t		i_ack_lock;	/* protect i_ack_next */
+ 	u64			i_ack_next;	/* next ACK to send */
+diff -urNp linux-2.6.38.7/net/rds/ib_recv.c linux-2.6.38.7/net/rds/ib_recv.c
+--- linux-2.6.38.7/net/rds/ib_recv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/ib_recv.c	2011-05-11 18:35:16.000000000 -0400
+@@ -592,7 +592,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
+ static void rds_ib_set_ack(struct rds_ib_connection *ic, u64 seq,
+ 				int ack_required)
+ {
+-	atomic64_set(&ic->i_ack_next, seq);
++	atomic64_set_unchecked(&ic->i_ack_next, seq);
+ 	if (ack_required) {
+ 		smp_mb__before_clear_bit();
+ 		set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+@@ -604,7 +604,7 @@ static u64 rds_ib_get_ack(struct rds_ib_
+ 	clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+ 	smp_mb__after_clear_bit();
+ 
+-	return atomic64_read(&ic->i_ack_next);
++	return atomic64_read_unchecked(&ic->i_ack_next);
+ }
+ #endif
+ 
+diff -urNp linux-2.6.38.7/net/rds/iw_cm.c linux-2.6.38.7/net/rds/iw_cm.c
+--- linux-2.6.38.7/net/rds/iw_cm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/iw_cm.c	2011-05-11 18:35:16.000000000 -0400
+@@ -664,7 +664,7 @@ void rds_iw_conn_shutdown(struct rds_con
+ 	/* Clear the ACK state */
+ 	clear_bit(IB_ACK_IN_FLIGHT, &ic->i_ack_flags);
+ #ifdef KERNEL_HAS_ATOMIC64
+-	atomic64_set(&ic->i_ack_next, 0);
++	atomic64_set_unchecked(&ic->i_ack_next, 0);
+ #else
+ 	ic->i_ack_next = 0;
+ #endif
+diff -urNp linux-2.6.38.7/net/rds/iw.h linux-2.6.38.7/net/rds/iw.h
+--- linux-2.6.38.7/net/rds/iw.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/iw.h	2011-05-11 18:35:16.000000000 -0400
+@@ -133,7 +133,7 @@ struct rds_iw_connection {
+ 	/* sending acks */
+ 	unsigned long		i_ack_flags;
+ #ifdef KERNEL_HAS_ATOMIC64
+-	atomic64_t		i_ack_next;	/* next ACK to send */
++	atomic64_unchecked_t	i_ack_next;	/* next ACK to send */
+ #else
+ 	spinlock_t		i_ack_lock;	/* protect i_ack_next */
+ 	u64			i_ack_next;	/* next ACK to send */
+diff -urNp linux-2.6.38.7/net/rds/iw_rdma.c linux-2.6.38.7/net/rds/iw_rdma.c
+--- linux-2.6.38.7/net/rds/iw_rdma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/iw_rdma.c	2011-05-16 21:47:09.000000000 -0400
+@@ -182,6 +182,8 @@ int rds_iw_update_cm_id(struct rds_iw_de
+ 	struct rdma_cm_id *pcm_id;
+ 	int rc;
+ 
++	pax_track_stack();
++
+ 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
+ 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
+ 
+diff -urNp linux-2.6.38.7/net/rds/iw_recv.c linux-2.6.38.7/net/rds/iw_recv.c
+--- linux-2.6.38.7/net/rds/iw_recv.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rds/iw_recv.c	2011-05-11 18:35:16.000000000 -0400
+@@ -427,7 +427,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
+ static void rds_iw_set_ack(struct rds_iw_connection *ic, u64 seq,
+ 				int ack_required)
+ {
+-	atomic64_set(&ic->i_ack_next, seq);
++	atomic64_set_unchecked(&ic->i_ack_next, seq);
+ 	if (ack_required) {
+ 		smp_mb__before_clear_bit();
+ 		set_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+@@ -439,7 +439,7 @@ static u64 rds_iw_get_ack(struct rds_iw_
+ 	clear_bit(IB_ACK_REQUESTED, &ic->i_ack_flags);
+ 	smp_mb__after_clear_bit();
+ 
+-	return atomic64_read(&ic->i_ack_next);
++	return atomic64_read_unchecked(&ic->i_ack_next);
+ }
+ #endif
+ 
+diff -urNp linux-2.6.38.7/net/rxrpc/af_rxrpc.c linux-2.6.38.7/net/rxrpc/af_rxrpc.c
+--- linux-2.6.38.7/net/rxrpc/af_rxrpc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/af_rxrpc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -39,7 +39,7 @@ static const struct proto_ops rxrpc_rpc_
+ __be32 rxrpc_epoch;
+ 
+ /* current debugging ID */
+-atomic_t rxrpc_debug_id;
++atomic_unchecked_t rxrpc_debug_id;
+ 
+ /* count of skbs currently in use */
+ atomic_t rxrpc_n_skbs;
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-ack.c linux-2.6.38.7/net/rxrpc/ar-ack.c
+--- linux-2.6.38.7/net/rxrpc/ar-ack.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-ack.c	2011-05-16 21:47:08.000000000 -0400
+@@ -175,7 +175,7 @@ static void rxrpc_resend(struct rxrpc_ca
+ 
+ 	_enter("{%d,%d,%d,%d},",
+ 	       call->acks_hard, call->acks_unacked,
+-	       atomic_read(&call->sequence),
++	       atomic_read_unchecked(&call->sequence),
+ 	       CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
+ 
+ 	stop = 0;
+@@ -199,7 +199,7 @@ static void rxrpc_resend(struct rxrpc_ca
+ 
+ 			/* each Tx packet has a new serial number */
+ 			sp->hdr.serial =
+-				htonl(atomic_inc_return(&call->conn->serial));
++				htonl(atomic_inc_return_unchecked(&call->conn->serial));
+ 
+ 			hdr = (struct rxrpc_header *) txb->head;
+ 			hdr->serial = sp->hdr.serial;
+@@ -405,7 +405,7 @@ static void rxrpc_rotate_tx_window(struc
+  */
+ static void rxrpc_clear_tx_window(struct rxrpc_call *call)
+ {
+-	rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
++	rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
+ }
+ 
+ /*
+@@ -631,7 +631,7 @@ process_further:
+ 
+ 		latest = ntohl(sp->hdr.serial);
+ 		hard = ntohl(ack.firstPacket);
+-		tx = atomic_read(&call->sequence);
++		tx = atomic_read_unchecked(&call->sequence);
+ 
+ 		_proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
+ 		       latest,
+@@ -844,6 +844,8 @@ void rxrpc_process_call(struct work_stru
+ 	u32 abort_code = RX_PROTOCOL_ERROR;
+ 	u8 *acks = NULL;
+ 
++	pax_track_stack();
++
+ 	//printk("\n--------------------\n");
+ 	_enter("{%d,%s,%lx} [%lu]",
+ 	       call->debug_id, rxrpc_call_states[call->state], call->events,
+@@ -1163,7 +1165,7 @@ void rxrpc_process_call(struct work_stru
+ 	goto maybe_reschedule;
+ 
+ send_ACK_with_skew:
+-	ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
++	ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
+ 			    ntohl(ack.serial));
+ send_ACK:
+ 	mtu = call->conn->trans->peer->if_mtu;
+@@ -1175,7 +1177,7 @@ send_ACK:
+ 	ackinfo.rxMTU	= htonl(5692);
+ 	ackinfo.jumbo_max = htonl(4);
+ 
+-	hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
++	hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
+ 	_proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
+ 	       ntohl(hdr.serial),
+ 	       ntohs(ack.maxSkew),
+@@ -1193,7 +1195,7 @@ send_ACK:
+ send_message:
+ 	_debug("send message");
+ 
+-	hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
++	hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
+ 	_proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
+ send_message_2:
+ 
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-call.c linux-2.6.38.7/net/rxrpc/ar-call.c
+--- linux-2.6.38.7/net/rxrpc/ar-call.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-call.c	2011-04-28 19:57:25.000000000 -0400
+@@ -83,7 +83,7 @@ static struct rxrpc_call *rxrpc_alloc_ca
+ 	spin_lock_init(&call->lock);
+ 	rwlock_init(&call->state_lock);
+ 	atomic_set(&call->usage, 1);
+-	call->debug_id = atomic_inc_return(&rxrpc_debug_id);
++	call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ 	call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
+ 
+ 	memset(&call->sock_node, 0xed, sizeof(call->sock_node));
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-connection.c linux-2.6.38.7/net/rxrpc/ar-connection.c
+--- linux-2.6.38.7/net/rxrpc/ar-connection.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-connection.c	2011-04-28 19:57:25.000000000 -0400
+@@ -206,7 +206,7 @@ static struct rxrpc_connection *rxrpc_al
+ 		rwlock_init(&conn->lock);
+ 		spin_lock_init(&conn->state_lock);
+ 		atomic_set(&conn->usage, 1);
+-		conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
++		conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ 		conn->avail_calls = RXRPC_MAXCALLS;
+ 		conn->size_align = 4;
+ 		conn->header_size = sizeof(struct rxrpc_header);
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-connevent.c linux-2.6.38.7/net/rxrpc/ar-connevent.c
+--- linux-2.6.38.7/net/rxrpc/ar-connevent.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-connevent.c	2011-04-28 19:57:25.000000000 -0400
+@@ -109,7 +109,7 @@ static int rxrpc_abort_connection(struct
+ 
+ 	len = iov[0].iov_len + iov[1].iov_len;
+ 
+-	hdr.serial = htonl(atomic_inc_return(&conn->serial));
++	hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ 	_proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
+ 
+ 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-input.c linux-2.6.38.7/net/rxrpc/ar-input.c
+--- linux-2.6.38.7/net/rxrpc/ar-input.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-input.c	2011-04-28 19:57:25.000000000 -0400
+@@ -340,9 +340,9 @@ void rxrpc_fast_process_packet(struct rx
+ 	/* track the latest serial number on this connection for ACK packet
+ 	 * information */
+ 	serial = ntohl(sp->hdr.serial);
+-	hi_serial = atomic_read(&call->conn->hi_serial);
++	hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
+ 	while (serial > hi_serial)
+-		hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
++		hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
+ 					   serial);
+ 
+ 	/* request ACK generation for any ACK or DATA packet that requests
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-internal.h linux-2.6.38.7/net/rxrpc/ar-internal.h
+--- linux-2.6.38.7/net/rxrpc/ar-internal.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-internal.h	2011-04-28 19:57:25.000000000 -0400
+@@ -272,8 +272,8 @@ struct rxrpc_connection {
+ 	int			error;		/* error code for local abort */
+ 	int			debug_id;	/* debug ID for printks */
+ 	unsigned		call_counter;	/* call ID counter */
+-	atomic_t		serial;		/* packet serial number counter */
+-	atomic_t		hi_serial;	/* highest serial number received */
++	atomic_unchecked_t	serial;		/* packet serial number counter */
++	atomic_unchecked_t	hi_serial;	/* highest serial number received */
+ 	u8			avail_calls;	/* number of calls available */
+ 	u8			size_align;	/* data size alignment (for security) */
+ 	u8			header_size;	/* rxrpc + security header size */
+@@ -346,7 +346,7 @@ struct rxrpc_call {
+ 	spinlock_t		lock;
+ 	rwlock_t		state_lock;	/* lock for state transition */
+ 	atomic_t		usage;
+-	atomic_t		sequence;	/* Tx data packet sequence counter */
++	atomic_unchecked_t	sequence;	/* Tx data packet sequence counter */
+ 	u32			abort_code;	/* local/remote abort code */
+ 	enum {					/* current state of call */
+ 		RXRPC_CALL_CLIENT_SEND_REQUEST,	/* - client sending request phase */
+@@ -420,7 +420,7 @@ static inline void rxrpc_abort_call(stru
+  */
+ extern atomic_t rxrpc_n_skbs;
+ extern __be32 rxrpc_epoch;
+-extern atomic_t rxrpc_debug_id;
++extern atomic_unchecked_t rxrpc_debug_id;
+ extern struct workqueue_struct *rxrpc_workqueue;
+ 
+ /*
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-local.c linux-2.6.38.7/net/rxrpc/ar-local.c
+--- linux-2.6.38.7/net/rxrpc/ar-local.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-local.c	2011-04-28 19:57:25.000000000 -0400
+@@ -45,7 +45,7 @@ struct rxrpc_local *rxrpc_alloc_local(st
+ 		spin_lock_init(&local->lock);
+ 		rwlock_init(&local->services_lock);
+ 		atomic_set(&local->usage, 1);
+-		local->debug_id = atomic_inc_return(&rxrpc_debug_id);
++		local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ 		memcpy(&local->srx, srx, sizeof(*srx));
+ 	}
+ 
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-output.c linux-2.6.38.7/net/rxrpc/ar-output.c
+--- linux-2.6.38.7/net/rxrpc/ar-output.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-output.c	2011-04-28 19:57:25.000000000 -0400
+@@ -681,9 +681,9 @@ static int rxrpc_send_data(struct kiocb 
+ 			sp->hdr.cid = call->cid;
+ 			sp->hdr.callNumber = call->call_id;
+ 			sp->hdr.seq =
+-				htonl(atomic_inc_return(&call->sequence));
++				htonl(atomic_inc_return_unchecked(&call->sequence));
+ 			sp->hdr.serial =
+-				htonl(atomic_inc_return(&conn->serial));
++				htonl(atomic_inc_return_unchecked(&conn->serial));
+ 			sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
+ 			sp->hdr.userStatus = 0;
+ 			sp->hdr.securityIndex = conn->security_ix;
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-peer.c linux-2.6.38.7/net/rxrpc/ar-peer.c
+--- linux-2.6.38.7/net/rxrpc/ar-peer.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-peer.c	2011-04-28 19:57:25.000000000 -0400
+@@ -87,7 +87,7 @@ static struct rxrpc_peer *rxrpc_alloc_pe
+ 		INIT_LIST_HEAD(&peer->error_targets);
+ 		spin_lock_init(&peer->lock);
+ 		atomic_set(&peer->usage, 1);
+-		peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
++		peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ 		memcpy(&peer->srx, srx, sizeof(*srx));
+ 
+ 		rxrpc_assess_MTU_size(peer);
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-proc.c linux-2.6.38.7/net/rxrpc/ar-proc.c
+--- linux-2.6.38.7/net/rxrpc/ar-proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-proc.c	2011-04-28 19:57:25.000000000 -0400
+@@ -164,8 +164,8 @@ static int rxrpc_connection_seq_show(str
+ 		   atomic_read(&conn->usage),
+ 		   rxrpc_conn_states[conn->state],
+ 		   key_serial(conn->key),
+-		   atomic_read(&conn->serial),
+-		   atomic_read(&conn->hi_serial));
++		   atomic_read_unchecked(&conn->serial),
++		   atomic_read_unchecked(&conn->hi_serial));
+ 
+ 	return 0;
+ }
+diff -urNp linux-2.6.38.7/net/rxrpc/ar-transport.c linux-2.6.38.7/net/rxrpc/ar-transport.c
+--- linux-2.6.38.7/net/rxrpc/ar-transport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/ar-transport.c	2011-04-28 19:57:25.000000000 -0400
+@@ -47,7 +47,7 @@ static struct rxrpc_transport *rxrpc_all
+ 		spin_lock_init(&trans->client_lock);
+ 		rwlock_init(&trans->conn_lock);
+ 		atomic_set(&trans->usage, 1);
+-		trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
++		trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
+ 
+ 		if (peer->srx.transport.family == AF_INET) {
+ 			switch (peer->srx.transport_type) {
+diff -urNp linux-2.6.38.7/net/rxrpc/rxkad.c linux-2.6.38.7/net/rxrpc/rxkad.c
+--- linux-2.6.38.7/net/rxrpc/rxkad.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/rxrpc/rxkad.c	2011-05-16 21:47:08.000000000 -0400
+@@ -211,6 +211,8 @@ static int rxkad_secure_packet_encrypt(c
+ 	u16 check;
+ 	int nsg;
+ 
++	pax_track_stack();
++
+ 	sp = rxrpc_skb(skb);
+ 
+ 	_enter("");
+@@ -338,6 +340,8 @@ static int rxkad_verify_packet_auth(cons
+ 	u16 check;
+ 	int nsg;
+ 
++	pax_track_stack();
++
+ 	_enter("");
+ 
+ 	sp = rxrpc_skb(skb);
+@@ -610,7 +614,7 @@ static int rxkad_issue_challenge(struct 
+ 
+ 	len = iov[0].iov_len + iov[1].iov_len;
+ 
+-	hdr.serial = htonl(atomic_inc_return(&conn->serial));
++	hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ 	_proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
+ 
+ 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
+@@ -660,7 +664,7 @@ static int rxkad_send_response(struct rx
+ 
+ 	len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
+ 
+-	hdr->serial = htonl(atomic_inc_return(&conn->serial));
++	hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
+ 	_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
+ 
+ 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
+diff -urNp linux-2.6.38.7/net/sctp/proc.c linux-2.6.38.7/net/sctp/proc.c
+--- linux-2.6.38.7/net/sctp/proc.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sctp/proc.c	2011-04-28 19:34:15.000000000 -0400
 @@ -212,7 +212,12 @@ static int sctp_eps_seq_show(struct seq_
  	sctp_for_each_hentry(epb, node, &head->chain) {
  		ep = sctp_ep(epb);
@@ -57572,18 +69310,9 @@ diff -urNp linux-2.6.38.2/net/sctp/proc.c linux-2.6.38.2/net/sctp/proc.c
  			   assoc->state, hash,
  			   assoc->assoc_id,
  			   assoc->sndbuf_used,
-diff -urNp linux-2.6.38.2/net/sctp/socket.c linux-2.6.38.2/net/sctp/socket.c
---- linux-2.6.38.2/net/sctp/socket.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/sctp/socket.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1496,7 +1496,7 @@ SCTP_STATIC int sctp_sendmsg(struct kioc
- 	struct sctp_sndrcvinfo *sinfo;
- 	struct sctp_initmsg *sinit;
- 	sctp_assoc_t associd = 0;
--	sctp_cmsgs_t cmsgs = { NULL };
-+	sctp_cmsgs_t cmsgs = { NULL, NULL };
- 	int err;
- 	sctp_scope_t scope;
- 	long timeo;
+diff -urNp linux-2.6.38.7/net/sctp/socket.c linux-2.6.38.7/net/sctp/socket.c
+--- linux-2.6.38.7/net/sctp/socket.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sctp/socket.c	2011-04-28 19:34:15.000000000 -0400
 @@ -4435,7 +4435,7 @@ static int sctp_getsockopt_peer_addrs(st
  		addrlen = sctp_get_af_specific(temp.sa.sa_family)->sockaddr_len;
  		if (space_left < addrlen)
@@ -57593,9 +69322,9 @@ diff -urNp linux-2.6.38.2/net/sctp/socket.c linux-2.6.38.2/net/sctp/socket.c
  			return -EFAULT;
  		to += addrlen;
  		cnt++;
-diff -urNp linux-2.6.38.2/net/socket.c linux-2.6.38.2/net/socket.c
---- linux-2.6.38.2/net/socket.c	2011-03-28 17:42:40.000000000 -0400
-+++ linux-2.6.38.2/net/socket.c	2011-03-28 17:42:53.000000000 -0400
+diff -urNp linux-2.6.38.7/net/socket.c linux-2.6.38.7/net/socket.c
+--- linux-2.6.38.7/net/socket.c	2011-04-18 17:27:16.000000000 -0400
++++ linux-2.6.38.7/net/socket.c	2011-05-16 21:47:09.000000000 -0400
 @@ -88,6 +88,7 @@
  #include <linux/nsproxy.h>
  #include <linux/magic.h>
@@ -57746,9 +69475,18 @@ diff -urNp linux-2.6.38.2/net/socket.c linux-2.6.38.2/net/socket.c
  	err =
  	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
  	if (err)
-diff -urNp linux-2.6.38.2/net/sunrpc/sched.c linux-2.6.38.2/net/sunrpc/sched.c
---- linux-2.6.38.2/net/sunrpc/sched.c	2011-03-23 17:20:08.000000000 -0400
-+++ linux-2.6.38.2/net/sunrpc/sched.c	2011-03-23 17:21:51.000000000 -0400
+@@ -1877,6 +1937,8 @@ SYSCALL_DEFINE3(sendmsg, int, fd, struct
+ 	int err, ctl_len, iov_size, total_len;
+ 	int fput_needed;
+ 
++	pax_track_stack();
++
+ 	err = -EFAULT;
+ 	if (MSG_CMSG_COMPAT & flags) {
+ 		if (get_compat_msghdr(&msg_sys, msg_compat))
+diff -urNp linux-2.6.38.7/net/sunrpc/sched.c linux-2.6.38.7/net/sunrpc/sched.c
+--- linux-2.6.38.7/net/sunrpc/sched.c	2011-04-18 17:27:14.000000000 -0400
++++ linux-2.6.38.7/net/sunrpc/sched.c	2011-04-28 19:34:15.000000000 -0400
 @@ -234,9 +234,9 @@ static int rpc_wait_bit_killable(void *w
  #ifdef RPC_DEBUG
  static void rpc_task_set_debuginfo(struct rpc_task *task)
@@ -57761,9 +69499,34 @@ diff -urNp linux-2.6.38.2/net/sunrpc/sched.c linux-2.6.38.2/net/sunrpc/sched.c
  }
  #else
  static inline void rpc_task_set_debuginfo(struct rpc_task *task)
-diff -urNp linux-2.6.38.2/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.38.2/net/sunrpc/xprtrdma/svc_rdma.c
---- linux-2.6.38.2/net/sunrpc/xprtrdma/svc_rdma.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/sunrpc/xprtrdma/svc_rdma.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma.c
+--- linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma.c	2011-04-28 19:57:25.000000000 -0400
+@@ -61,15 +61,15 @@ unsigned int svcrdma_max_req_size = RPCR
+ static unsigned int min_max_inline = 4096;
+ static unsigned int max_max_inline = 65536;
+ 
+-atomic_t rdma_stat_recv;
+-atomic_t rdma_stat_read;
+-atomic_t rdma_stat_write;
+-atomic_t rdma_stat_sq_starve;
+-atomic_t rdma_stat_rq_starve;
+-atomic_t rdma_stat_rq_poll;
+-atomic_t rdma_stat_rq_prod;
+-atomic_t rdma_stat_sq_poll;
+-atomic_t rdma_stat_sq_prod;
++atomic_unchecked_t rdma_stat_recv;
++atomic_unchecked_t rdma_stat_read;
++atomic_unchecked_t rdma_stat_write;
++atomic_unchecked_t rdma_stat_sq_starve;
++atomic_unchecked_t rdma_stat_rq_starve;
++atomic_unchecked_t rdma_stat_rq_poll;
++atomic_unchecked_t rdma_stat_rq_prod;
++atomic_unchecked_t rdma_stat_sq_poll;
++atomic_unchecked_t rdma_stat_sq_prod;
+ 
+ /* Temporary NFS request map and context caches */
+ struct kmem_cache *svc_rdma_map_cachep;
 @@ -109,7 +109,7 @@ static int read_reset_stat(ctl_table *ta
  		len -= *ppos;
  		if (len > *lenp)
@@ -57773,9 +69536,172 @@ diff -urNp linux-2.6.38.2/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.38.2/net/sunr
  			return -EFAULT;
  		*lenp = len;
  		*ppos += len;
-diff -urNp linux-2.6.38.2/net/sysctl_net.c linux-2.6.38.2/net/sysctl_net.c
---- linux-2.6.38.2/net/sysctl_net.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/sysctl_net.c	2011-03-21 18:31:35.000000000 -0400
+@@ -150,63 +150,63 @@ static ctl_table svcrdma_parm_table[] = 
+ 	{
+ 		.procname	= "rdma_stat_read",
+ 		.data		= &rdma_stat_read,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_recv",
+ 		.data		= &rdma_stat_recv,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_write",
+ 		.data		= &rdma_stat_write,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_sq_starve",
+ 		.data		= &rdma_stat_sq_starve,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_rq_starve",
+ 		.data		= &rdma_stat_rq_starve,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_rq_poll",
+ 		.data		= &rdma_stat_rq_poll,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_rq_prod",
+ 		.data		= &rdma_stat_rq_prod,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_sq_poll",
+ 		.data		= &rdma_stat_sq_poll,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+ 	{
+ 		.procname	= "rdma_stat_sq_prod",
+ 		.data		= &rdma_stat_sq_prod,
+-		.maxlen		= sizeof(atomic_t),
++		.maxlen		= sizeof(atomic_unchecked_t),
+ 		.mode		= 0644,
+ 		.proc_handler	= read_reset_stat,
+ 	},
+diff -urNp linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
+--- linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2011-04-28 19:57:25.000000000 -0400
+@@ -499,7 +499,7 @@ next_sge:
+ 			svc_rdma_put_context(ctxt, 0);
+ 			goto out;
+ 		}
+-		atomic_inc(&rdma_stat_read);
++		atomic_inc_unchecked(&rdma_stat_read);
+ 
+ 		if (read_wr.num_sge < chl_map->ch[ch_no].count) {
+ 			chl_map->ch[ch_no].count -= read_wr.num_sge;
+@@ -609,7 +609,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
+ 				  dto_q);
+ 		list_del_init(&ctxt->dto_q);
+ 	} else {
+-		atomic_inc(&rdma_stat_rq_starve);
++		atomic_inc_unchecked(&rdma_stat_rq_starve);
+ 		clear_bit(XPT_DATA, &xprt->xpt_flags);
+ 		ctxt = NULL;
+ 	}
+@@ -629,7 +629,7 @@ int svc_rdma_recvfrom(struct svc_rqst *r
+ 	dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
+ 		ctxt, rdma_xprt, rqstp, ctxt->wc_status);
+ 	BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
+-	atomic_inc(&rdma_stat_recv);
++	atomic_inc_unchecked(&rdma_stat_recv);
+ 
+ 	/* Build up the XDR from the receive buffers. */
+ 	rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
+diff -urNp linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_sendto.c
+--- linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_sendto.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_sendto.c	2011-04-28 19:57:25.000000000 -0400
+@@ -362,7 +362,7 @@ static int send_write(struct svcxprt_rdm
+ 	write_wr.wr.rdma.remote_addr = to;
+ 
+ 	/* Post It */
+-	atomic_inc(&rdma_stat_write);
++	atomic_inc_unchecked(&rdma_stat_write);
+ 	if (svc_rdma_send(xprt, &write_wr))
+ 		goto err;
+ 	return 0;
+diff -urNp linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_transport.c
+--- linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_transport.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sunrpc/xprtrdma/svc_rdma_transport.c	2011-04-28 19:57:25.000000000 -0400
+@@ -298,7 +298,7 @@ static void rq_cq_reap(struct svcxprt_rd
+ 		return;
+ 
+ 	ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
+-	atomic_inc(&rdma_stat_rq_poll);
++	atomic_inc_unchecked(&rdma_stat_rq_poll);
+ 
+ 	while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
+ 		ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
+@@ -320,7 +320,7 @@ static void rq_cq_reap(struct svcxprt_rd
+ 	}
+ 
+ 	if (ctxt)
+-		atomic_inc(&rdma_stat_rq_prod);
++		atomic_inc_unchecked(&rdma_stat_rq_prod);
+ 
+ 	set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
+ 	/*
+@@ -392,7 +392,7 @@ static void sq_cq_reap(struct svcxprt_rd
+ 		return;
+ 
+ 	ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
+-	atomic_inc(&rdma_stat_sq_poll);
++	atomic_inc_unchecked(&rdma_stat_sq_poll);
+ 	while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
+ 		if (wc.status != IB_WC_SUCCESS)
+ 			/* Close the transport */
+@@ -410,7 +410,7 @@ static void sq_cq_reap(struct svcxprt_rd
+ 	}
+ 
+ 	if (ctxt)
+-		atomic_inc(&rdma_stat_sq_prod);
++		atomic_inc_unchecked(&rdma_stat_sq_prod);
+ }
+ 
+ static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
+@@ -1271,7 +1271,7 @@ int svc_rdma_send(struct svcxprt_rdma *x
+ 		spin_lock_bh(&xprt->sc_lock);
+ 		if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
+ 			spin_unlock_bh(&xprt->sc_lock);
+-			atomic_inc(&rdma_stat_sq_starve);
++			atomic_inc_unchecked(&rdma_stat_sq_starve);
+ 
+ 			/* See if we can opportunistically reap SQ WR to make room */
+ 			sq_cq_reap(xprt);
+diff -urNp linux-2.6.38.7/net/sysctl_net.c linux-2.6.38.7/net/sysctl_net.c
+--- linux-2.6.38.7/net/sysctl_net.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/sysctl_net.c	2011-04-28 19:34:15.000000000 -0400
 @@ -46,7 +46,7 @@ static int net_ctl_permissions(struct ct
  			       struct ctl_table *table)
  {
@@ -57785,25 +69711,10 @@ diff -urNp linux-2.6.38.2/net/sysctl_net.c linux-2.6.38.2/net/sysctl_net.c
  		int mode = (table->mode >> 6) & 7;
  		return (mode << 6) | (mode << 3) | mode;
  	}
-diff -urNp linux-2.6.38.2/net/tipc/socket.c linux-2.6.38.2/net/tipc/socket.c
---- linux-2.6.38.2/net/tipc/socket.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/tipc/socket.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1447,8 +1447,9 @@ static int connect(struct socket *sock, 
- 	} else {
- 		if (res == 0)
- 			res = -ETIMEDOUT;
--		else
--			; /* leave "res" unchanged */
-+		else {
-+			/* leave "res" unchanged */
-+		}
- 		sock->state = SS_DISCONNECTING;
- 	}
- 
-diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
---- linux-2.6.38.2/net/unix/af_unix.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/unix/af_unix.c	2011-03-21 18:31:35.000000000 -0400
-@@ -765,6 +765,12 @@ static struct sock *unix_find_other(stru
+diff -urNp linux-2.6.38.7/net/unix/af_unix.c linux-2.6.38.7/net/unix/af_unix.c
+--- linux-2.6.38.7/net/unix/af_unix.c	2011-05-10 22:06:29.000000000 -0400
++++ linux-2.6.38.7/net/unix/af_unix.c	2011-05-10 22:09:03.000000000 -0400
+@@ -767,6 +767,12 @@ static struct sock *unix_find_other(stru
  		err = -ECONNREFUSED;
  		if (!S_ISSOCK(inode->i_mode))
  			goto put_fail;
@@ -57816,7 +69727,7 @@ diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
  		u = unix_find_socket_byinode(inode);
  		if (!u)
  			goto put_fail;
-@@ -785,6 +791,13 @@ static struct sock *unix_find_other(stru
+@@ -787,6 +793,13 @@ static struct sock *unix_find_other(stru
  		if (u) {
  			struct dentry *dentry;
  			dentry = unix_sk(u)->dentry;
@@ -57830,7 +69741,7 @@ diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
  			if (dentry)
  				touch_atime(unix_sk(u)->mnt, dentry);
  		} else
-@@ -870,11 +883,18 @@ static int unix_bind(struct socket *sock
+@@ -872,11 +885,18 @@ static int unix_bind(struct socket *sock
  		err = security_path_mknod(&nd.path, dentry, mode, 0);
  		if (err)
  			goto out_mknod_drop_write;
@@ -57849,7 +69760,7 @@ diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
  		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
  		dput(nd.path.dentry);
  		nd.path.dentry = dentry;
-@@ -892,6 +912,11 @@ out_mknod_drop_write:
+@@ -894,6 +914,11 @@ out_mknod_drop_write:
  			goto out_unlock;
  		}
  
@@ -57861,7 +69772,7 @@ diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
  		list = &unix_socket_table[addr->hash];
  	} else {
  		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
-@@ -2235,7 +2260,11 @@ static int unix_seq_show(struct seq_file
+@@ -2249,7 +2274,11 @@ static int unix_seq_show(struct seq_file
  		unix_state_lock(s);
  
  		seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
@@ -57873,21 +69784,9 @@ diff -urNp linux-2.6.38.2/net/unix/af_unix.c linux-2.6.38.2/net/unix/af_unix.c
  			atomic_read(&s->sk_refcnt),
  			0,
  			s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
-diff -urNp linux-2.6.38.2/net/wireless/reg.c linux-2.6.38.2/net/wireless/reg.c
---- linux-2.6.38.2/net/wireless/reg.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/wireless/reg.c	2011-03-21 18:31:35.000000000 -0400
-@@ -54,7 +54,7 @@
- 		printk(KERN_DEBUG pr_fmt(format), ##args);	\
- 	} while (0)
- #else
--#define REG_DBG_PRINT(args...)
-+#define REG_DBG_PRINT(args...) do {} while (0)
- #endif
- 
- /* Receipt of information from last regulatory request */
-diff -urNp linux-2.6.38.2/net/wireless/wext-core.c linux-2.6.38.2/net/wireless/wext-core.c
---- linux-2.6.38.2/net/wireless/wext-core.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/wireless/wext-core.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/wireless/wext-core.c linux-2.6.38.7/net/wireless/wext-core.c
+--- linux-2.6.38.7/net/wireless/wext-core.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/wireless/wext-core.c	2011-04-28 19:34:15.000000000 -0400
 @@ -746,8 +746,7 @@ static int ioctl_standard_iw_point(struc
  		 */
  
@@ -57921,22 +69820,27 @@ diff -urNp linux-2.6.38.2/net/wireless/wext-core.c linux-2.6.38.2/net/wireless/w
  	err = handler(dev, info, (union iwreq_data *) iwp, extra);
  
  	iwp->length += essid_compat;
-diff -urNp linux-2.6.38.2/net/x25/x25_facilities.c linux-2.6.38.2/net/x25/x25_facilities.c
---- linux-2.6.38.2/net/x25/x25_facilities.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/x25/x25_facilities.c	2011-03-21 18:31:35.000000000 -0400
-@@ -167,7 +167,8 @@ int x25_parse_facilities(struct sk_buff 
- 				break;
- 			default:
- 				printk(KERN_DEBUG "X.25: unknown facility %02X,"
--					"length %d\n", p[0], p[1]);
-+					"length %d, values %02X, %02X\n",
-+					p[0], p[1], p[2], p[3]);
- 				break;
- 			}
- 			len -= p[1] + 2;
-diff -urNp linux-2.6.38.2/net/xfrm/xfrm_policy.c linux-2.6.38.2/net/xfrm/xfrm_policy.c
---- linux-2.6.38.2/net/xfrm/xfrm_policy.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/net/xfrm/xfrm_policy.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/net/xfrm/xfrm_policy.c linux-2.6.38.7/net/xfrm/xfrm_policy.c
+--- linux-2.6.38.7/net/xfrm/xfrm_policy.c	2011-04-22 19:20:59.000000000 -0400
++++ linux-2.6.38.7/net/xfrm/xfrm_policy.c	2011-04-28 19:57:25.000000000 -0400
+@@ -296,7 +296,7 @@ static void xfrm_policy_kill(struct xfrm
+ {
+ 	policy->walk.dead = 1;
+ 
+-	atomic_inc(&policy->genid);
++	atomic_inc_unchecked(&policy->genid);
+ 
+ 	if (del_timer(&policy->timer))
+ 		xfrm_pol_put(policy);
+@@ -575,7 +575,7 @@ int xfrm_policy_insert(int dir, struct x
+ 		hlist_add_head(&policy->bydst, chain);
+ 	xfrm_pol_hold(policy);
+ 	net->xfrm.policy_count[dir]++;
+-	atomic_inc(&flow_cache_genid);
++	atomic_inc_unchecked(&flow_cache_genid);
+ 	if (delpol)
+ 		__xfrm_policy_unlink(delpol, dir);
+ 	policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
 @@ -1507,7 +1507,7 @@ free_dst:
  	goto out;
  }
@@ -57964,9 +69868,57 @@ diff -urNp linux-2.6.38.2/net/xfrm/xfrm_policy.c linux-2.6.38.2/net/xfrm/xfrm_po
  xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
  {
  #ifdef CONFIG_XFRM_SUB_POLICY
-diff -urNp linux-2.6.38.2/scripts/basic/fixdep.c linux-2.6.38.2/scripts/basic/fixdep.c
---- linux-2.6.38.2/scripts/basic/fixdep.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/basic/fixdep.c	2011-03-21 18:31:35.000000000 -0400
+@@ -1625,7 +1625,7 @@ xfrm_resolve_and_create_bundle(struct xf
+ 
+ 	xdst->num_pols = num_pols;
+ 	memcpy(xdst->pols, pols, sizeof(struct xfrm_policy*) * num_pols);
+-	xdst->policy_genid = atomic_read(&pols[0]->genid);
++	xdst->policy_genid = atomic_read_unchecked(&pols[0]->genid);
+ 
+ 	return xdst;
+ }
+@@ -2319,7 +2319,7 @@ static int xfrm_bundle_ok(struct xfrm_po
+ 		if (xdst->xfrm_genid != dst->xfrm->genid)
+ 			return 0;
+ 		if (xdst->num_pols > 0 &&
+-		    xdst->policy_genid != atomic_read(&xdst->pols[0]->genid))
++		    xdst->policy_genid != atomic_read_unchecked(&xdst->pols[0]->genid))
+ 			return 0;
+ 
+ 		if (strict && fl &&
+@@ -2852,7 +2852,7 @@ static int xfrm_policy_migrate(struct xf
+ 			       sizeof(pol->xfrm_vec[i].saddr));
+ 			pol->xfrm_vec[i].encap_family = mp->new_family;
+ 			/* flush bundles */
+-			atomic_inc(&pol->genid);
++			atomic_inc_unchecked(&pol->genid);
+ 		}
+ 	}
+ 
+diff -urNp linux-2.6.38.7/net/xfrm/xfrm_user.c linux-2.6.38.7/net/xfrm/xfrm_user.c
+--- linux-2.6.38.7/net/xfrm/xfrm_user.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/net/xfrm/xfrm_user.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1309,6 +1309,8 @@ static int copy_to_user_tmpl(struct xfrm
+ 	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
+ 	int i;
+ 
++	pax_track_stack();
++
+ 	if (xp->xfrm_nr == 0)
+ 		return 0;
+ 
+@@ -1957,6 +1959,8 @@ static int xfrm_do_migrate(struct sk_buf
+ 	int err;
+ 	int n = 0;
+ 
++	pax_track_stack();
++
+ 	if (attrs[XFRMA_MIGRATE] == NULL)
+ 		return -EINVAL;
+ 
+diff -urNp linux-2.6.38.7/scripts/basic/fixdep.c linux-2.6.38.7/scripts/basic/fixdep.c
+--- linux-2.6.38.7/scripts/basic/fixdep.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/basic/fixdep.c	2011-04-28 19:34:15.000000000 -0400
 @@ -235,9 +235,9 @@ static void use_config(const char *m, in
  
  static void parse_config_file(const char *map, size_t len)
@@ -57988,27 +69940,9 @@ diff -urNp linux-2.6.38.2/scripts/basic/fixdep.c linux-2.6.38.2/scripts/basic/fi
  
  	if (*p != INT_CONF) {
  		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
-diff -urNp linux-2.6.38.2/scripts/kallsyms.c linux-2.6.38.2/scripts/kallsyms.c
---- linux-2.6.38.2/scripts/kallsyms.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/kallsyms.c	2011-03-21 18:31:35.000000000 -0400
-@@ -43,10 +43,10 @@ struct text_range {
- 
- static unsigned long long _text;
- static struct text_range text_ranges[] = {
--	{ "_stext",     "_etext"     },
--	{ "_sinittext", "_einittext" },
--	{ "_stext_l1",  "_etext_l1"  },	/* Blackfin on-chip L1 inst SRAM */
--	{ "_stext_l2",  "_etext_l2"  },	/* Blackfin on-chip L2 SRAM */
-+	{ "_stext",     "_etext",     0, 0 },
-+	{ "_sinittext", "_einittext", 0, 0 },
-+	{ "_stext_l1",  "_etext_l1",  0, 0 },	/* Blackfin on-chip L1 inst SRAM */
-+	{ "_stext_l2",  "_etext_l2",  0, 0 },	/* Blackfin on-chip L2 SRAM */
- };
- #define text_range_text     (&text_ranges[0])
- #define text_range_inittext (&text_ranges[1])
-diff -urNp linux-2.6.38.2/scripts/mod/file2alias.c linux-2.6.38.2/scripts/mod/file2alias.c
---- linux-2.6.38.2/scripts/mod/file2alias.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/mod/file2alias.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/scripts/mod/file2alias.c linux-2.6.38.7/scripts/mod/file2alias.c
+--- linux-2.6.38.7/scripts/mod/file2alias.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/mod/file2alias.c	2011-04-28 19:34:15.000000000 -0400
 @@ -72,7 +72,7 @@ static void device_id_check(const char *
  			    unsigned long size, unsigned long id_size,
  			    void *symval)
@@ -58063,9 +69997,9 @@ diff -urNp linux-2.6.38.2/scripts/mod/file2alias.c linux-2.6.38.2/scripts/mod/fi
  
  	sprintf(alias, "dmi*");
  
-diff -urNp linux-2.6.38.2/scripts/mod/modpost.c linux-2.6.38.2/scripts/mod/modpost.c
---- linux-2.6.38.2/scripts/mod/modpost.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/mod/modpost.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/scripts/mod/modpost.c linux-2.6.38.7/scripts/mod/modpost.c
+--- linux-2.6.38.7/scripts/mod/modpost.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/mod/modpost.c	2011-04-28 19:34:15.000000000 -0400
 @@ -896,6 +896,7 @@ enum mismatch {
  	ANY_INIT_TO_ANY_EXIT,
  	ANY_EXIT_TO_ANY_INIT,
@@ -58133,9 +70067,9 @@ diff -urNp linux-2.6.38.2/scripts/mod/modpost.c linux-2.6.38.2/scripts/mod/modpo
  		goto close_write;
  
  	tmp = NOFAIL(malloc(b->pos));
-diff -urNp linux-2.6.38.2/scripts/mod/modpost.h linux-2.6.38.2/scripts/mod/modpost.h
---- linux-2.6.38.2/scripts/mod/modpost.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/mod/modpost.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/scripts/mod/modpost.h linux-2.6.38.7/scripts/mod/modpost.h
+--- linux-2.6.38.7/scripts/mod/modpost.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/mod/modpost.h	2011-04-28 19:34:15.000000000 -0400
 @@ -92,15 +92,15 @@ void *do_nofail(void *ptr, const char *e
  
  struct buffer {
@@ -58155,9 +70089,9 @@ diff -urNp linux-2.6.38.2/scripts/mod/modpost.h linux-2.6.38.2/scripts/mod/modpo
  
  struct module {
  	struct module *next;
-diff -urNp linux-2.6.38.2/scripts/mod/sumversion.c linux-2.6.38.2/scripts/mod/sumversion.c
---- linux-2.6.38.2/scripts/mod/sumversion.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/mod/sumversion.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/scripts/mod/sumversion.c linux-2.6.38.7/scripts/mod/sumversion.c
+--- linux-2.6.38.7/scripts/mod/sumversion.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/mod/sumversion.c	2011-04-28 19:34:15.000000000 -0400
 @@ -470,7 +470,7 @@ static void write_version(const char *fi
  		goto out;
  	}
@@ -58167,9 +70101,9 @@ diff -urNp linux-2.6.38.2/scripts/mod/sumversion.c linux-2.6.38.2/scripts/mod/su
  		warn("writing sum in %s failed: %s\n",
  			filename, strerror(errno));
  		goto out;
-diff -urNp linux-2.6.38.2/scripts/pnmtologo.c linux-2.6.38.2/scripts/pnmtologo.c
---- linux-2.6.38.2/scripts/pnmtologo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/scripts/pnmtologo.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/scripts/pnmtologo.c linux-2.6.38.7/scripts/pnmtologo.c
+--- linux-2.6.38.7/scripts/pnmtologo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/scripts/pnmtologo.c	2011-04-28 19:34:15.000000000 -0400
 @@ -237,14 +237,14 @@ static void write_header(void)
      fprintf(out, " *  Linux logo %s\n", logoname);
      fputs(" */\n\n", out);
@@ -58196,9 +70130,9 @@ diff -urNp linux-2.6.38.2/scripts/pnmtologo.c linux-2.6.38.2/scripts/pnmtologo.c
  	    logoname);
      write_hex_cnt = 0;
      for (i = 0; i < logo_clutsize; i++) {
-diff -urNp linux-2.6.38.2/security/apparmor/lsm.c linux-2.6.38.2/security/apparmor/lsm.c
---- linux-2.6.38.2/security/apparmor/lsm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/apparmor/lsm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/apparmor/lsm.c linux-2.6.38.7/security/apparmor/lsm.c
+--- linux-2.6.38.7/security/apparmor/lsm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/apparmor/lsm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -619,7 +619,7 @@ static int apparmor_task_setrlimit(struc
  	return error;
  }
@@ -58208,9 +70142,9 @@ diff -urNp linux-2.6.38.2/security/apparmor/lsm.c linux-2.6.38.2/security/apparm
  	.name =				"apparmor",
  
  	.ptrace_access_check =		apparmor_ptrace_access_check,
-diff -urNp linux-2.6.38.2/security/commoncap.c linux-2.6.38.2/security/commoncap.c
---- linux-2.6.38.2/security/commoncap.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/commoncap.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/commoncap.c linux-2.6.38.7/security/commoncap.c
+--- linux-2.6.38.7/security/commoncap.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/commoncap.c	2011-04-28 19:34:15.000000000 -0400
 @@ -27,6 +27,7 @@
  #include <linux/sched.h>
  #include <linux/prctl.h>
@@ -58242,9 +70176,9 @@ diff -urNp linux-2.6.38.2/security/commoncap.c linux-2.6.38.2/security/commoncap
  	if (cred->uid != 0) {
  		if (bprm->cap_effective)
  			return 1;
-diff -urNp linux-2.6.38.2/security/integrity/ima/ima_api.c linux-2.6.38.2/security/integrity/ima/ima_api.c
---- linux-2.6.38.2/security/integrity/ima/ima_api.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/integrity/ima/ima_api.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/integrity/ima/ima_api.c linux-2.6.38.7/security/integrity/ima/ima_api.c
+--- linux-2.6.38.7/security/integrity/ima/ima_api.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/integrity/ima/ima_api.c	2011-04-28 19:34:15.000000000 -0400
 @@ -75,7 +75,7 @@ void ima_add_violation(struct inode *ino
  	int result;
  
@@ -58254,9 +70188,9 @@ diff -urNp linux-2.6.38.2/security/integrity/ima/ima_api.c linux-2.6.38.2/securi
  
  	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
  	if (!entry) {
-diff -urNp linux-2.6.38.2/security/integrity/ima/ima_fs.c linux-2.6.38.2/security/integrity/ima/ima_fs.c
---- linux-2.6.38.2/security/integrity/ima/ima_fs.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/integrity/ima/ima_fs.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/integrity/ima/ima_fs.c linux-2.6.38.7/security/integrity/ima/ima_fs.c
+--- linux-2.6.38.7/security/integrity/ima/ima_fs.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/integrity/ima/ima_fs.c	2011-04-28 19:34:15.000000000 -0400
 @@ -28,12 +28,12 @@
  static int valid_policy = 1;
  #define TMPBUFLEN 12
@@ -58272,9 +70206,9 @@ diff -urNp linux-2.6.38.2/security/integrity/ima/ima_fs.c linux-2.6.38.2/securit
  	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
  }
  
-diff -urNp linux-2.6.38.2/security/integrity/ima/ima.h linux-2.6.38.2/security/integrity/ima/ima.h
---- linux-2.6.38.2/security/integrity/ima/ima.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/integrity/ima/ima.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/integrity/ima/ima.h linux-2.6.38.7/security/integrity/ima/ima.h
+--- linux-2.6.38.7/security/integrity/ima/ima.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/integrity/ima/ima.h	2011-04-28 19:34:15.000000000 -0400
 @@ -85,8 +85,8 @@ void ima_add_violation(struct inode *ino
  extern spinlock_t ima_queue_lock;
  
@@ -58286,9 +70220,9 @@ diff -urNp linux-2.6.38.2/security/integrity/ima/ima.h linux-2.6.38.2/security/i
  	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
  };
  extern struct ima_h_table ima_htable;
-diff -urNp linux-2.6.38.2/security/integrity/ima/ima_queue.c linux-2.6.38.2/security/integrity/ima/ima_queue.c
---- linux-2.6.38.2/security/integrity/ima/ima_queue.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/integrity/ima/ima_queue.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/integrity/ima/ima_queue.c linux-2.6.38.7/security/integrity/ima/ima_queue.c
+--- linux-2.6.38.7/security/integrity/ima/ima_queue.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/integrity/ima/ima_queue.c	2011-04-28 19:34:15.000000000 -0400
 @@ -79,7 +79,7 @@ static int ima_add_digest_entry(struct i
  	INIT_LIST_HEAD(&qe->later);
  	list_add_tail_rcu(&qe->later, &ima_measurements);
@@ -58298,10 +70232,10 @@ diff -urNp linux-2.6.38.2/security/integrity/ima/ima_queue.c linux-2.6.38.2/secu
  	key = ima_hash_key(entry->digest);
  	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
  	return 0;
-diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
---- linux-2.6.38.2/security/Kconfig	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/Kconfig	2011-03-21 18:31:35.000000000 -0400
-@@ -4,6 +4,527 @@
+diff -urNp linux-2.6.38.7/security/Kconfig linux-2.6.38.7/security/Kconfig
+--- linux-2.6.38.7/security/Kconfig	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/Kconfig	2011-04-30 19:58:48.000000000 -0400
+@@ -4,6 +4,548 @@
  
  menu "Security options"
  
@@ -58360,10 +70294,6 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  know about the non-standard use of the ELF header) therefore it
 +	  has been deprecated in favour of PT_PAX_FLAGS support.
 +
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable this option otherwise they
-+	  will not get any protection.
-+
 +	  Note that if you enable PT_PAX_FLAGS marking support as well,
 +	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
 +
@@ -58378,9 +70308,8 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  integrated into the toolchain (the binutils patch is available
 +	  from http://pax.grsecurity.net).
 +
-+	  If you have applications not marked by the PT_PAX_FLAGS ELF
-+	  program header then you MUST enable the EI_PAX marking support
-+	  otherwise they will not get any protection.
++	  If your toolchain does not support PT_PAX_FLAGS markings,
++	  you can create one in most cases with 'paxctl -C'.
 +
 +	  Note that if you enable the legacy EI_PAX marking support as well,
 +	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
@@ -58632,6 +70561,9 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  that is, enabling this option will make it harder to inject
 +	  and execute 'foreign' code in kernel memory itself.
 +
++	  Note that on x86_64 kernels there is a known regression when
++	  this feature and KVM/VMX are both enabled in the host kernel.
++
 +config PAX_KERNEXEC_MODULE_TEXT
 +	int "Minimum amount of memory reserved for module code"
 +	default "4"
@@ -58689,7 +70621,7 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +
 +config PAX_RANDKSTACK
 +	bool "Randomize kernel stack base"
-+	depends on PAX_ASLR && X86_TSC && X86_32
++	depends on PAX_ASLR && X86_TSC && X86
 +	help
 +	  By saying Y here the kernel will randomize every task's kernel
 +	  stack on every system call.  This will not only force an attacker
@@ -58760,6 +70692,24 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  Note that this feature does not protect data stored in live pages,
 +	  e.g., process memory swapped to disk may stay there for a long time.
 +
++config PAX_MEMORY_STACKLEAK
++	bool "Sanitize kernel stack"
++	depends on X86
++	help
++	  By saying Y here the kernel will erase the kernel stack before it
++	  returns from a system call.  This in turn reduces the information
++	  that a kernel stack leak bug can reveal.
++
++	  Note that such a bug can still leak information that was put on
++	  the stack by the current system call (the one eventually triggering
++	  the bug) but traces of earlier system calls on the kernel stack
++	  cannot leak anymore.
++
++	  The tradeoff is performance impact: on a single CPU system kernel
++	  compilation sees a 1% slowdown, other systems and workloads may vary
++	  and you are advised to test this feature on your expected workload
++	  before deploying it.
++
 +config PAX_MEMORY_UDEREF
 +	bool "Prevent invalid userland pointer dereference"
 +	depends on X86 && !UML_X86 && !XEN
@@ -58799,9 +70749,9 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  this feature.
 +
 +config PAX_USERCOPY
-+	bool "Bounds check heap object copies between kernel and userland"
++	bool "Harden heap object copies between kernel and userland"
 +	depends on X86 || PPC || SPARC
-+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
++	depends on GRKERNSEC && (SLAB || SLUB)
 +	help
 +	  By saying Y here the kernel will enforce the size of heap objects
 +	  when they are copied in either direction between the kernel and
@@ -58812,8 +70762,13 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
 +	  object is otherwise fully initialized) and prevents kernel heap
 +	  overflows during userland to kernel copies.
 +
-+	  Note that the current implementation provides the strictest checks
-+	  for the SLUB allocator.
++	  Note that the current implementation provides the strictest bounds
++	  checks for the SLUB allocator.
++
++	  Enabling this option also enables per-slab cache protection against
++	  data in a given cache being copied into/out of via userland
++	  accessors.  Though the whitelist of regions will be reduced over
++	  time, it notably protects important data structures like task structs.
 +
 +	  If frame pointers are enabled on x86, this option will also restrict
 +	  copies into and out of the kernel stack to local variables within a
@@ -58829,7 +70784,7 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
  config KEYS
  	bool "Enable access key retention support"
  	help
-@@ -167,7 +688,7 @@ config INTEL_TXT
+@@ -167,7 +709,7 @@ config INTEL_TXT
  config LSM_MMAP_MIN_ADDR
  	int "Low address space for LSM to protect from user allocation"
  	depends on SECURITY && SECURITY_SELINUX
@@ -58838,9 +70793,31 @@ diff -urNp linux-2.6.38.2/security/Kconfig linux-2.6.38.2/security/Kconfig
  	help
  	  This is the portion of low virtual memory which should be protected
  	  from userspace allocation.  Keeping a user from writing to low pages
-diff -urNp linux-2.6.38.2/security/min_addr.c linux-2.6.38.2/security/min_addr.c
---- linux-2.6.38.2/security/min_addr.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/min_addr.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/keys/keyring.c linux-2.6.38.7/security/keys/keyring.c
+--- linux-2.6.38.7/security/keys/keyring.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/keys/keyring.c	2011-04-28 19:34:15.000000000 -0400
+@@ -213,15 +213,15 @@ static long keyring_read(const struct ke
+ 			ret = -EFAULT;
+ 
+ 			for (loop = 0; loop < klist->nkeys; loop++) {
++				key_serial_t serial;
+ 				key = klist->keys[loop];
++				serial = key->serial;
+ 
+ 				tmp = sizeof(key_serial_t);
+ 				if (tmp > buflen)
+ 					tmp = buflen;
+ 
+-				if (copy_to_user(buffer,
+-						 &key->serial,
+-						 tmp) != 0)
++				if (copy_to_user(buffer, &serial, tmp))
+ 					goto error;
+ 
+ 				buflen -= tmp;
+diff -urNp linux-2.6.38.7/security/min_addr.c linux-2.6.38.7/security/min_addr.c
+--- linux-2.6.38.7/security/min_addr.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/min_addr.c	2011-04-28 19:34:15.000000000 -0400
 @@ -14,6 +14,7 @@ unsigned long dac_mmap_min_addr = CONFIG
   */
  static void update_mmap_min_addr(void)
@@ -58857,9 +70834,9 @@ diff -urNp linux-2.6.38.2/security/min_addr.c linux-2.6.38.2/security/min_addr.c
  }
  
  /*
-diff -urNp linux-2.6.38.2/security/security.c linux-2.6.38.2/security/security.c
---- linux-2.6.38.2/security/security.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/security.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/security.c linux-2.6.38.7/security/security.c
+--- linux-2.6.38.7/security/security.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/security.c	2011-04-28 19:34:15.000000000 -0400
 @@ -25,8 +25,8 @@ static __initdata char chosen_lsm[SECURI
  /* things that live in capability.c */
  extern void __init security_fixup_ops(struct security_operations *ops);
@@ -58881,9 +70858,9 @@ diff -urNp linux-2.6.38.2/security/security.c linux-2.6.38.2/security/security.c
  }
  
  /* Save user chosen LSM */
-diff -urNp linux-2.6.38.2/security/selinux/hooks.c linux-2.6.38.2/security/selinux/hooks.c
---- linux-2.6.38.2/security/selinux/hooks.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/selinux/hooks.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/selinux/hooks.c linux-2.6.38.7/security/selinux/hooks.c
+--- linux-2.6.38.7/security/selinux/hooks.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/selinux/hooks.c	2011-04-28 19:34:15.000000000 -0400
 @@ -90,7 +90,6 @@
  #define NUM_SEL_MNT_OPTS 5
  
@@ -58901,9 +70878,33 @@ diff -urNp linux-2.6.38.2/security/selinux/hooks.c linux-2.6.38.2/security/selin
  	.name =				"selinux",
  
  	.ptrace_access_check =		selinux_ptrace_access_check,
-diff -urNp linux-2.6.38.2/security/smack/smack_lsm.c linux-2.6.38.2/security/smack/smack_lsm.c
---- linux-2.6.38.2/security/smack/smack_lsm.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/smack/smack_lsm.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/selinux/include/xfrm.h linux-2.6.38.7/security/selinux/include/xfrm.h
+--- linux-2.6.38.7/security/selinux/include/xfrm.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/selinux/include/xfrm.h	2011-05-18 20:23:44.000000000 -0400
+@@ -48,7 +48,7 @@ int selinux_xfrm_decode_session(struct s
+ 
+ static inline void selinux_xfrm_notify_policyload(void)
+ {
+-	atomic_inc(&flow_cache_genid);
++	atomic_inc_unchecked(&flow_cache_genid);
+ }
+ #else
+ static inline int selinux_xfrm_enabled(void)
+diff -urNp linux-2.6.38.7/security/selinux/ss/services.c linux-2.6.38.7/security/selinux/ss/services.c
+--- linux-2.6.38.7/security/selinux/ss/services.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/selinux/ss/services.c	2011-05-16 21:47:09.000000000 -0400
+@@ -1769,6 +1769,8 @@ int security_load_policy(void *data, siz
+ 	int rc = 0;
+ 	struct policy_file file = { data, len }, *fp = &file;
+ 
++	pax_track_stack();
++
+ 	if (!ss_initialized) {
+ 		avtab_cache_init();
+ 		rc = policydb_read(&policydb, fp);
+diff -urNp linux-2.6.38.7/security/smack/smack_lsm.c linux-2.6.38.7/security/smack/smack_lsm.c
+--- linux-2.6.38.7/security/smack/smack_lsm.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/smack/smack_lsm.c	2011-04-28 19:34:15.000000000 -0400
 @@ -3179,7 +3179,7 @@ static int smack_inode_getsecctx(struct 
  	return 0;
  }
@@ -58913,9 +70914,9 @@ diff -urNp linux-2.6.38.2/security/smack/smack_lsm.c linux-2.6.38.2/security/sma
  	.name =				"smack",
  
  	.ptrace_access_check =		smack_ptrace_access_check,
-diff -urNp linux-2.6.38.2/security/tomoyo/tomoyo.c linux-2.6.38.2/security/tomoyo/tomoyo.c
---- linux-2.6.38.2/security/tomoyo/tomoyo.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/security/tomoyo/tomoyo.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/security/tomoyo/tomoyo.c linux-2.6.38.7/security/tomoyo/tomoyo.c
+--- linux-2.6.38.7/security/tomoyo/tomoyo.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/security/tomoyo/tomoyo.c	2011-04-28 19:34:15.000000000 -0400
 @@ -240,7 +240,7 @@ static int tomoyo_sb_pivotroot(struct pa
   * tomoyo_security_ops is a "struct security_operations" which is used for
   * registering TOMOYO.
@@ -58925,9 +70926,9 @@ diff -urNp linux-2.6.38.2/security/tomoyo/tomoyo.c linux-2.6.38.2/security/tomoy
  	.name                = "tomoyo",
  	.cred_alloc_blank    = tomoyo_cred_alloc_blank,
  	.cred_prepare        = tomoyo_cred_prepare,
-diff -urNp linux-2.6.38.2/sound/aoa/codecs/onyx.c linux-2.6.38.2/sound/aoa/codecs/onyx.c
---- linux-2.6.38.2/sound/aoa/codecs/onyx.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/aoa/codecs/onyx.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/aoa/codecs/onyx.c linux-2.6.38.7/sound/aoa/codecs/onyx.c
+--- linux-2.6.38.7/sound/aoa/codecs/onyx.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/aoa/codecs/onyx.c	2011-04-28 19:34:15.000000000 -0400
 @@ -54,7 +54,7 @@ struct onyx {
  				spdif_locked:1,
  				analog_locked:1,
@@ -58956,9 +70957,9 @@ diff -urNp linux-2.6.38.2/sound/aoa/codecs/onyx.c linux-2.6.38.2/sound/aoa/codec
  		onyx->spdif_locked = onyx->analog_locked = 0;
  	mutex_unlock(&onyx->mutex);
  
-diff -urNp linux-2.6.38.2/sound/aoa/codecs/onyx.h linux-2.6.38.2/sound/aoa/codecs/onyx.h
---- linux-2.6.38.2/sound/aoa/codecs/onyx.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/aoa/codecs/onyx.h	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/aoa/codecs/onyx.h linux-2.6.38.7/sound/aoa/codecs/onyx.h
+--- linux-2.6.38.7/sound/aoa/codecs/onyx.h	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/aoa/codecs/onyx.h	2011-04-28 19:34:15.000000000 -0400
 @@ -11,6 +11,7 @@
  #include <linux/i2c.h>
  #include <asm/pmac_low_i2c.h>
@@ -58967,41 +70968,9 @@ diff -urNp linux-2.6.38.2/sound/aoa/codecs/onyx.h linux-2.6.38.2/sound/aoa/codec
  
  /* PCM3052 register definitions */
  
-diff -urNp linux-2.6.38.2/sound/core/oss/pcm_oss.c linux-2.6.38.2/sound/core/oss/pcm_oss.c
---- linux-2.6.38.2/sound/core/oss/pcm_oss.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/core/oss/pcm_oss.c	2011-03-21 18:31:35.000000000 -0400
-@@ -2971,8 +2971,8 @@ static void snd_pcm_oss_proc_done(struct
- 	}
- }
- #else /* !CONFIG_SND_VERBOSE_PROCFS */
--#define snd_pcm_oss_proc_init(pcm)
--#define snd_pcm_oss_proc_done(pcm)
-+#define snd_pcm_oss_proc_init(pcm) do {} while (0)
-+#define snd_pcm_oss_proc_done(pcm) do {} while (0)
- #endif /* CONFIG_SND_VERBOSE_PROCFS */
- 
- /*
-diff -urNp linux-2.6.38.2/sound/core/seq/seq_lock.h linux-2.6.38.2/sound/core/seq/seq_lock.h
---- linux-2.6.38.2/sound/core/seq/seq_lock.h	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/core/seq/seq_lock.h	2011-03-21 18:31:35.000000000 -0400
-@@ -23,10 +23,10 @@ void snd_use_lock_sync_helper(snd_use_lo
- #else /* SMP || CONFIG_SND_DEBUG */
- 
- typedef spinlock_t snd_use_lock_t;	/* dummy */
--#define snd_use_lock_init(lockp) /**/
--#define snd_use_lock_use(lockp) /**/
--#define snd_use_lock_free(lockp) /**/
--#define snd_use_lock_sync(lockp) /**/
-+#define snd_use_lock_init(lockp) do {} while (0)
-+#define snd_use_lock_use(lockp) do {} while (0)
-+#define snd_use_lock_free(lockp) do {} while (0)
-+#define snd_use_lock_sync(lockp) do {} while (0)
- 
- #endif /* SMP || CONFIG_SND_DEBUG */
- 
-diff -urNp linux-2.6.38.2/sound/drivers/mts64.c linux-2.6.38.2/sound/drivers/mts64.c
---- linux-2.6.38.2/sound/drivers/mts64.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/drivers/mts64.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/drivers/mts64.c linux-2.6.38.7/sound/drivers/mts64.c
+--- linux-2.6.38.7/sound/drivers/mts64.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/drivers/mts64.c	2011-04-28 19:34:15.000000000 -0400
 @@ -28,6 +28,7 @@
  #include <sound/initval.h>
  #include <sound/rawmidi.h>
@@ -59058,9 +71027,9 @@ diff -urNp linux-2.6.38.2/sound/drivers/mts64.c linux-2.6.38.2/sound/drivers/mts
  
  	return 0;
  }
-diff -urNp linux-2.6.38.2/sound/drivers/portman2x4.c linux-2.6.38.2/sound/drivers/portman2x4.c
---- linux-2.6.38.2/sound/drivers/portman2x4.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/drivers/portman2x4.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/drivers/portman2x4.c linux-2.6.38.7/sound/drivers/portman2x4.c
+--- linux-2.6.38.7/sound/drivers/portman2x4.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/drivers/portman2x4.c	2011-04-28 19:34:15.000000000 -0400
 @@ -47,6 +47,7 @@
  #include <sound/initval.h>
  #include <sound/rawmidi.h>
@@ -59078,9 +71047,9 @@ diff -urNp linux-2.6.38.2/sound/drivers/portman2x4.c linux-2.6.38.2/sound/driver
  	int mode[PORTMAN_NUM_INPUT_PORTS];
  	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
  };
-diff -urNp linux-2.6.38.2/sound/oss/sb_audio.c linux-2.6.38.2/sound/oss/sb_audio.c
---- linux-2.6.38.2/sound/oss/sb_audio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/oss/sb_audio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/oss/sb_audio.c linux-2.6.38.7/sound/oss/sb_audio.c
+--- linux-2.6.38.7/sound/oss/sb_audio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/oss/sb_audio.c	2011-04-28 19:34:15.000000000 -0400
 @@ -901,7 +901,7 @@ sb16_copy_from_user(int dev,
  		buf16 = (signed short *)(localbuf + localoffs);
  		while (c)
@@ -59090,9 +71059,9 @@ diff -urNp linux-2.6.38.2/sound/oss/sb_audio.c linux-2.6.38.2/sound/oss/sb_audio
  			if (copy_from_user(lbuf8,
  					   userbuf+useroffs + p,
  					   locallen))
-diff -urNp linux-2.6.38.2/sound/oss/swarm_cs4297a.c linux-2.6.38.2/sound/oss/swarm_cs4297a.c
---- linux-2.6.38.2/sound/oss/swarm_cs4297a.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/oss/swarm_cs4297a.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/oss/swarm_cs4297a.c linux-2.6.38.7/sound/oss/swarm_cs4297a.c
+--- linux-2.6.38.7/sound/oss/swarm_cs4297a.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/oss/swarm_cs4297a.c	2011-04-28 19:34:15.000000000 -0400
 @@ -2606,7 +2606,6 @@ static int __init cs4297a_init(void)
  {
  	struct cs4297a_state *s;
@@ -59127,102 +71096,64 @@ diff -urNp linux-2.6.38.2/sound/oss/swarm_cs4297a.c linux-2.6.38.2/sound/oss/swa
  
                  list_add(&s->list, &cs4297a_devs);
  
-diff -urNp linux-2.6.38.2/sound/pci/ac97/ac97_patch.c linux-2.6.38.2/sound/pci/ac97/ac97_patch.c
---- linux-2.6.38.2/sound/pci/ac97/ac97_patch.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/pci/ac97/ac97_patch.c	2011-03-21 18:31:35.000000000 -0400
-@@ -1486,7 +1486,7 @@ static const struct snd_ac97_res_table a
- 	{ AC97_VIDEO, 0x9f1f },
- 	{ AC97_AUX, 0x9f1f },
- 	{ AC97_PCM, 0x9f1f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_ad1819(struct snd_ac97 * ac97)
-@@ -3864,7 +3864,7 @@ static struct snd_ac97_res_table lm4550_
- 	{ AC97_AUX, 0x1f1f },
- 	{ AC97_PCM, 0x1f1f },
- 	{ AC97_REC_GAIN, 0x0f0f },
--	{ } /* terminator */
-+	{ 0, 0 } /* terminator */
- };
- 
- static int patch_lm4550(struct snd_ac97 *ac97)
-diff -urNp linux-2.6.38.2/sound/pci/ens1370.c linux-2.6.38.2/sound/pci/ens1370.c
---- linux-2.6.38.2/sound/pci/ens1370.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/pci/ens1370.c	2011-03-21 18:31:35.000000000 -0400
-@@ -452,7 +452,7 @@ static DEFINE_PCI_DEVICE_TABLE(snd_audio
- 	{ PCI_VDEVICE(ENSONIQ, 0x5880), 0, },	/* ES1373 - CT5880 */
- 	{ PCI_VDEVICE(ECTIVA, 0x8938), 0, },	/* Ectiva EV1938 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_audiopci_ids);
-diff -urNp linux-2.6.38.2/sound/pci/hda/patch_hdmi.c linux-2.6.38.2/sound/pci/hda/patch_hdmi.c
---- linux-2.6.38.2/sound/pci/hda/patch_hdmi.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/pci/hda/patch_hdmi.c	2011-03-21 18:31:35.000000000 -0400
-@@ -733,10 +733,10 @@ static void hdmi_non_intrinsic_event(str
- 		cp_ready);
- 
- 	/* TODO */
--	if (cp_state)
--		;
--	if (cp_ready)
--		;
-+	if (cp_state) {
-+	}
-+	if (cp_ready) {
-+	}
- }
- 
- 
-diff -urNp linux-2.6.38.2/sound/pci/intel8x0.c linux-2.6.38.2/sound/pci/intel8x0.c
---- linux-2.6.38.2/sound/pci/intel8x0.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/pci/intel8x0.c	2011-03-21 18:31:35.000000000 -0400
-@@ -444,7 +444,7 @@ static DEFINE_PCI_DEVICE_TABLE(snd_intel
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AMD, 0x7445), DEVICE_INTEL },	/* AMD768 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0_ids);
-@@ -2141,7 +2141,7 @@ static struct ac97_quirk ac97_quirks[] _
- 		.type = AC97_TUNE_HP_ONLY
- 	},
- #endif
--	{ } /* terminator */
-+	{ 0, 0, 0, 0, NULL, 0 } /* terminator */
- };
- 
- static int __devinit snd_intel8x0_mixer(struct intel8x0 *chip, int ac97_clock,
-diff -urNp linux-2.6.38.2/sound/pci/intel8x0m.c linux-2.6.38.2/sound/pci/intel8x0m.c
---- linux-2.6.38.2/sound/pci/intel8x0m.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/sound/pci/intel8x0m.c	2011-03-21 18:31:35.000000000 -0400
-@@ -239,7 +239,7 @@ static DEFINE_PCI_DEVICE_TABLE(snd_intel
- 	{ PCI_VDEVICE(AMD, 0x746d), DEVICE_INTEL },	/* AMD8111 */
- 	{ PCI_VDEVICE(AL, 0x5455), DEVICE_ALI },   /* Ali5455 */
- #endif
--	{ 0, }
-+	{ 0, 0, 0, 0, 0, 0, 0 }
- };
- 
- MODULE_DEVICE_TABLE(pci, snd_intel8x0m_ids);
+diff -urNp linux-2.6.38.7/sound/pci/intel8x0m.c linux-2.6.38.7/sound/pci/intel8x0m.c
+--- linux-2.6.38.7/sound/pci/intel8x0m.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/pci/intel8x0m.c	2011-04-28 19:34:15.000000000 -0400
 @@ -1264,7 +1264,7 @@ static struct shortname_table {
  	{ 0x5455, "ALi M5455" },
  	{ 0x746d, "AMD AMD8111" },
  #endif
 -	{ 0 },
-+	{ 0, NULL },
++	{ 0, },
  };
  
  static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
-diff -urNp linux-2.6.38.2/usr/gen_init_cpio.c linux-2.6.38.2/usr/gen_init_cpio.c
---- linux-2.6.38.2/usr/gen_init_cpio.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/usr/gen_init_cpio.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/sound/pci/ymfpci/ymfpci_main.c linux-2.6.38.7/sound/pci/ymfpci/ymfpci_main.c
+--- linux-2.6.38.7/sound/pci/ymfpci/ymfpci_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/sound/pci/ymfpci/ymfpci_main.c	2011-04-28 19:57:25.000000000 -0400
+@@ -202,8 +202,8 @@ static void snd_ymfpci_hw_stop(struct sn
+ 		if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
+ 			break;
+ 	}
+-	if (atomic_read(&chip->interrupt_sleep_count)) {
+-		atomic_set(&chip->interrupt_sleep_count, 0);
++	if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++		atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 		wake_up(&chip->interrupt_sleep);
+ 	}
+       __end:
+@@ -787,7 +787,7 @@ static void snd_ymfpci_irq_wait(struct s
+ 		 	continue;
+ 		init_waitqueue_entry(&wait, current);
+ 		add_wait_queue(&chip->interrupt_sleep, &wait);
+-		atomic_inc(&chip->interrupt_sleep_count);
++		atomic_inc_unchecked(&chip->interrupt_sleep_count);
+ 		schedule_timeout_uninterruptible(msecs_to_jiffies(50));
+ 		remove_wait_queue(&chip->interrupt_sleep, &wait);
+ 	}
+@@ -825,8 +825,8 @@ static irqreturn_t snd_ymfpci_interrupt(
+ 		snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
+ 		spin_unlock(&chip->reg_lock);
+ 
+-		if (atomic_read(&chip->interrupt_sleep_count)) {
+-			atomic_set(&chip->interrupt_sleep_count, 0);
++		if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
++			atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 			wake_up(&chip->interrupt_sleep);
+ 		}
+ 	}
+@@ -2363,7 +2363,7 @@ int __devinit snd_ymfpci_create(struct s
+ 	spin_lock_init(&chip->reg_lock);
+ 	spin_lock_init(&chip->voice_lock);
+ 	init_waitqueue_head(&chip->interrupt_sleep);
+-	atomic_set(&chip->interrupt_sleep_count, 0);
++	atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
+ 	chip->card = card;
+ 	chip->pci = pci;
+ 	chip->irq = -1;
+diff -urNp linux-2.6.38.7/usr/gen_init_cpio.c linux-2.6.38.7/usr/gen_init_cpio.c
+--- linux-2.6.38.7/usr/gen_init_cpio.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/usr/gen_init_cpio.c	2011-04-28 19:34:15.000000000 -0400
 @@ -305,7 +305,7 @@ static int cpio_mkfile(const char *name,
  	int retval;
  	int rc = -1;
@@ -59245,9 +71176,18 @@ diff -urNp linux-2.6.38.2/usr/gen_init_cpio.c linux-2.6.38.2/usr/gen_init_cpio.c
                 } else
                         break;
         }
-diff -urNp linux-2.6.38.2/virt/kvm/kvm_main.c linux-2.6.38.2/virt/kvm/kvm_main.c
---- linux-2.6.38.2/virt/kvm/kvm_main.c	2011-03-14 21:20:32.000000000 -0400
-+++ linux-2.6.38.2/virt/kvm/kvm_main.c	2011-03-21 18:31:35.000000000 -0400
+diff -urNp linux-2.6.38.7/virt/kvm/kvm_main.c linux-2.6.38.7/virt/kvm/kvm_main.c
+--- linux-2.6.38.7/virt/kvm/kvm_main.c	2011-03-14 21:20:32.000000000 -0400
++++ linux-2.6.38.7/virt/kvm/kvm_main.c	2011-04-28 19:57:25.000000000 -0400
+@@ -74,7 +74,7 @@ LIST_HEAD(vm_list);
+ 
+ static cpumask_var_t cpus_hardware_enabled;
+ static int kvm_usage_count = 0;
+-static atomic_t hardware_enable_failed;
++static atomic_unchecked_t hardware_enable_failed;
+ 
+ struct kmem_cache *kvm_vcpu_cache;
+ EXPORT_SYMBOL_GPL(kvm_vcpu_cache);
 @@ -1521,7 +1521,7 @@ static int kvm_vcpu_release(struct inode
  	return 0;
  }
@@ -59275,17 +71215,29 @@ diff -urNp linux-2.6.38.2/virt/kvm/kvm_main.c linux-2.6.38.2/virt/kvm/kvm_main.c
  	.unlocked_ioctl = kvm_dev_ioctl,
  	.compat_ioctl   = kvm_dev_ioctl,
  	.llseek		= noop_llseek,
-@@ -2098,6 +2098,9 @@ static struct miscdevice kvm_dev = {
- 	KVM_MINOR,
- 	"kvm",
- 	&kvm_chardev_ops,
-+	{NULL, NULL},
-+	NULL,
-+	NULL
- };
- 
- static void hardware_enable_nolock(void *junk)
-@@ -2443,7 +2446,7 @@ static void kvm_sched_out(struct preempt
+@@ -2114,7 +2114,7 @@ static void hardware_enable_nolock(void 
+ 
+ 	if (r) {
+ 		cpumask_clear_cpu(cpu, cpus_hardware_enabled);
+-		atomic_inc(&hardware_enable_failed);
++		atomic_inc_unchecked(&hardware_enable_failed);
+ 		printk(KERN_INFO "kvm: enabling virtualization on "
+ 				 "CPU%d failed\n", cpu);
+ 	}
+@@ -2168,10 +2168,10 @@ static int hardware_enable_all(void)
+ 
+ 	kvm_usage_count++;
+ 	if (kvm_usage_count == 1) {
+-		atomic_set(&hardware_enable_failed, 0);
++		atomic_set_unchecked(&hardware_enable_failed, 0);
+ 		on_each_cpu(hardware_enable_nolock, NULL, 1);
+ 
+-		if (atomic_read(&hardware_enable_failed)) {
++		if (atomic_read_unchecked(&hardware_enable_failed)) {
+ 			hardware_disable_all_nolock();
+ 			r = -EBUSY;
+ 		}
+@@ -2443,7 +2443,7 @@ static void kvm_sched_out(struct preempt
  	kvm_arch_vcpu_put(vcpu);
  }
  
@@ -59294,3 +71246,12 @@ diff -urNp linux-2.6.38.2/virt/kvm/kvm_main.c linux-2.6.38.2/virt/kvm/kvm_main.c
  		  struct module *module)
  {
  	int r;
+@@ -2514,7 +2514,7 @@ int kvm_init(void *opaque, unsigned vcpu
+ 	if (!vcpu_align)
+ 		vcpu_align = __alignof__(struct kvm_vcpu);
+ 	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size, vcpu_align,
+-					   0, NULL);
++					   SLAB_USERCOPY, NULL);
+ 	if (!kvm_vcpu_cache) {
+ 		r = -ENOMEM;
+ 		goto out_free_5;
diff --git a/main/linux-grsec/kernelconfig.x86 b/main/linux-grsec/kernelconfig.x86
index 14fbc4d832..f21ca50e0e 100644
--- a/main/linux-grsec/kernelconfig.x86
+++ b/main/linux-grsec/kernelconfig.x86
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux/i386 2.6.38.1 Kernel Configuration
-# Thu Mar 31 17:56:09 2011
+# Linux/i386 2.6.38.6 Kernel Configuration
+# Thu May 19 13:36:21 2011
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
@@ -296,10 +296,10 @@ CONFIG_NO_BOOTMEM=y
 # CONFIG_MEMTEST is not set
 # CONFIG_M386 is not set
 # CONFIG_M486 is not set
-# CONFIG_M586 is not set
+CONFIG_M586=y
 # CONFIG_M586TSC is not set
 # CONFIG_M586MMX is not set
-CONFIG_M686=y
+# CONFIG_M686 is not set
 # CONFIG_MPENTIUMII is not set
 # CONFIG_MPENTIUMIII is not set
 # CONFIG_MPENTIUMM is not set
@@ -318,25 +318,22 @@ CONFIG_M686=y
 # CONFIG_MVIAC7 is not set
 # CONFIG_MCORE2 is not set
 # CONFIG_MATOM is not set
-# CONFIG_X86_GENERIC is not set
+CONFIG_X86_GENERIC=y
 CONFIG_X86_CPU=y
-CONFIG_X86_INTERNODE_CACHE_SHIFT=5
+CONFIG_X86_INTERNODE_CACHE_SHIFT=6
 CONFIG_X86_CMPXCHG=y
 CONFIG_CMPXCHG_LOCAL=y
-CONFIG_X86_L1_CACHE_SHIFT=5
+CONFIG_X86_L1_CACHE_SHIFT=6
 CONFIG_X86_XADD=y
 # CONFIG_X86_PPRO_FENCE is not set
+CONFIG_X86_F00F_BUG=y
 CONFIG_X86_WP_WORKS_OK=y
 CONFIG_X86_INVLPG=y
 CONFIG_X86_BSWAP=y
 CONFIG_X86_POPAD_OK=y
 CONFIG_X86_ALIGNMENT_16=y
-CONFIG_X86_USE_PPRO_CHECKSUM=y
-CONFIG_X86_TSC=y
-CONFIG_X86_CMPXCHG64=y
-CONFIG_X86_CMOV=y
-CONFIG_X86_MINIMUM_CPU_FAMILY=5
-CONFIG_X86_DEBUGCTLMSR=y
+CONFIG_X86_INTEL_USERCOPY=y
+CONFIG_X86_MINIMUM_CPU_FAMILY=4
 # CONFIG_PROCESSOR_SELECT is not set
 CONFIG_CPU_SUP_INTEL=y
 CONFIG_CPU_SUP_CYRIX_32=y
@@ -361,9 +358,9 @@ CONFIG_X86_IO_APIC=y
 # CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS is not set
 # CONFIG_X86_MCE is not set
 CONFIG_VM86=y
-# CONFIG_TOSHIBA is not set
+CONFIG_TOSHIBA=m
 CONFIG_I8K=m
-# CONFIG_X86_REBOOTFIXUPS is not set
+CONFIG_X86_REBOOTFIXUPS=y
 CONFIG_MICROCODE=m
 CONFIG_MICROCODE_INTEL=y
 CONFIG_MICROCODE_AMD=y
@@ -382,19 +379,18 @@ CONFIG_PAGE_OFFSET=0xC0000000
 CONFIG_HIGHMEM=y
 # CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 # CONFIG_ARCH_DMA_ADDR_T_64BIT is not set
-CONFIG_NEED_NODE_MEMMAP_SIZE=y
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
 CONFIG_ILLEGAL_POINTER_VALUE=0
 CONFIG_SELECT_MEMORY_MODEL=y
-# CONFIG_FLATMEM_MANUAL is not set
-CONFIG_SPARSEMEM_MANUAL=y
-CONFIG_SPARSEMEM=y
-CONFIG_HAVE_MEMORY_PRESENT=y
+CONFIG_FLATMEM_MANUAL=y
+# CONFIG_SPARSEMEM_MANUAL is not set
+CONFIG_FLATMEM=y
+CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_SPARSEMEM_STATIC=y
 CONFIG_HAVE_MEMBLOCK=y
-# CONFIG_MEMORY_HOTPLUG is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_COMPACTION=y
 CONFIG_MIGRATION=y
@@ -556,7 +552,8 @@ CONFIG_PCI_IOAPIC=y
 CONFIG_ISA_DMA_API=y
 # CONFIG_ISA is not set
 # CONFIG_MCA is not set
-# CONFIG_SCx200 is not set
+CONFIG_SCx200=m
+CONFIG_SCx200HR_TIMER=m
 # CONFIG_OLPC is not set
 # CONFIG_OLPC_OPENFIRMWARE is not set
 CONFIG_AMD_NB=y
@@ -1296,6 +1293,7 @@ CONFIG_MTD_SC520CDP=m
 CONFIG_MTD_NETSC520=m
 CONFIG_MTD_TS5500=m
 CONFIG_MTD_SBC_GXX=m
+# CONFIG_MTD_SCx200_DOCFLASH is not set
 CONFIG_MTD_AMD76XROM=m
 CONFIG_MTD_ICHXROM=m
 CONFIG_MTD_ESB2ROM=m
@@ -2461,7 +2459,6 @@ CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_NONSTANDARD=y
 CONFIG_COMPUTONE=m
 CONFIG_ROCKETPORT=m
@@ -2553,6 +2550,7 @@ CONFIG_CARDMAN_4000=m
 CONFIG_CARDMAN_4040=m
 CONFIG_IPWIRELESS=m
 CONFIG_MWAVE=m
+# CONFIG_SCx200_GPIO is not set
 # CONFIG_PC8736x_GPIO is not set
 # CONFIG_NSC_GPIO is not set
 CONFIG_RAW_DRIVER=m
@@ -2566,7 +2564,6 @@ CONFIG_TCG_NSC=m
 CONFIG_TCG_ATMEL=m
 CONFIG_TCG_INFINEON=m
 CONFIG_TELCLOCK=m
-CONFIG_DEVPORT=y
 CONFIG_RAMOOPS=m
 CONFIG_I2C=m
 CONFIG_I2C_BOARDINFO=y
@@ -2891,6 +2888,7 @@ CONFIG_IT8712F_WDT=m
 CONFIG_IT87_WDT=m
 # CONFIG_HP_WATCHDOG is not set
 CONFIG_SC1200_WDT=m
+# CONFIG_SCx200_WDT is not set
 CONFIG_PC87413_WDT=m
 CONFIG_NV_TCO=m
 CONFIG_60XX_WDT=m
@@ -4021,7 +4019,7 @@ CONFIG_USB_STORAGE_ALAUDA=m
 CONFIG_USB_STORAGE_ONETOUCH=m
 CONFIG_USB_STORAGE_KARMA=m
 CONFIG_USB_STORAGE_CYPRESS_ATACB=m
-# CONFIG_USB_UAS is not set
+CONFIG_USB_UAS=m
 CONFIG_USB_LIBUSUAL=y
 
 #
@@ -4332,7 +4330,7 @@ CONFIG_UIO_PDRV=m
 CONFIG_UIO_PDRV_GENIRQ=m
 CONFIG_UIO_AEC=m
 CONFIG_UIO_SERCOS3=m
-# CONFIG_UIO_PCI_GENERIC is not set
+CONFIG_UIO_PCI_GENERIC=m
 CONFIG_UIO_NETX=m
 CONFIG_STAGING=y
 # CONFIG_STAGING_EXCLUDE_BUILD is not set
@@ -4434,7 +4432,7 @@ CONFIG_PANASONIC_LAPTOP=m
 CONFIG_COMPAL_LAPTOP=m
 CONFIG_SONY_LAPTOP=m
 # CONFIG_SONYPI_COMPAT is not set
-# CONFIG_IDEAPAD_LAPTOP is not set
+CONFIG_IDEAPAD_LAPTOP=m
 CONFIG_THINKPAD_ACPI=m
 CONFIG_THINKPAD_ACPI_ALSA_SUPPORT=y
 # CONFIG_THINKPAD_ACPI_DEBUGFACILITIES is not set
@@ -4453,7 +4451,7 @@ CONFIG_ACPI_ASUS=m
 CONFIG_ACPI_TOSHIBA=m
 CONFIG_TOSHIBA_BT_RFKILL=m
 CONFIG_ACPI_CMPC=m
-# CONFIG_INTEL_IPS is not set
+CONFIG_INTEL_IPS=m
 # CONFIG_IBM_RTL is not set
 
 #
@@ -4748,7 +4746,7 @@ CONFIG_PRINTK_TIME=y
 CONFIG_ENABLE_WARN_DEPRECATED=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FRAME_WARN=1024
-# CONFIG_MAGIC_SYSRQ is not set
+CONFIG_MAGIC_SYSRQ=y
 # CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
@@ -4787,6 +4785,7 @@ CONFIG_TRACING_SUPPORT=y
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_HAVE_ARCH_KMEMCHECK=y
+CONFIG_TEST_KSTRTOX=m
 CONFIG_STRICT_DEVMEM=y
 # CONFIG_X86_VERBOSE_BOOTUP is not set
 # CONFIG_EARLY_PRINTK is not set
@@ -4827,6 +4826,7 @@ CONFIG_GRKERNSEC_PROC_MEMMAP=y
 # CONFIG_GRKERNSEC_BRUTE is not set
 # CONFIG_GRKERNSEC_MODHARDEN is not set
 # CONFIG_GRKERNSEC_HIDESYM is not set
+# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
 
 #
 # Role Based Access Control Options
@@ -4928,7 +4928,7 @@ CONFIG_PAX_HAVE_ACL_FLAGS=y
 #
 CONFIG_PAX_NOEXEC=y
 CONFIG_PAX_PAGEEXEC=y
-# CONFIG_PAX_SEGMEXEC is not set
+CONFIG_PAX_SEGMEXEC=y
 CONFIG_PAX_EMUTRAMP=y
 CONFIG_PAX_MPROTECT=y
 # CONFIG_PAX_MPROTECT_COMPAT is not set
@@ -4939,7 +4939,6 @@ CONFIG_PAX_MPROTECT=y
 # Address Space Layout Randomization
 #
 CONFIG_PAX_ASLR=y
-# CONFIG_PAX_RANDKSTACK is not set
 CONFIG_PAX_RANDUSTACK=y
 CONFIG_PAX_RANDMMAP=y
 
@@ -4947,6 +4946,7 @@ CONFIG_PAX_RANDMMAP=y
 # Miscellaneous hardening features
 #
 # CONFIG_PAX_MEMORY_SANITIZE is not set
+# CONFIG_PAX_MEMORY_STACKLEAK is not set
 # CONFIG_PAX_MEMORY_UDEREF is not set
 CONFIG_PAX_REFCOUNT=y
 # CONFIG_PAX_USERCOPY is not set
diff --git a/main/linux-grsec/kernelconfig.x86_64 b/main/linux-grsec/kernelconfig.x86_64
index c830b9cc32..c035fc93bf 100644
--- a/main/linux-grsec/kernelconfig.x86_64
+++ b/main/linux-grsec/kernelconfig.x86_64
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux/x86_64 2.6.38.1 Kernel Configuration
-# Thu Mar 31 17:56:09 2011
+# Linux/x86_64 2.6.38.3 Kernel Configuration
+# Mon Apr 18 10:45:51 2011
 #
 CONFIG_64BIT=y
 # CONFIG_X86_32 is not set
@@ -2415,7 +2415,6 @@ CONFIG_CONSOLE_TRANSLATIONS=y
 CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
-# CONFIG_DEVKMEM is not set
 CONFIG_SERIAL_NONSTANDARD=y
 CONFIG_COMPUTONE=m
 CONFIG_ROCKETPORT=m
@@ -2518,7 +2517,6 @@ CONFIG_TCG_NSC=m
 CONFIG_TCG_ATMEL=m
 CONFIG_TCG_INFINEON=m
 CONFIG_TELCLOCK=m
-CONFIG_DEVPORT=y
 CONFIG_RAMOOPS=m
 CONFIG_I2C=m
 CONFIG_I2C_BOARDINFO=y
@@ -4707,7 +4705,7 @@ CONFIG_PRINTK_TIME=y
 CONFIG_ENABLE_WARN_DEPRECATED=y
 # CONFIG_ENABLE_MUST_CHECK is not set
 CONFIG_FRAME_WARN=1024
-# CONFIG_MAGIC_SYSRQ is not set
+CONFIG_MAGIC_SYSRQ=y 
 # CONFIG_STRIP_ASM_SYMS is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
@@ -4746,6 +4744,7 @@ CONFIG_TRACING_SUPPORT=y
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 CONFIG_HAVE_ARCH_KMEMCHECK=y
+CONFIG_TEST_KSTRTOX=m
 CONFIG_STRICT_DEVMEM=y
 # CONFIG_X86_VERBOSE_BOOTUP is not set
 # CONFIG_EARLY_PRINTK is not set
@@ -4784,6 +4783,7 @@ CONFIG_GRKERNSEC_PROC_MEMMAP=y
 # CONFIG_GRKERNSEC_BRUTE is not set
 # CONFIG_GRKERNSEC_MODHARDEN is not set
 # CONFIG_GRKERNSEC_HIDESYM is not set
+# CONFIG_GRKERNSEC_KERN_LOCKOUT is not set
 
 #
 # Role Based Access Control Options
@@ -4894,6 +4894,7 @@ CONFIG_PAX_MPROTECT=y
 # Address Space Layout Randomization
 #
 CONFIG_PAX_ASLR=y
+# CONFIG_PAX_RANDKSTACK is not set
 CONFIG_PAX_RANDUSTACK=y
 CONFIG_PAX_RANDMMAP=y
 
@@ -4901,6 +4902,7 @@ CONFIG_PAX_RANDMMAP=y
 # Miscellaneous hardening features
 #
 # CONFIG_PAX_MEMORY_SANITIZE is not set
+# CONFIG_PAX_MEMORY_STACKLEAK is not set
 CONFIG_PAX_REFCOUNT=y
 # CONFIG_PAX_USERCOPY is not set
 CONFIG_KEYS=y
author	Natanael Copa <ncopa@alpinelinux.org>	2011-05-24 12:53:50 +0000
committer	Natanael Copa <ncopa@alpinelinux.org>	2011-05-24 12:53:50 +0000
commit	8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d (patch)
tree	d32c69c9a8f6fa4c27eff3df871c71d6ae76876c /main/linux-grsec
parent	aeab26d98cd427c5b7effd561d230aae1515e3ea (diff)
download	aports-8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d.tar.bz2 aports-8b29ce3cf9a7ae91c08bfe1b7f62839bd657745d.tar.xz